Aruba ClearPass (syslog)

Configure ClearPass Policy Manager to forward syslog logs to Radiant Security.

In this guide, you will set up a trusted relationship between Radiant and your Aruba ClearPass account to forward logs to Radiant Security via a syslog forwarder.

Prerequisites

• Admin access to the Aruba ClearPass console

Add the data connector in Radiant Security

1. Log in to Radiant Security.

2. From the navigation menu, select Settings > Data Connectors and click + Add Connector.

3. Search for and select the Radiant Agent option and click Data Feeds.

4. Under Select your data feeds, select Aruba ClearPass (syslog) and click Credentials.

5. Under Credential Name, give the Radiant Agent integration an identifiable name (e.g. Aruba ClearPass Credentials) or reuse a pre-existing Radiant Agent integration.

6. Click Add Connector.

Configure a Radiant Agent for log collection

Refer to the Install the Radiant Security Agent guide to set up a local agent to collect the logs.

Adding a syslog target on Aruba ClearPass

1. Access the Aruba ClearPass console.

2. Navigate to Administration > External Servers > Syslog Targets.

   
3. Click Add.

4. Enter the following parameters:

   1. Host Address: <radiant_agent_internal_address>

   2. Description: Radiant Security On-Prem Log Collector

   3. Protocol: UDP

   4. Server Port: <port_configured_to_receive_aruba_clearpass>

5. Click Save.

Configure log forwarding on Aruba ClearPass

1. Access the Aruba ClearPass console.

2. Navigate to Administration > External Servers > Syslog Export Filters.

3. Click Add.

4. Enter the following parameters:

   1. Name: Radiant Security Session Logs - Logged in users

   2. Description: Radiant Security Syslog Forwarder

   3. Export Template: Session Logs

   4. Export Event Format Type: CEF

   5. ClearPass Servers: Leave it blank

      
5. Click the Filter and Columns tab and configure the following:

   1. Data Filter: [All Requests]

   2. Columns Selection: Select one of the Predefined Field Group values from the table below:

   Export Template	Predefined Field Group
   Session Logs	Failed Authentications
   Session Logs	Guest Access
   Session Logs	Logged in users
   Session Logs	RADIUS Accounting
   Session Logs	TACACS+ Accounting
   Insight Logs	Endpoints
   Insight Logs	ClearPass Guest
   Insight Logs	Onboard Enrollment
   Insight Logs	RADIUS Authentications
   Insight Logs	RADIUS Failed Authentications
   Insight Logs	TACACS Authentication
   Insight Logs	TACACS Failed Authentication
   Insight Logs	WEBAUTH Failed Authentications
   Insight Logs	WEBAUTH
   Insight Logs	Application Authentication
   Insight Logs	Posture Antivirus Summary
   Insight Logs	Posture Antispyware Summary
   Insight Logs	Posture DiskEncryption Summary
   Insight Logs	Posture Summary

6. Click Save.

7. Repeat steps 3 and 4 for all the Export Templates and Predefined Field Group from the table.

8. Each Syslog Export Filter can only support one export template and one predefined group. The final result should look like this: