From af0943b7e7375a8f371094657e82819f83242ffa Mon Sep 17 00:00:00 2001 From: lvoloshyn-sekoia Date: Thu, 3 Sep 2026 15:14:33 +0300 Subject: [PATCH] Aruba ClearPass - add docs --- .../network_security/aruba_clearpass.md | 54 +++++++++++++++++++ mkdocs.yml | 1 + 2 files changed, 55 insertions(+) create mode 100644 docs/integration/categories/network_security/aruba_clearpass.md diff --git a/docs/integration/categories/network_security/aruba_clearpass.md b/docs/integration/categories/network_security/aruba_clearpass.md new file mode 100644 index 0000000000..ce59398c50 --- /dev/null +++ b/docs/integration/categories/network_security/aruba_clearpass.md @@ -0,0 +1,54 @@ +uuid: bbbb10ea-72a1-4b60-8385-6543b588dc3f +name: Aruba ClearPass +type: intake + +## Overview + +Aruba ClearPass is a vendor-agnostic network access control (NAC) and policy management platform by HPE Aruba Networking that automates security compliance and role-based access for all users, devices, and IoT endpoints. + +- **Vendor**: Aruba Networks +- **Supported environment**: On-Prem +- **Detection based on**: Telemetry + +## Configure + +### Instructions on Sekoia + +{!_shared_content/integration/intake_configuration.md!} + +{!_shared_content/integration/forwarder_configuration.md!} + +### Configure Aruba ClearPass syslog server +1. Sign in to the **ClearPass Policy Manager** console. +2. Select **Administration > External servers > Syslog targets**. +3. Click **Add**. +4. In the **Add syslog target** window that appears, specify the following details: + - **Host address**: enter the syslog concentrator IP address. + - **Server port**: enter the syslog concentrator port number. + - **Protocol**: select **UDP** (you can also select **TCP**, depending on your syslog concentrator configuration). +5. Click **Save**. + +### Configure syslog export filters +1. Go to **Administration > External servers > Syslog export filters**. +2. Click **Add**. +3. In the **Add Syslog Filters** window that appears, specify the following in the **General** tab: + - **Name**: enter the syslog export filter name based on the table in Export template items. + - **Export template**: select the appropriate export template based on the table in Export template items. + - **Export event format type**: select CEF. + - **Syslog servers**: select the syslog concentrator IP address. +4. In the **Export template** list, when you select the **Session** or **Insight** export templates, the **Filter and columns** tab is enabled. Complete the following steps: + - Click the **Filter and columns** tab. + - **Data filter**: make sure the default value All requests is selected. + - **Column selection**: select the predefined field groups you want to get. + - Click the **Summary** tab. + - Click **Save**. +5. In the Export template list, when you select the System events and Audit records export templates, the Filter and columns tab is not enabled. Proceed to the Summary tab and click Save. +6. Repeat steps to add syslog export filters for all Session, Insight, Audit records and System events export templates based on the details from the table in Export template items. + +{!_shared_content/operations_center/integrations/generated/bbbb10ea-72a1-4b60-8385-6543b588dc3f_sample.md!} + +{!_shared_content/integration/detection_section.md!} + +{!_shared_content/operations_center/detection/generated/suggested_rules_bbbb10ea-72a1-4b60-8385-6543b588dc3f_do_not_edit_manually.md!} + +{!_shared_content/operations_center/integrations/generated/bbbb10ea-72a1-4b60-8385-6543b588dc3f.md!} diff --git a/mkdocs.yml b/mkdocs.yml index fc539c6a32..a6ef0f4ffd 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -490,6 +490,7 @@ nav: - Akamai Guardicore Saas: integration/categories/network_security/akamai_guardicore_saas.md - Akamai WAF: integration/categories/network_security/akamai_waf.md - Aleph Alerts: integration/categories/network_security/aleph_alerts.md + - Aruba ClearPass: integration/categories/network_security/aruba_clearpass.md - AWS CloudTrail: integration/categories/network_security/aws_cloudtrail.md - Amazon CloudFront Logs: integration/categories/network_security/aws_cloudfront.md - Amazon GuardDuty: integration/categories/network_security/aws_guardduty.md