Foresight Cyber Platform

The Foresight Cyber Platform (the FCP) is a collection of applications and systems, part open source and part internally coded: designed and created by our technical gurus to enable seamless delivery of our various managed services, such as Skybox Security and Qualys managed services, and other as per clients’ requirements. The FCP is an in-house developed software licenced under the Elastic License 2.0 (https://foresightcyber.com/fcp-licence ) and is free to use for non-commercial purposes. 

See the wiki of the platform on a dedicated website: https://fcpc.online/

Our teams have been developing the FCP based on requirements from our own IT and service delivery teams and our clients. 

The high-level capabilities of the FCP are:

• Automate Foresight Cyber services delivery 
• Asset discovery, Asset monitoring & Asset inventory correlations
• Connects to technologies such as Qualys, Skybox, Zabbix, ServiceNow! and more
• Hosted inside clients’ networks or in our datacentre
• Extensible with newly built modules to satisfy new requirements 

Asset management is the cornerstone of cyber security as "one cannot protect what one does not know about". From our experience, though, there is no single bullet on doing asset discovery, updates and management perfectly. The closest one can get to is an automated system to read multiple asset relevant information sources and perform automated correlations and reporting.  

This is what the FCP does!  

The Foresight Cyber Platform can help answer the following sample questions:  

• Which assets are new on the network? 
• Which assets are not available anymore? 
• How are discovered assets documented within CMDB? 
• Can I find owners of unknown assets? 
• If a change or network problem was detected. Who logged in on a specific system within this time range?  

The platform itself does not replace a standard CMDB within the company. Instead, the FCP can enrich the asset data with information from CMDB. After the correlations and further data enrichment from other data sources, the FCP can update CMDB.  

For example, after a vulnerability scan, the scan data is imported to the FCP, enhanced with data from other sources (such as DNS, network netflow logs, Active Directory),  and then pushed the data back to the CMDB. Likewise, the FCP can inform the vulnerability scanner about new assets and initiate a vulnerability scan.