Forescout Platform Deployment

Script for Forescout to deploy and execute TYCHON Quantum Readiness on Windows endpoints:

# certscanner_deploy_and_scan.ps1
# Forescout deployment script for Windows endpoints

param(
    [string]$ForescoutServer = $env:FORESCOUT_SERVER,
    [string]$SyslogServer = $env:SYSLOG_SERVER,
    [string]$DeploymentTag = "forescout-managed"
)

$ToolsPath = "C:\Tools\TYCHON Quantum Readiness"
$ScannerURL = "http://internal-tools.company.com/certscanner/windows/certscanner-windows-amd64.exe"
$ScannerPath = "$ToolsPath\certscanner.exe"
$ResultsPath = "$ToolsPath\scan-results.json"

try {
    Write-Host "🔄 Forescout TYCHON Quantum Readiness deployment starting on $env:COMPUTERNAME..."
    
    # Create tools directory
    if (!(Test-Path $ToolsPath)) {
        New-Item -Path $ToolsPath -ItemType Directory -Force | Out-Null
        Write-Host "📁 Created tools directory: $ToolsPath"
    }
    
    # Download or update TYCHON Quantum Readiness binary
    if (!(Test-Path $ScannerPath) -or (Get-Item $ScannerPath).LastWriteTime -lt (Get-Date).AddDays(-7)) {
        Write-Host "📦 Downloading TYCHON Quantum Readiness binary..."
        Invoke-WebRequest -Uri $ScannerURL -OutFile $ScannerPath -UseBasicParsing
        Write-Host "✅ TYCHON Quantum Readiness binary updated"
    }
    
    # Execute comprehensive local scan
    Write-Host "🔍 Executing cryptographic asset scan..."
    $ScanArgs = @(
        "-mode", "local",
        "-scanfilesystem",
        "-scanmemory", 
        "-scanconnected",
        "-scanoutlookarchives",
        "-outputformat", "flatndjson",
        "-output", $ResultsPath,
        "-tags", "$DeploymentTag,forescout-policy,$env:COMPUTERNAME"
    )
    
    Start-Process -FilePath $ScannerPath -ArgumentList $ScanArgs -Wait -NoNewWindow
    
    if ($LASTEXITCODE -eq 0) {
        Write-Host "✅ Crypto scan completed successfully"
        
        # Report to Forescout via custom property
        $ScanSummary = Get-Content $ResultsPath | ConvertFrom-Json
        $CertCount = ($ScanSummary | Measure-Object).Count
        
        # Update Forescout device properties
        $PropertyUpdate = @{
            "last_crypto_scan" = Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ"
            "crypto_assets_found" = $CertCount
            "certscanner_status" = "completed"
        } | ConvertTo-Json
        
        # Send results to syslog/SIEM if configured
        if ($SyslogServer) {
            Write-Host "📤 Sending results to SIEM: $SyslogServer"
            
            # Read and send each NDJSON line to syslog
            Get-Content $ResultsPath | ForEach-Object {
                $LogMessage = "CEF:0|Tychon|TYCHON Quantum Readiness|1.0.42|CRYPTO_SCAN|Cryptographic Asset Discovery|Medium|src=$env:COMPUTERNAME dhost=$env:COMPUTERNAME msg=$_"
                
                # Send via TCP syslog (port 514)
                try {
                    $Socket = New-Object System.Net.Sockets.TcpClient($SyslogServer, 514)
                    $Stream = $Socket.GetStream()
                    $Bytes = [System.Text.Encoding]::UTF8.GetBytes($LogMessage + "`n")
                    $Stream.Write($Bytes, 0, $Bytes.Length)
                    $Stream.Close()
                    $Socket.Close()
                } catch {
                    Write-Warning "Failed to send log to $SyslogServer : $($_.Exception.Message)"
                }
            }
        }
        
        Write-Host "📊 Scan summary: $CertCount crypto assets discovered"
        
    } else {
        Write-Error "❌ TYCHON Quantum Readiness execution failed with exit code: $LASTEXITCODE"
        
        # Report failure to Forescout
        $PropertyUpdate = @{
            "last_crypto_scan" = Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ"
            "certscanner_status" = "failed"
            "error_code" = $LASTEXITCODE
        } | ConvertTo-Json
        
        exit 1
    }
    
} catch {
    Write-Error "❌ Deployment script failed: $($_.Exception.Message)"
    exit 1
} finally {
    # Optional: Clean up results file after transmission
    # if (Test-Path $ResultsPath) { Remove-Item $ResultsPath -Force }
}

Write-Host "🎯 Forescout TYCHON Quantum Readiness deployment completed"

Splunk search queries for Forescout TYCHON Quantum Readiness data:

// Search for crypto assets discovered via Forescout
index=security source="forescout_syslog" CEF_Name="CRYPTO_DISCOVERY"
| spath input=CEF_Message 
| eval scan_data=json_extract(msg, "$")
| stats count by src, cs1, cs2
| sort -count

// Find PQC-vulnerable devices managed by Forescout  
index=security source="forescout_syslog" CEF_Name="CRYPTO_DISCOVERY"
| spath input=CEF_Message
| eval scan_results=json_extract(msg, "$")
| search scan_results.tychon.pqc_vulnerable=true
| table _time, src, scan_results.certificate.subject.common_name, scan_results.cipher.name
| sort -_time

// Monitor Forescout TYCHON Quantum Readiness deployment status
index=security source="forescout_syslog" 
| search CEF_Name="CRYPTO_DISCOVERY" OR CEF_Name="SCRIPT_EXECUTION"
| stats latest(CEF_Name) as last_action, latest(_time) as last_seen by src
| eval status=if(last_action="CRYPTO_DISCOVERY", "scan_completed", "deployment_only")
| sort -last_seen