Skip to content

Aruba ClearPass

Overview

Aruba ClearPass is a vendor-agnostic network access control (NAC) and policy management platform by HPE Aruba Networking that automates security compliance and role-based access for all users, devices, and IoT endpoints.

  • Vendor: Aruba Networks
  • Supported environment: On-Prem
  • Detection based on: Telemetry

Configure

Instructions on Sekoia

Configure Your Intake

This section will guide you through creating the intake object in Sekoia, which provides a unique identifier called the "Intake key." The Intake key is essential for later configuration, as it references the Community, Entity, and Parser (Intake Format) used when receiving raw events on Sekoia.

  1. Go to the Sekoia Intake page.
  2. Click on the + New Intake button at the top right of the page.
  3. Search for your Intake by the product name in the search bar.
  4. Give it a Name and associate it with an Entity (and a Community if using multi-tenant mode).
  5. Click on Create.

Note

For more details on how to use the Intake page and to find the Intake key you just created, refer to this documentation.

Configure a forwarder

To forward events using syslog to Sekoia.io, you need to update the syslog header with the intake key you previously created. Here is an example of your message before the forwarder 

<%pri%>1 %timestamp:::date-rfc3339% %hostname% %app-name% %procid% LOG RAW_MESSAGE
and after 
<%pri%>1 %timestamp:::date-rfc3339% %hostname% %app-name% %procid% LOG [SEKOIA@53288 intake_key=\"YOUR_INTAKE_KEY\"] RAW_MESSAGE

To achieve this you can:

  • Use the Sekoia.io forwarder which is the official supported way to collect data using the syslog protocol in Sekoia.io. In charge of centralizing data coming from many equipments/sources and forwarding them to Sekoia.io with the apporpriated format, it is a prepackaged option. You only have to provide your intake key as parameter.
  • Use your own Syslog service instance. Maybe you already have an intance of one of these components on your side and want to reuse it in order to centralize data before forwarding them to Sekoia.io. When using this mode, you have to configure and maintain your component in order to respect the expected Sekoia.io format.

Warning

Only the Sekoia.io forwarder is officially supported. Other options are documented for reference purposes but do not have official support.

Configure Aruba ClearPass syslog server

  1. Sign in to the ClearPass Policy Manager console.
  2. Select Administration > External servers > Syslog targets.
  3. Click Add.
  4. In the Add syslog target window that appears, specify the following details:
    • Host address: enter the syslog concentrator IP address.
    • Server port: enter the syslog concentrator port number.
    • Protocol: select UDP (you can also select TCP, depending on your syslog concentrator configuration).
  5. Click Save.

Configure syslog export filters

  1. Go to Administration > External servers > Syslog export filters.
  2. Click Add.
  3. In the Add Syslog Filters window that appears, specify the following in the General tab:
    • Name: enter the syslog export filter name based on the table in Export template items.
    • Export template: select the appropriate export template based on the table in Export template items.
    • Export event format type: select CEF.
    • Syslog servers: select the syslog concentrator IP address.
  4. In the Export template list, when you select the Session or Insight export templates, the Filter and columns tab is enabled. Complete the following steps:
    • Click the Filter and columns tab.
    • Data filter: make sure the default value All requests is selected.
    • Column selection: select the predefined field groups you want to get.
    • Click the Summary tab.
    • Click Save.
  5. In the Export template list, when you select the System events and Audit records export templates, the Filter and columns tab is not enabled. Proceed to the Summary tab and click Save.
  6. Repeat steps to add syslog export filters for all Session, Insight, Audit records and System events export templates based on the details from the table in Export template items.

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

CEF:0|Aruba Networks|ClearPass|6.6.1.84176|3002|Syslog Export Data| 2|rt=Aug 01 2016 11:16:32 fname=Intel Radius Authenication cat=Audit Records duser=admin dvc=192.0.2.10 act=REMOVE

CEF:0|Aruba Networks|ClearPass|6.6.1.84176|1009|Endpoints|1| dmac=020000000001 cs6=Acme Inc. cs6Label=Endpoint.MAC-Vendor dst=192.0.2.10 duser=johndoe cs3=Computer cs3Label=Endpoint.Device-Category cs4=Linux cs4Label=Endpoint.Device-Family cs5=Linux Computer cs5Label=Endpoint.Device-Name ArubaClearpassEndpointConflict=f ArubaClearpassEndpointStatus=Known deviceCustomDate1=Aug 03 2016 14:31:54 deviceCustomDate1Label=Endpoint.Added-At rt=Aug 11 2016 14:56:52 dvc=198.51.100.20 cat=Insight Logs

CEF:0|Aruba Networks|ClearPass|6.11.14.265169|1003|TACACS Authentication|5|cat=Insight Logs dvc=192.0.2.10 duser=JOHNDOE cs2=TACACS_AUTHORIZATION cs2Label=Request Type src=198.51.100.20 cs6=Example R9 cs6Label=Tacacs Service cs3=REDACTED cs3Label=Authentication Source dpriv=[User Authenticated] cs5=ANONYMIZED cs5Label=Enforcement Profiles cs4=0 cs4Label=Privilege Level destinationServiceName=REDACTED ArubaClearpassTacacsCommand=shell exec ArubaClearpassCppmNodeCPPM=EXAMPLE.example.invalid cn3=0 cn3Label=CPPM Error Code ArubaClearpassCppmErrorCodeErrorCodeDetails=Success

CEF:0|Aruba Networks|ClearPass|6.6.1.84176|2006|Guest Access|1| duser=johndoe dmac=020000000001 dpriv=[User Authenticated] cs2=UNKNOWN cs2Label=System Posture Token outcome=[Allow Access Profile] rt=Aug 10 2016 15:16:51 dvc=192.0.2.10 cat=Session Logs

CEF:0|Aruba Networks|ClearPass|6.11.14.265169|2000|Logged in users|1|cat=Session Logs dvc=192.0.2.10 duser=JOHNDOE destinationServiceName=REDACTED Y0 dpriv=[User Authenticated] src=198.51.100.20 rt=Aug 21 2026 04:59:39

CEF:0|Aruba Networks|ClearPass|6.6.1.84176|4009|restart|1| dvc=192.0.2.10 deviceProcessName=Policy server outcome=Success rt=Aug 23 2016 16:55:23 cat=ClearPassSystemEvents

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Network device logs None

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind ``
Category authentication, configuration, host, process
Type change, creation, deletion, info

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

{
    "message": "CEF:0|Aruba Networks|ClearPass|6.6.1.84176|3002|Syslog Export Data| 2|rt=Aug 01 2016 11:16:32 fname=Intel Radius Authenication cat=Audit Records duser=admin dvc=192.0.2.10 act=REMOVE",
    "event": {
        "action": "REMOVE",
        "category": [
            "configuration"
        ],
        "code": "3002",
        "dataset": "aruba-clearpass.audit",
        "severity": 2,
        "type": [
            "deletion"
        ]
    },
    "@timestamp": "2016-08-01T11:16:32Z",
    "aruba": {
        "clearpass": {
            "category": "Audit Records",
            "name": "Syslog Export Data",
            "object_name": "Intel Radius Authenication"
        }
    },
    "observer": {
        "ip": "192.0.2.10",
        "product": "ClearPass",
        "vendor": "Aruba Networks",
        "version": "6.6.1.84176"
    },
    "related": {
        "ip": [
            "192.0.2.10"
        ],
        "user": [
            "admin"
        ]
    },
    "user": {
        "name": "admin"
    }
}

{
    "message": "CEF:0|Aruba Networks|ClearPass|6.6.1.84176|1009|Endpoints|1| dmac=020000000001 cs6=Acme Inc. cs6Label=Endpoint.MAC-Vendor dst=192.0.2.10 duser=johndoe cs3=Computer cs3Label=Endpoint.Device-Category cs4=Linux cs4Label=Endpoint.Device-Family cs5=Linux Computer cs5Label=Endpoint.Device-Name ArubaClearpassEndpointConflict=f ArubaClearpassEndpointStatus=Known deviceCustomDate1=Aug 03 2016 14:31:54 deviceCustomDate1Label=Endpoint.Added-At rt=Aug 11 2016 14:56:52 dvc=198.51.100.20 cat=Insight Logs",
    "event": {
        "category": [
            "host"
        ],
        "code": "1009",
        "dataset": "aruba-clearpass.insight",
        "severity": 1,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2016-08-11T14:56:52Z",
    "aruba": {
        "clearpass": {
            "category": "Insight Logs",
            "endpoint": {
                "added_at": "2016-08-03T14:31:54Z",
                "conflict": false,
                "device_category": "Computer",
                "device_name": "Linux Computer",
                "mac_vendor": "Acme Inc.",
                "status": "Known"
            },
            "name": "Endpoints"
        }
    },
    "destination": {
        "address": "192.0.2.10",
        "ip": "192.0.2.10",
        "mac": "02:00:00:00:00:01"
    },
    "host": {
        "os": {
            "family": "Linux"
        }
    },
    "observer": {
        "ip": "198.51.100.20",
        "product": "ClearPass",
        "vendor": "Aruba Networks",
        "version": "6.6.1.84176"
    },
    "related": {
        "ip": [
            "192.0.2.10",
            "198.51.100.20"
        ],
        "user": [
            "johndoe"
        ]
    },
    "user": {
        "name": "johndoe"
    }
}

{
    "message": "CEF:0|Aruba Networks|ClearPass|6.11.14.265169|1003|TACACS Authentication|5|cat=Insight Logs dvc=192.0.2.10 duser=JOHNDOE cs2=TACACS_AUTHORIZATION cs2Label=Request Type src=198.51.100.20 cs6=Example R9 cs6Label=Tacacs Service cs3=REDACTED cs3Label=Authentication Source dpriv=[User Authenticated] cs5=ANONYMIZED cs5Label=Enforcement Profiles cs4=0 cs4Label=Privilege Level destinationServiceName=REDACTED ArubaClearpassTacacsCommand=shell exec ArubaClearpassCppmNodeCPPM=EXAMPLE.example.invalid cn3=0 cn3Label=CPPM Error Code ArubaClearpassCppmErrorCodeErrorCodeDetails=Success",
    "event": {
        "category": [
            "authentication"
        ],
        "code": "1003",
        "dataset": "aruba-clearpass.insight",
        "severity": 5,
        "type": [
            "info"
        ]
    },
    "aruba": {
        "clearpass": {
            "category": "Insight Logs",
            "name": "TACACS Authentication"
        }
    },
    "observer": {
        "ip": "192.0.2.10",
        "product": "ClearPass",
        "vendor": "Aruba Networks",
        "version": "6.11.14.265169"
    },
    "related": {
        "ip": [
            "192.0.2.10",
            "198.51.100.20"
        ],
        "user": [
            "JOHNDOE"
        ]
    },
    "source": {
        "address": "198.51.100.20",
        "ip": "198.51.100.20"
    },
    "user": {
        "name": "JOHNDOE",
        "roles": [
            "User Authenticated"
        ]
    }
}

{
    "message": "CEF:0|Aruba Networks|ClearPass|6.6.1.84176|2006|Guest Access|1| duser=johndoe dmac=020000000001 dpriv=[User Authenticated] cs2=UNKNOWN cs2Label=System Posture Token outcome=[Allow Access Profile] rt=Aug 10 2016 15:16:51 dvc=192.0.2.10 cat=Session Logs",
    "event": {
        "category": [
            "authentication"
        ],
        "code": "2006",
        "dataset": "aruba-clearpass.session",
        "severity": 1,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2016-08-10T15:16:51Z",
    "aruba": {
        "clearpass": {
            "category": "Session Logs",
            "enforcement_profile": "[Allow Access Profile]",
            "name": "Guest Access",
            "system_posture_token": "UNKNOWN"
        }
    },
    "destination": {
        "mac": "02:00:00:00:00:01"
    },
    "observer": {
        "ip": "192.0.2.10",
        "product": "ClearPass",
        "vendor": "Aruba Networks",
        "version": "6.6.1.84176"
    },
    "related": {
        "ip": [
            "192.0.2.10"
        ],
        "user": [
            "johndoe"
        ]
    },
    "user": {
        "name": "johndoe",
        "roles": [
            "User Authenticated"
        ]
    }
}

{
    "message": "CEF:0|Aruba Networks|ClearPass|6.11.14.265169|2000|Logged in users|1|cat=Session Logs dvc=192.0.2.10 duser=JOHNDOE destinationServiceName=REDACTED Y0 dpriv=[User Authenticated] src=198.51.100.20 rt=Aug 21 2026 04:59:39",
    "event": {
        "category": [
            "authentication"
        ],
        "code": "2000",
        "dataset": "aruba-clearpass.session",
        "severity": 1,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-08-21T04:59:39Z",
    "aruba": {
        "clearpass": {
            "category": "Session Logs",
            "name": "Logged in users"
        }
    },
    "observer": {
        "ip": "192.0.2.10",
        "product": "ClearPass",
        "vendor": "Aruba Networks",
        "version": "6.11.14.265169"
    },
    "related": {
        "ip": [
            "192.0.2.10",
            "198.51.100.20"
        ],
        "user": [
            "JOHNDOE"
        ]
    },
    "source": {
        "address": "198.51.100.20",
        "ip": "198.51.100.20"
    },
    "user": {
        "name": "JOHNDOE",
        "roles": [
            "User Authenticated"
        ]
    }
}

{
    "message": "CEF:0|Aruba Networks|ClearPass|6.6.1.84176|4009|restart|1| dvc=192.0.2.10 deviceProcessName=Policy server outcome=Success rt=Aug 23 2016 16:55:23 cat=ClearPassSystemEvents",
    "event": {
        "category": [
            "process"
        ],
        "code": "4009",
        "dataset": "aruba-clearpass.system",
        "outcome": "success",
        "severity": 1,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2016-08-23T16:55:23Z",
    "aruba": {
        "clearpass": {
            "category": "ClearPassSystemEvents",
            "name": "restart"
        }
    },
    "observer": {
        "ip": "192.0.2.10",
        "product": "ClearPass",
        "vendor": "Aruba Networks",
        "version": "6.6.1.84176"
    },
    "process": {
        "name": "Policy server"
    },
    "related": {
        "ip": [
            "192.0.2.10"
        ]
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
aruba.clearpass.category keyword Event category
aruba.clearpass.endpoint.added_at datetime Timestamp when a device is added
aruba.clearpass.endpoint.device_category keyword Device category
aruba.clearpass.endpoint.device_name keyword Device name
aruba.clearpass.endpoint.mac_vendor keyword MAC vendor
aruba.clearpass.endpoint.status keyword Status
aruba.clearpass.enforcement_profile keyword Enforcement profile
aruba.clearpass.name keyword Event name
aruba.clearpass.object_name keyword Name of the configuration object targeted by an audit record
aruba.clearpass.system_posture_token keyword System posture token
destination.ip ip IP address of the destination.
destination.mac keyword MAC address of the destination.
event.action keyword The action captured by the event.
event.category keyword Event category. The second categorization field in the hierarchy.
event.code keyword Identification code for this event.
event.dataset keyword Name of the dataset.
event.outcome keyword The outcome of the event. The lowest level categorization field in the hierarchy.
event.severity long Numeric severity of the event.
event.type keyword Event type. The third categorization field in the hierarchy.
host.os.family keyword OS family (such as redhat, debian, freebsd, windows).
observer.ip ip IP addresses of the observer.
observer.product keyword The product name of the observer.
observer.vendor keyword Vendor name of the observer.
observer.version keyword Observer version.
process.name keyword Process name.
source.ip ip IP address of the source.
user.name keyword Short name or login of the user.
user.roles keyword Array of user roles at the time of the event.

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.