All Apps and Add-ons

Support for Clearpass Insight logs

ftdrhr4378
New Member

We're attempting to get Clearpass Insight logs into Splunk. We've had the Aruba ClearPass App for Splunk Enterprise app configured and in use for RADIUS logs, etc. for some time.

Current software versions are:
Splunk - Splunk Cloud 7.0.8.5
ClearPass Policy Manager 6.7.9
App - Aruba ClearPass App for Splunk Enterprise 2.0

We have configured our logging outputs per the "Supporting XML file for configuring ClearPass Syslog filters" http://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default....

I cannot see any reference in the above XML to Insight logs. In theory these would be 'clearpass_insight_logs'

Is there any support for Insight logs within the App/TA
How should the ClearPass Syslog filters be configured to support the above?

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...