Security

last person joined: 23 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Blacklist Users Report

This thread has been viewed 1 times

  • 1.  Blacklist Users Report

    Posted Sep 25, 2019 02:13 PM

    Is it possible to get a log when a client is being blacklisted? I am trying to get notified when a client gets blacklisted so I can notify the client via email. I wonder if this is possible from either Aruba Controller, Airwave or ClearPass, and if email is not possible, at least get a log so I can send it to a Syslog Server and send email from there. Thank you in advance. 



  • 2.  RE: Blacklist Users Report

    EMPLOYEE
    Posted Sep 26, 2019 03:32 AM
    How are you blacklisting the client?


  • 3.  RE: Blacklist Users Report

    Posted Sep 26, 2019 10:12 AM

    Client gets automatically blacklisted after five failed authentications. 



  • 4.  RE: Blacklist Users Report

    EMPLOYEE
    Posted Sep 26, 2019 09:41 PM

    Sorry I don't have an easy answer for you without looking at your policies. You can either call the ClearPass Email API when the authentication limit condition is reached within the Enforcment Policy or craft a syslog export filter to send you the desired data that can be used to filter using your SIEM