Security

 View Only
last person joined: 15 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

custom clearpass syslog message

This thread has been viewed 25 times

  • 1.  custom clearpass syslog message

    Posted Nov 17, 2020 09:18 PM
    dear all,

    on our clearpass, we would like to custom syslog message to SIEM syslog server like picture below

    and on our SIEM received syslog message like picture below,

    and the question is, can we custom syslog message that clearpass send to SIEM is logs of command CLI that user input on NAD ?

    just like log accounting on clearpass like below,


    kindly need your help,

    thankyou

    ------------------------------
    br,

    Hudaya
    ------------------------------


  • 2.  RE: custom clearpass syslog message

    Posted Nov 18, 2020 10:19 PM
    up,

    anyone have same issue ? or knowing the solving problem for this ?

    ------------------------------
    BR,

    Hudaya
    ------------------------------

    Original Message


  • 3.  RE: custom clearpass syslog message

    EMPLOYEE
    Posted Nov 19, 2020 06:36 AM
    I don't think you can send TACACS Accounting records out to syslog from ClearPass. What you probably can do is enable command accounting on your network devices (switches, APs, controllers, etc) and send that directly to your SIEM.

    If you like to see such a feature in ClearPass, work with your partner or local Aruba SE to get a request for a new feature filed to the Aruba Innovation Zone,

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC.
    ------------------------------

    Original Message