• Support
  • Forums
  • Blogs

Aruba ClearPass NAC

GhassanSiyaGhassanSiya

Hi everybody,

I'm integrating Aruba ClearPass with AlienVault SIEM and followed these guides

https://www.alienvault.com/documentation/usm-anywhere/supported-plugins/configuring-aruba-clearpass.htm 

https://www.alienvault.com/documentation/usm-anywhere/supported-plugins/configuring-aruba-clearpass-cef.htm

and I'm receiving syslogs on the SIEM but it doesn't have source or destination information.
Is there a way to solve this?

Thanks,
Tagged:

Share post:

Answers

  • GhassanSiya,

    From experience, I have seen that many of the Aruba events do not actually have a source or destination. Can you check the raw log at the bottom of the event to confirm if there is any SRC/DST data in the event?

    If there is SRC/DST data, and it is not being parsed, you can request a plugin improvement, and support will assist in collecting the plugin data from USM Anywhereto submit to the plugin team. 
Sign In or Register to comment.