What is the best practice to pass an endpoint from one policy to another?

Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:

According to the Forescout Platform Administration and Deployment Documentation, the best practice to pass an endpoint from one policy to another is to use SUB-RULES.​

Sub-Rules and Policy Routing:

Sub-rules are conditional branches within a Forescout policy that allow for sophisticated endpoint routing and handling. When an endpoint matches a sub-rule condition, it can be directed to perform specific actions or be passed to another policy group for further evaluation.​

Key Advantages of Using Sub-Rules:

Granular Control - Sub-rules enable precise segmentation of endpoints based on multiple properties and conditions

Hierarchical Processing - Once an endpoint matches a sub-rule, it proceeds down the sub-rule branch; later sub-rules of the policy are not evaluated for that endpoint​

Efficient Endpoint Routing - Sub-rules allow endpoints to be efficiently routed to appropriate policy handlers without evaluating unnecessary conditions

Policy Chaining - Sub-rules facilitate the logical flow and routing of endpoints through multiple policy layers

Best Practice Implementation:

The documentation emphasizes that when designing policies for endpoint management, administrators should:

Use sub-rules to create conditional branches that evaluate endpoints against multiple criteria

Route endpoints to appropriate policy handlers based on their properties and compliance status

Avoid using simple property-based routing when complex multi-step evaluation is needed​

Why Other Options Are Incorrect:

A. Use operating system property - While OS properties can be used in conditions, they are not the mechanism for passing endpoints between policies

C. Use function property - Function properties are not used for inter-policy endpoint routing

D. Use groups - While groups are useful for organizing endpoints, they are not the primary best practice for passing endpoints between policies

E. Use policy condition - Policy conditions define what endpoints should be evaluated, but sub-rules provide the actual routing mechanism

Referenced Documentation:

Forescout Platform Administration Guide - Defining Policy Sub-Rules​

"Defining Forescout Platform Policy Sub-Rules" - Best Practice section​

Sub-Rule Advanced Options documentation