Wireless Access

Hi everyone.
I have comprehensive wireless infrastructure which contains 5 controllers.
Also, I'm using IBM Qradar SIEM to correlate incidents.
I found that Aruba equipment recognized by SIEM as 3com switch. I was trying to delete that entry but it appears again and again.
Now I'm going to investigate it. Now I have a question - does anyone know how does Aruba Networks references with 3com (may be they are using the same LAN ports vendor or something else)?

Which equipment, specifically?  You might want to ask Qradar about why this happens...

Actually, Aruba is closer for me.
Also, I issued the same question at IBM.
Im just querying - may be someone faced the same problem.
Aruba 3000 controller is recognized by IBM Qradar SIEM as 3com 8800 series switch.

I can't answer why, but have dealt with this before with 2 different SIEMs.  I had to contact those vendors to get a fix.  Something different about the format of the logs.

Hi, 
if you add logsources manually to QRadar, you simply have to change log source parse ordering in admin tab. Dont rely on automatic detection as long as you dont know how to achieve that. If you got hundreds of Arubas to manage, you may think of alternatives like connecting an Aruba management component. Use DSMedit for unsupported devices. In most cases IBM support will be able to help you.  Pls see link below for supported Aruba devices
https://www.ibm.com/docs/en/dsm?topic=configuration-aruba-networks

------------------------------
karl jaeger
------------------------------

Original Message:
Sent: Jan 22, 2016 01:45 PM
From: Jay La Valle
Subject: Aruba Networks in IBM Qradar

I can't answer why, but have dealt with this before with 2 different SIEMs.  I had to contact those vendors to get a fix.  Something different about the format of the logs.