Community

Forward is presenting at Security Field Day 16 this afternoon, and the session is streaming live for anyone to watch. It’s a great session if you’re responsible for exposure management, segmentation, or CVE prioritization at your organization.Register to get the livestream linkWhen: Today, Thursday, October 29, 2:30–4:00 PM PTSpeakers: Brandon Heller, CTO and Co-Founder, and Renata Budko, Senior Director of Product Management, Security and CloudVulnerability scanners sort findings by CVSS severity, and attack surface tools only see what faces the internet. Neither shows you what an attacker can actually reach. In this 90-minute session, the team will show how Forward's network digital twin ranks every critical asset by network exposure, vulnerability severity, and business criticality, giving you one remediation queue in priority order.This session will cover: How exposure, severity, and business criticality combine into a single risk score for each critical asset How transitive expo

Just a quick note here for future reference:Out of the box, Inventory+ shows both physical and virtual firewalls.  For example, a Fortigate with five VDOMs will probably result in 6 inventory items.If you want an inventory of just your hardware devices, you can achieve that by comparing the device.system.physicalName with the device.name.  If there is a difference we can assume that this device is a virtual one running on a physical firewall host.   Here is the code for convenience: /** * @intent Find only physical devices for inventory * @description This script checks to see if the device.system.physicalName is * different to device.name. If there is a difference we can be fairly certain * that this is a virtual device (e.g. virtual firewall on a physical piece of hardware) */foreach device in network.deviceslet isVirtual = isPresent(device.system.physicalName) && device.system.physicalName != device.nameselect { Device: device.name, Type: if isVirtual then "Virtu

Hello NQE Enthusiasts,Another challenge. ChallengePassport TaskLet’s assume you are an agent of Customs and Border Protection (CBP) and are working a border crossing from the US into Canada.  Citizens from the US and Canada DO NOT need a passport to cross the border.  Assume for this scenario that all other nationals do require a passport.  Write an NQE query that returns the  people in the list that require a passport, and who they are and where they are from.Input:List of people crossingBob Smith -  USZhang Wei - China Hiromasa Tahara - JapanJessica Northland - CanadaWess Maple - CanadaPeter Volkman - GermanyJeremy Clarkson- UKRachel Riley - UK Scott Ramirez - Spain Gabriel Martin - FranceKazuko Hashigawa - JapanThomas Bouchard - Canada Hint: Use lists (item in list) and ComparisonsContributions: John Schupp

 For many organizations, the challenge of gaining full visibility into all devices connected to their network goes beyond traditional routers, switches, and firewalls. Non-network devices—such as power controllers, printers, terminal servers and security cameras—are often left out of inventory reports, even though they can pose operational and security risks if unmanaged.This became a critical need for one of our large financial services customers. They required a way to inventory every device on their network, including thousands of non-network endpoints still accessible via SNMP. Their goal? Replace an existing NetBrain solution and consolidate into Forward Networks as their single source of truth.The result is the Endpoints feature—engineered to discover and report on any device Forward can authenticate to via CLI, SNMP, or API. This guide walks you through setting up SNMP Endpoints using real-world configurations and examples. With this workflow, you can generate a comprehensive in

Attempt to manage EoL - In progress

Is it possible to run a NQE query similar to aclEntry.lifecycleData?.lastUsed which returns the list of applications that has been identified passing through a security policy?Something similar to Palo Alto’s “apps seen” or Fortinet’s Fortiview Application Usage?

Can we make the api to download nqe reports in csv/ xlsx format a public api? I find this a lot more convenient than using the offset / limit api for fetching query results especially for very large datasets (greater than 500K records). 

On July 28, 2026, CISA, the Australian Signals Directorate's Australian Cyber Security Centre (ACSC), the FBI, and international partners released "CI Fortify – Advice for Isolating Vital Systems." The guidance gives critical infrastructure (CI) operators a practical framework for disconnecting vital operational technology (OT) from corporate, internet-facing, and other less-trusted networks — and for continuing to deliver essential services while isolated. Nearly every step in that framework comes down to two questions: which devices matter, and what paths connect them to everything else. This post summarizes the guidance and outlines how Forward Enterprise helps answer both. Who should read this postNetwork engineers and architects responsible for segmentation between IT, OT, and vendor/cloud networks   Incident response and business continuity planners building isolation and crisis-response plan   Security teams validating that segmentation and isolation controls actually work as de

A few weeks ago I wrote about what building Skyforge taught me about network emulation and digital twins. If you haven’t read it, you can find it here: The response was much larger than I expected, but one conversation afterwards stuck with me.An colleague mentioned they were starting to hear a different question from customers. It wasn’t really about digital twins anymore. It was about AI.If tools like Claude can generate software this quickly, doesn’t that fundamentally change the build-versus-buy equation?It’s a fair question, and honestly, it’s one I’ve been asking myself as well.After all, I spent the last six months building Skyforge with Claude sitting beside me. I don’t mean that as a marketing statement about AI. I mean it literally. Large parts of the platform, from Go services and Kubernetes manifests to GitOps workflows, deployment automation, documentation, and countless little pieces of glue code started life as conversations instead of blank files.There is absolutely no

Sometimes you just want to get the results of custom commands quickly.Here is what the command group contains for collection:show ip bgp summaryshow environmentshow interface statusshow ip routeshow port-channel summaryshow lldp neighborsshow ip arp vrf allshow ip arpshow mac address-tableshow inventoryshow interfacesshow cdp neighborsshow ip ospf interfaceshow ip ospf neighborsHere’s a template NXOS/*** @intent NX-OS Multi-Command **/getCommandResponse(device, commandText) = max(foreach command in device.outputs.commands where command.commandText == commandText select command.response);main = foreach device in network.devices where device.platform.vendor == Vendor.CISCO where device.platform.os == OS.NXOS where device.name == device.system.physicalName let bgpSummary = getCommandResponse(device, "show ip bgp summary") let environment = getCommandResponse(device, "show environment") let interfaceStatus = getCommandResponse(device, "show interface status

Some cyberattacks need a zero-day to make headlines. This one didn't. For years, Russian intelligence has simply walked through open doors: default SNMP community strings left unchanged, Cisco's Smart Install left switched on, routers nobody got around to patching. That activity was significant enough to bring eighteen agencies together on a single warning. NSA, CISA, FBI, and DC3 in the United States joined fourteen international partners, including the UK's NCSC, Australia's ACSC, and Canada's Cyber Centre, to co-sign a joint advisory: AA26-194A, "Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting." When that many agencies put their names on one document, it's worth reading closely. Russian FSB Center 16 actors (tracked in the industry as Berserk Bear, Energetic Bear, Dragonfly, and Static Tundra, among other names) have been opportunistically compromising routers and switches worldwide for over a decade, and they're still finding plenty of them, not through

Environment:Forward Networks (self-hosted) ServiceNow CMDB integration via NQE query Target class: cmdb_ci_ip_firewallIssue:When mapping System Criticality (a ServiceNow choice field) from an NQE query to ServiceNow via Forward's native CMDB integration, the field consistently reports "data type mismatched" regardless of the value format used.Attempted formats — all result in data type mismatched:"System Criticality": "2" "System Criticality": 2 "System Criticality": "2 - High" "System Criticality": ["2"] "System Criticality": [2] "System Criticality": ["2 - High"] Top-level named list: systemCriticality = ["2"] referenced in selectQuestion:Is ServiceNow choice field type mapping supported in Forward's NQE→CMDB integration? If so, what is the correct NQE syntax or integration configuration to map to a choice field without a type mismatch?Current workaround being considered:ServiceNow business rule that sets system_criticality = "2" on insert/update when discovery_source == "Forward Net

Does anyone know if there is a log or export for the push to service now? We are having an issue with service now processing the model_id (ref). It looks like forward is mapping “model” to both snow’s model_number and model_id. However, it looks like it isn’t being processed on the cmdb side. I just want to see if there is a way to show evidence of the payload forward is sending.  Thank you

On June 18, 2026, CISA issued an urgent advisory warning that malicious cyber actors — believed to be a Russian-speaking criminal group — have compromised nearly 74,000 Fortinet firewall and VPN devices across 194 countries in a campaign now dubbed FortiBleed. The list of affected organizations spans global enterprises and, most alarmingly, a Turkish NATO defense contractor from which classified documents were successfully exfiltrated. As of this writing, independent telemetry puts the number of compromised devices at over 86,000.CISA’s recommended actions are straightforward: terminate all SSL VPN and administrative sessions, reset credentials, enable phishing-resistant MFA, migrate password storage to PBKDF2 hashing, and restrict management interfaces from the public internet.Good advice. But reactive. The more important question is: could your team have known these conditions existed before attackers found them?The answer, for organizations running Forward Networks, is yes.The campa

A discussion at Cisco Live this year got me thinking about network emulation and digital twins. About six months ago, I started building Skyforge, an internal network emulation platform at Forward. The project started as an attempt to solve a practical problem: how do you quickly create realistic multi-vendor environments for demos, testing, and experimentation without maintaining racks of physical hardware? The name comes from The Elder Scrolls V: Skyrim, which is probably what happens when you spend too many hours playing video games and then find yourself naming infrastructure projects. Skyforge uses Kubernetes to orchestrate and manage emulated network environments, along with netlab to generate topologies, configurations, and deployment artifacts across multiple vendors. None of those technologies are particularly new, and individually they're all excellent at what they do. What surprised me wasn't getting the individual pieces working. What surprised me was how quickly the proble

As part of a network initiative, I’m sharing all the scripts that I have worked on to create an audit program. These files feed are then fed into PowerBi for better visualization by engineers and mgmt.First step is create a utility called, “tag_var_util” to grab tags, of which, will be used as part of the logic to assign a template to different sets of attribtues.This utility will then be imported on all other NQE Audit Scripts. // Create a new NQE Function called: tag_var_util// Add the following utility to extract tags given to devices in Forward Networks Sources// TAGS to identify Environmentexport get_env_from_tags(tags: Bag)= get_list_match_from_tags(tags, ["DC", "CoLo", "Branch", "AWS"]);// TAGS to identify a sub category of locationexport get_SubDc_from_tags(tags: Bag)= get_list_match_from_tags(tags, ["Branch", "DC01", "DC02" ]);// TAGS to identify which managers owns the productexport get_mgr_from_tags(tags: Bag)= get_list_match_from_tags(tags, ["Moe", "Larry", "Curly"]);//

CISA issued Binding Operational Directive 26-04 on June 10, 2026, fundamentally reshaping how federal agencies must prioritize and remediate vulnerabilities. Rather than treating all CVEs with equal urgency, BOD 26-04 establishes a risk-tiered patching framework built around four variables: whether the asset is publicly exposed, whether the vulnerability is in the Known Exploited Vulnerabilities (KEV) catalog, whether the exploit can be automated by an adversary, and the technical impact an attacker achieves after exploitation. The directive allows agencies to defer the lowest-risk vulnerabilities entirely to the next system upgrade, while demanding the fastest action—three days—on the highest-risk combinations. This post outlines what the directive requires and how Forward Enterprise helps organizations answer the questions that determine each risk tier. This directive supersedes both BOD 22-01 (Known Exploited Vulnerabilities) and BOD 19-02 (Vulnerability Remediation for Internet-Acc

As part of a network initiative, I’m sharing all the scripts that I have worked on to create an audit program. These files feed are then fed into PowerBi for better visualization by engineers and mgmt.Power Bi Display of Forward NQE belowStarting with AAA.First step is create a utility called, “tag_var_util” to grab tags, of which, will be used as part of the logic to assign a template to different sets of attribtues.This utility will then be imported on all other NQE Audit Scripts.// Best practice is to tag all devices with the following:// Environment && Sub-Environment && Manager && Region && Function && VRF && Mgmt-Interface (source interface for mgmt. traffic)// Each Script will import the utilities: import "PROD/Standards_Network/NetworkVars/tag_var_util"; let region = get_region_from_tags(device.tagNames) let deviceFunc = get_function_from_tags(device.tagNames) let environment = get_env_from_tags(device.tagNames) let vrf

we are using below format to collect the data from Fortinet firewall for custom command. endconfig globalshow system dnsshow system ntp can anyone check and confirm ,these will not impact anything ,if i remove config gloabl , than command will not run. 

There is a specific section of the AFM config which refers to the default action of the firewall, the below query checks that the default action is Drop.F5 AFM Config to check for.}sys db tm.fw.defaultaction {    value "drop"} /** * @intent Check that all F5's that are running AFM have the default action set to deny * @description THis will check sys db tm.fw.defaultaction for the value drop and error * if it is not drop. **/// Note {} have been removed as they can not be included in the pattern.defaultPattern = ```sys db tm.fw.defaultaction value "drop"```;foreach device in network.deviceswhere device.platform.os == OS.F5foreach command in device.outputs.commands//Check for only the F5's with AFM Configwhere command.commandType == CommandType.F5_AFM_CONFIG//Extract the command response.let AFMConfig = parseConfigBlocks(OS.F5,command.response)//Match the patternlet match = blockMatches(AFMConfig,defaultPattern)let violation = if length(match) == 0 then true else falselet DropActio

 Here are a set of 3 scripts for:NXOSEOSIOS (and IOS-XE)The scripts look for configuration related to source interfaces.  Over the years, engineers have used Loopback0, dedicated management interfaces, Loopback10, or other random interfaces to source traffic from. We have an an inititiative to clean these inconsistencies up.These scripts parse through the configs looking anything related to the ‘source-interface’ or ‘local-interface’ etc. Then it finds the associated configuration of those interfaces, such as IP Address, VRF, description.I have also tuned them to ignore parts of the configuration that are not important to the effort , ex:no ip redirectsno ip route-cacheno ip unreachablesno ip proxy-arpip mtu {number}load-interval {number}ip helper-address {string}negotiation autostandbye {string}etc...Cisco NXOS/*** * @intent Source-Interface Extraction (NXOS) * @description Extracts all source-interface configs and interface details from config text.***/// --- 1. Helper Functions ---g