Configure

IoT Security

and

Cortex XSOAR

Log in to
IoT Security
, and from there access the
Aruba AirWave
integration settings in
Cortex XSOAR
.
Log in to

IoT Security

and then click

Integrations

.

Launch

Cortex XSOAR

from the

IoT Security

portal.

IoT Security

uses

Cortex XSOAR

to integrate with

Aruba AirWave

. The settings you must configure are in the

Cortex XSOAR

interface. To access these settings from the Integrations page,

Launch Cortex XSOAR

. The

Cortex XSOAR

interface opens in a new browser tab or window.

Find the

Aruba AirWave

integration.

Click

Settings

in the left navigation menu. Search for

Aruba AirWave

to locate it among other integrations.
Configure the
Aruba AirWave
integration instance.
Click
Add instance
to open the settings panel.
In the settings panel, configure the following settings:
Name
: Use the default name of the instance or enter a new one.
Remember the instance name because you're going to use it again when creating a job that
Cortex XSOAR
will run to gather device data from the
Aruba AirWave
instance specified in this integration instance.
Aruba AirWave
IP or Hostname
: Enter the domain URL of a cloud-hosted
Aruba AirWave
instance or the FQDN of an on-premises
Aruba AirWave
server.
Username
: Enter the username of the
Aruba AirWave
Read-Only Monitoring & Auditing user account that you created for the
Cortex XSOAR
engine to use when connecting to
Aruba AirWave
.
Password
: Enter the password associated with the user account.
Use single engine
: When using a cloud-based
Cortex XSOAR
instance and an on-premises
Aruba AirWave
server, choose the
Cortex XSOAR
engine that you want to communicate with the
Aruba AirWave
server.
When finished, click
Run test
or
Test
to test the integration instance.
If the test is successful, a Success message appears. If not, check that the settings were entered correctly and then test the configuration again.
After the test succeeds, click
Save & exit
to save your changes and close the settings panel.
Create a job for
Cortex XSOAR
to query
Aruba AirWave
for floor plan maps and import them to
IoT Security
.
Create a new
Cortex XSOAR
job.
Copy the name of the instance you created, click
Jobs
near the bottom of the left navigation menu, and then click
New Job
at the top of the page.
Configure the new
Cortex XSOAR
job.
In the New Job panel that appears, configure the following and leave the other settings at their default values:
Recurring
: Select this if you want to periodically import floor plan maps from
Aruba AirWave
. Clear it if you want to import floor plan maps on demand.
Every
: If you select
Recurring
, enter a number and set the interval value (Minutes, Hours, Days, or Weeks) and select the days on which to run the job. If you don't select specific days, then the job will run every day by default. This determines how often
Cortex XSOAR
queries
Aruba AirWave
for information about floor plan maps.
Name
: Enter a name for the job.
Playbook
: Choose
Import Aruba AirWave VisualRF Floor Plans to PANW IoT
.
Integration Instance Name
: Paste the instance name you copied a few moments ago.
Click
Create new job
and verify that the job appears in the Jobs list.
Create a job for
Cortex XSOAR
to query
Aruba AirWave
for device details and import them to
IoT Security
.
Create a new
Cortex XSOAR
job.
Stay on the Jobs page, and click
New Job
at the top of the page.
Configure the new
Cortex XSOAR
job.
In the New Job panel that appears, configure the following and leave the other settings at their default values:
Recurring
: Select this if you want to periodically import device details from
Aruba AirWave
. Clear it if you want to import device details on demand.
Every
: If you select
Recurring
, enter a number and set the interval value (Minutes, Hours, Days, or Weeks) and select the days on which to run the job. If you don't select specific days, then the job will run every day by default. This determines how often
Cortex XSOAR
queries
Aruba AirWave
for information about device details.
Name
: Enter a name for the job.
Playbook
: Choose
Import Aruba AirWave VisualRF Clients to PANW IoT
.
Integration Instance Name
: Paste the same instance name you use for the floor plan maps job.
Click
Create new job
and verify that the job appears in the Jobs list.
Enable the jobs and run them.
If you run the device detail job before the floor plans map job,
IoT Security
will still import device information, but the devices won't appear in the Device Location Map widget.
Check the job status for the jobs you created. If the jobs are Disabled, select the appropriate checkboxes and then click
Enable
.
Run the floor plan maps job. After you enable the jobs, select only the checkbox for the floor plan maps job and click
Run now
. The Run Status should change from Idle to Running.
Run the device details job. Once the floor plan maps job Run Status changes to Completed, deselect that job. Select the checkbox for the clients job and click
Run now
. The Run Status should change from Idle to Running.
For either job, if you selected
Recurring
,
Cortex XSOAR
queries
Aruba AirWave
for information at the defined intervals and forwards imported information to
IoT Security
.
If you cleared
Recurring
,
Cortex XSOAR
immediately queries
Aruba AirWave
and forwards imported information to
IoT Security
.
Optional
Add more jobs for each integration instance.
If you created more integration instances for multiple on-premises
Aruba AirWave
servers, add more jobs as necessary. Each
Aruba AirWave
server requires a separate job.
Run the job for each integration instance you create. The first time you run a job that references an integration instance, it triggers
Cortex XSOAR
to report the instance to
IoT Security
, which then displays the integration instance on the Integrations page.
Return to the
IoT Security
portal and check the status of the
Aruba AirWave
integration.
An integration instance can be in one of the following four states, which
IoT Security
displays in the Status column on the Integrations page:
Disabled
means that either the integration was configured but intentionally disabled or it was never configured and a job that references it is enabled and running.
Error
means that the integration was configured and enabled but is not functioning properly, possibly due to a configuration error or network condition.
Inactive
means that the integration was configured and enabled but no job has run for at least the past 60 minutes.
Active
means that the integration was configured and enabled and is functioning properly.
When you see that the status of an integration instance is
Active
, its setup is complete.