Hi, it's easiest to think in terms of event types first... the CIM is really built on "type of thing that happened" rather than "brand of thing it happened to".
Totally ignoring the fact that it's a NAC, for any network security device I imagine you'll want to model some events to:
- Change Analysis -- people often forget this, so I put it first... wouldn't it be nice to get an alert when your network security device gets reconfigured? Especially if the good guys didn't do that reconfig?
- Authentication -- ditto, I want to know when someone logs into the device. Especially with an administrator level of privilege. That might be good to cross-reference with the add-on for ServiceNow, and see if there's a ticket open against this device...
- Inventory -- how many do we have and where are they?
- Performance -- are they barely ticking over, or at their limits?
And since this is a NAC device:
- I would put the NAC decisions under Change Analysis, tag=network, because you're tracking decisions and configurations that alter the rules of access.
- If there are actual block and allow events getting logged (e.g. "foo tried to talk to bar and I said no because rule baz"), those would go under Network Traffic.
