Security

last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

How to write Clearpass : Authentication Source : Insight Repository : Filter Query

This thread has been viewed 14 times

  • 1.  How to write Clearpass : Authentication Source : Insight Repository : Filter Query

    Posted Mar 11, 2014 05:22 AM

    Hi Guys, I'm using Clearpass 6.2.5 and right now i'm trying to add more filters in "insight repository". However it asked me to fill in "Filter Query" too. I tried to find out the information or manual teach me to write down the filter query for any more filters. But i didn't found. So could you please advice me for these information resources that can study how to write "Filter query" for any more filters.

     



  • 2.  RE: How to write Clearpass : Authentication Source : Insight Repository : Filter Query

    Posted Mar 11, 2014 05:31 AM

    Filter queries are SQL statements which lookup information from the InsightDB tables.

    I tend to use the pgAdmin III tool to manually connect to the database and find out all the fields but you generally need some SQL knowledge to write the queries.

     

    What information do you need to gather from the Insight repository?



  • 3.  RE: How to write Clearpass : Authentication Source : Insight Repository : Filter Query

    Posted Mar 11, 2014 06:07 AM

    Thanks a lot for your help. I want to add session-count from insight repository. However when i tried to add , it asked me to fill in Filter query too. But i don't know how to write down it. So suppose if i use PGAdmin tool, it will give me for these syntax right?



  • 4.  RE: How to write Clearpass : Authentication Source : Insight Repository : Filter Query

    Posted Mar 11, 2014 07:23 AM

    Not exactly. The pgAdmin tool just allows you to find the fields in the tables you want to use.

    You could try the following:

     

    select count(*) as active_sessions from radius_acct where (username = '%{Authentication:Username}') AND end_time is null AND termination_cause is null;

     

    Add active_sessions as the 'Name' and set the Data Type to integer. You can use whatever AliasName you want and that is then the field you refer to in your policies.

    This will be a count of all active sessions based on the authenticating username.

    Is this what you want?