Security

last person joined: 2 hours ago 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

custom clearpass syslog message

  • 1.  custom clearpass syslog message

    Posted 10 days ago
    dear all,

    on our clearpass, we would like to custom syslog message to SIEM syslog server like picture below

    and on our SIEM received syslog message like picture below,

    and the question is, can we custom syslog message that clearpass send to SIEM is logs of command CLI that user input on NAD ?

    just like log accounting on clearpass like below,


    kindly need your help,

    thankyou

    ------------------------------
    br,

    Hudaya
    ------------------------------


  • 2.  RE: custom clearpass syslog message

    Posted 9 days ago
    up,

    anyone have same issue ? or knowing the solving problem for this ?

    ------------------------------
    BR,

    Hudaya
    ------------------------------



  • 3.  RE: custom clearpass syslog message

    Posted 9 days ago
    I don't think you can send TACACS Accounting records out to syslog from ClearPass. What you probably can do is enable command accounting on your network devices (switches, APs, controllers, etc) and send that directly to your SIEM.

    If you like to see such a feature in ClearPass, work with your partner or local Aruba SE to get a request for a new feature filed to the Aruba Innovation Zone,

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC.
    ------------------------------