An admission event is a trigger that initiates Forescout's process of discovering, classifying, and assessing an endpoint as it connects to or changes its state on the network. Events such as a DHCP request, a user logging into an authentication server (e.g., RADIUS), a new VPN connection, or an IP address change all signify a device's arrival or significant network identity change, prompting immediate evaluation. Conversely, a host becoming offline is a disconnection or departure event. While Forescout monitors this state change for asset management and licensing purposes, it is not an event that admits a device to the network for initial inspection.

A. DHCP Request: This is a primary admission event. The DHCP Classifier plugin monitors DHCP traffic to discover endpoints as soon as they request an IP address.

B. IP Address Change: This event triggers a re-evaluation of the host's policy compliance, as its network location and applicable rules may have changed, functioning as a new admission.

D. Login to an authentication server: This is a critical admission event, particularly in 802.1X environments, allowing Forescout to associate a user with a device and apply user-based policies.

E. New VPN user: A new VPN connection is an admission event for a remote endpoint joining the corporate network, initiating Forescout's assessment process for that device.

1. Forescout Platform and Base Modules Administration Guide 8.4.1, "Endpoint Detection" section, page 45. This section details how Forescout discovers endpoints, explicitly mentioning the DHCP Classifier plugin which "detects endpoints when they send DHCP requests to a DHCP server." This confirms DHCP requests are admission events.

2. Forescout Platform and Base Modules Administration Guide 8.4.1, "How Policies Are Evaluated" section, page 412. The documentation states, "Policy evaluation is triggered by events, for example, when an endpoint connects to the network, its IP address changes, or a user logs in." This confirms IP address changes and logins are admission events.

3. Forescout Authentication Module Configuration Guide 8.4, "About the Module" section, page 9. It describes how the module "learns about endpoints connecting to the network via RADIUS authentication and accounting messages," confirming authentication server logins are admission events.

4. Forescout VPN Concentrator Plugin Configuration Guide 8.4, "About the Plugin" section, page 8. The guide explains that the plugin "lets you monitor and control remote endpoints that connect to the network through VPNs," treating the connection as an event to be managed.