Aruba ClearPass Policy Manager

The IBM® QRadar® DSM for Aruba ClearPass Policy Manager can collect event logs from your Aruba ClearPass Policy Manager servers.

The following table identifies the specifications for the Aruba ClearPass Policy Manager DSM:
Table 1. Aruba ClearPass Policy Manager DSM specifications
Specification Value
Manufacturer Aruba Networks
DSM name ClearPass
RPM file name DSM-ArubaClearPass-QRadar_version-build_number.noarch.rpm
Supported versions 6.5.0.71095
Event format LEEF
Recorded event types

Session

Audit

System

Insight
Automatically discovered? Yes
Includes identity? Yes
Includes custom properties? No
More information Aruba Networks website (https://www.arubanetworks.com/products/security/)
To integrate Aruba ClearPass Policy Manager with QRadar, complete the following steps:
  1. If automatic updates are not enabled, download and install the most recent version of the following RPMs from the IBM Support Website onto your QRadar Console:
    • Aruba ClearPass DSM RPM
    • DSMCommon RPM
  2. Configure your Aruba ClearPass Policy Manager device to send syslog events to QRadar.
  3. If QRadar does not automatically detect the log source, add an Aruba ClearPass log source on the QRadar Console. The following table describes the parameters that require specific values for Aruba ClearPass Policy Manager event collection:
    Table 2. Aruba ClearPass Policy Manager log source parameters
    Parameter Value
    Log Source type Aruba ClearPass Policy Manager
    Protocol Configuration Syslog