Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:

According to the Forescout Administration Guide, when creating a new "Send Mail" notification action, the email configured under Options > General > Mail is used by default.​

Default Email Configuration:

According to the Managing Email Notifications documentation:​

"From the Tools menu, select Options > General > Mail and DNS. Update any of the following fields: Send Email Alerts / Notifications - List email addresses to receive CounterACT email alerts."

This setting establishes the default recipients for all email notifications across the system.

Email Notification Hierarchy:

According to the documentation:​

Default Recipients (Options > General > Mail) - Used when no specific recipients are defined

Policy-Specific Recipients - Can override defaults in individual policy actions

Action-Level Recipients - The "Send Mail" action can specify custom recipients

When "Send Mail" Action Uses Defaults:

According to the documentation:​

When you create a "Send Mail" action without specifying custom recipients, the system automatically uses the email addresses configured in:

Tools > Options > General > Mail and DNS

The "Send Email Alerts/Notifications" field

Why Other Options Are Incorrect:

B. Email of the last logged in user - The system doesn't track login history for email defaults

C. The Tech Support email - There is no "Tech Support email" setting in Forescout

D. Email used for license registration - License email is not used for policy notifications

E. Email entered in the send mail action on the rule - While this CAN override defaults, it's not the DEFAULT used when creating the action

Referenced Documentation:

Managing Forescout Platform Email Notifications​

Managing Email Notifications​

Managing Email Notification Addresses​