Security

last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Search Clearpass Accounting for specific commands?

This thread has been viewed 1 times

  • 1.  Search Clearpass Accounting for specific commands?

    Posted Dec 05, 2018 11:38 AM

    Is it possible to search accounting in clearpass to find commands run? 

    Example, a port had a vlan changed and I want to know when that happened. 

    Can I tell when that port changed without having to click through each item listed in accounting?



  • 2.  RE: Search Clearpass Accounting for specific commands?

    EMPLOYEE
    Posted Dec 05, 2018 11:41 AM
    Assuming you’re talking about TACACS+ Command Accounting? You can run a TACACS+ report in Insight with the raw data and then search the CSV export.


  • 3.  RE: Search Clearpass Accounting for specific commands?

    Posted Dec 05, 2018 12:47 PM

    Yes TACACS+ accounting. 

    I did not have insight enabled on my cluster and running a report I don't seem to have any data. Does the insight database only collect information realtime? 

    Also, the only Category I found mentioning Accounting was "Accounting - Bandwidth and Session"



  • 4.  RE: Search Clearpass Accounting for specific commands?
    Best Answer

    EMPLOYEE
    Posted Dec 05, 2018 12:57 PM
    Data is only sent to Insight when it is enabled.

    The TACACS Authentication report with raw data included should include this data.