Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-arubaclearpass-setup

Integrate Aruba ClearPass

You can integrate Aruba ClearPass with Sophos XDR so that it sends data to Sophos for analysis. The integration uses a data collector, which receives third-party data and sends it to the Sophos Data Lake.

Key steps

The key steps in an Aruba ClearPass integration are as follows:

  • Install and configure a data collector if you haven't already done so.
  • Configure Aruba ClearPass to send data to the data collector.

Requirements

The following is required for Aruba ClearPass configuration:

  • Check the requirements for the data collector you're using by reviewing the guides at Data collectors.

Add an Aruba ClearPass integration

To integrate Aruba ClearPass, you must first install a Sophos XDR data collector, then configure Aruba to send logs to it.

Install and configure a data collector

Aruba ClearPass must be configured to send logs to the Sophos XDR data collector. Logs are filtered and correlated in real-time for various security event observations. Go to Data collectors and follow the guide for creating a data collector if you haven't already done so.

Configure logging and enable monitoring

When the data collector is ready, you can configure Aruba ClearPass to send us data.

To set up event forwarding via syslog, do as follows:

  1. Follow the steps in Aruba's own guides for adding a syslog export filter and adding a syslog target.

  2. Be sure to configure the following details:

    • Export Template: Choose one of the templates.
    • Export Event Format Type: Choose CEF.
    • Host address: The Sophos XDR data collector's server IP address.

  3. Repeat these steps for each export template type.

Your Aruba ClearPass data should now appear in the Sophos Data Lake after validation.

Configuration notes

Keep the following in mind during Aruba ClearPass configuration:

  • Logs must not be split across more than one line, as we're unable to rejoin them, and any split portion may be ignored.
  • You can configure multiple instances of Aruba to send data to Sophos via the same data collector. After you finish integration, repeat the steps in this section for your other instances of Aruba.

Additional resources

For more information on configuring Aruba ClearPass, see the following documents: