Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-arubaclearpass

Aruba ClearPass

You can integrate Aruba ClearPass with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

Aruba ClearPass product overview

Aruba ClearPass Policy Manager is a network access control (NAC) platform that authenticates, authorizes, and enforces role- and device-based secure network access across multivendor wired, wireless, and VPN infrastructure, using RADIUS, TACACS+, device profiling, posture assessment, and guest access.

What we ingest

Sophos XDR collects Aruba ClearPass syslog data by listening for CEF messages your ClearPass deployment forwards to a Sophos XDR data collector. The following log categories are collected:

  • Authentication: RADIUS and TACACS+ authentication and accounting events, including successful and failed authentications and guest access.
  • Guest user management: Guest user account activity.

Event and data types

We ingest the following event and data types from Aruba ClearPass:

  • Authentication: RADIUS and TACACS+ authentication and accounting events, including successful and failed authentications, as well as guest access, with the user, device, and result. Normalized to authentication telemetry.
  • Guest user management: Guest user account creation and access activity, with the account and action. Normalized to cloud audit telemetry.

Data provided by this integration

Data provided by Aruba ClearPass gets normalized to the following schemas:

  • auth
  • cloudaudit

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation