What is the automated safety feature to prevent network wide outages/blocks?

Action Thresholds are a critical, built-in safety mechanism within the Forescout platform designed to prevent policy actions from causing widespread network disruption. This feature automatically suspends an action if the number of endpoints that match the policy's conditions exceeds a pre-configured limit. By doing so, it prevents unintended consequences, such as blocking a large number of critical devices or overloading network infrastructure, which could lead to a network-wide outage. The action is halted, and an alert is generated, allowing administrators to investigate before causing a major incident.

A. Stop all policies: This is a manual, system-wide command an administrator would issue, not an automated, preventative safety feature for a specific action.

B. Disable policy: This is a manual configuration change for a single policy, not an automated response to a high-impact event.

C. Disable Policy Action: This is a manual setting within a policy's sub-rule, not an automated safety trigger based on the number of affected endpoints.

E. Send an Email Alert: This is a notification, not a preventative control. It informs an administrator of an event but does not automatically stop the action causing it.

1. Forescout Administration Guide, Version 8.2.2: In the section "Working with Policies > Defining Policy Actions > Action Thresholds," the guide states, "Action thresholds are a safety mechanism that prevents Forescout eyeSight from applying an action to a large number of endpoints at once. This can prevent network overload or other undesirable consequences... When the number of endpoints that match a policy sub-rule exceeds the threshold, the action is automatically suspended." (Page 495)

2. Forescout Policy and Action Cookbook, Version 1.2: In the "Best Practices" section, it advises on the use of safety nets. "Use Action Thresholds: Configure action thresholds to prevent a policy from taking action on too many endpoints at once. This is a crucial safety net to avoid accidental, widespread network impact." (Section 3.1, "Policy Creation Best Practices")