Security

Good morning,

We are currently using CPPM 6.11.9 and are a splunk cloud customer and using the typical clearpass syslog export filter. 

The clearpass data comes into our splunk environment in a raw format so pretty useless. We'd like to be able to do the field extractions using the Clearpass Splunk app but the app is depricated on splunkbase and does not support our versions of CPPM or Splunk.  So what are folks using? Are other customers using the depricated Splunk app or some other method?

Thanks

Can Splunk read CEF or LEEF format of syslog? That has field information included, so should be easy to parse.

There is a Tech Note on Splunk with ClearPass, but it refers to probably the same deprecated extension. I can't find it in the extension search. The note may have some guidance for setting up syslog, just in case you didn't find the document yet.

Good morning,

We are currently using CPPM 6.11.9 and are a splunk cloud customer and using the typical clearpass syslog export filter. 

The clearpass data comes into our splunk environment in a raw format so pretty useless. We'd like to be able to do the field extractions using the Clearpass Splunk app but the app is depricated on splunkbase and does not support our versions of CPPM or Splunk.  So what are folks using? Are other customers using the depricated Splunk app or some other method?

Thanks

So good news as there is now an updated Aruba Clearpass app for Splunk. Apparently, this now supports RFC  5424 which i was told the previous app did not. It does not appear there is any configuration documention for the new app. Does anyone know where I could find this?

https://splunkbase.splunk.com/app/5086

Can Splunk read CEF or LEEF format of syslog? That has field information included, so should be easy to parse.

There is a Tech Note on Splunk with ClearPass, but it refers to probably the same deprecated extension. I can't find it in the extension search. The note may have some guidance for setting up syslog, just in case you didn't find the document yet.

Good morning,

We are currently using CPPM 6.11.9 and are a splunk cloud customer and using the typical clearpass syslog export filter. 

The clearpass data comes into our splunk environment in a raw format so pretty useless. We'd like to be able to do the field extractions using the Clearpass Splunk app but the app is depricated on splunkbase and does not support our versions of CPPM or Splunk.  So what are folks using? Are other customers using the depricated Splunk app or some other method?

Thanks