In the job panel that appears, enter the following and leave
the other settings at their default values:
Recurring:
Select this because you want to periodically export endpoint attributes
to ClearPass.
Every: Enter a number
and set the interval value (Minutes, Hours, Days, or Weeks) and
select the days on which to run the job. (If you don’t select anything,
the job runs everyday.) This determines how often XSOAR sends data
to ClearPass. It’s important to set an interval that allows enough
time for the job to complete, considering factors such as the number
of devices involved, the amount of bandwidth and latency in the
connection, and the processing speed of the ClearPass server. You
might start by running the job every 15 minutes and then increasing it
as necessary until each job completes before the next one starts.
You can see the run status of a recurring job on the Jobs page.
When in progress, its status is Running.
When done, its status changes to Completed.
Name:
For the preconfigured job, leave this as is. For a new job, enter
a name. Example: ClearPass - Incremental Updates
Playbook:
Choose Incremental Export to Aruba ClearPass- PANW IoT
3rd Party Integration.
Integration
Instance Name: Paste the name of the Aruba ClearPass
integration instance you copied earlier. If you leave this field
empty, XSOAR uses the preconfigured ClearPass integration instance: PANW IoT 3rd Party Aruba Clearpass Integration Instance.
PANW
IoT Device Custom Attributes: By default, Device Security
exports all device attributes through XSOAR to ClearPass. If you
want to export a subset, clear the Export Attribute check box for
the ones you don’t want to export.
When Device Security connects
through XSOAR to Aruba ClearPass, ClearPass automatically generates
the custom endpoint attribute names defined here. If you modify
any of the names, ClearPass automatically generates the modified
names the next time XSOAR connects to it.
PANW
IoT In Scope Tag Enforcement: Select
Yes to
filter attributes that
Device Security exports to only devices with
the
Aruba Clearpass tag type and the
In
Scope tag value. If you don’t want to filter exported
attributes by tagged devices, leave this as
No.
For information about tagging devices in
Device Security, see
Tag Management.
Playbook
Poll Interval: Enter a number (the value, though unspecified,
is minutes) defining the period of time during which Device Security
must see newly discovered devices or changes in any attribute fields
of previously discovered devices to include their attributes in the
list it provides to XSOAR for export. It’s common to use the same
interval as the one for running the recurring job. However, if you
increase the interval between jobs, you can set a shorter interval
for polling than that for the job. If you leave it blank, the default
poll interval is 15 minutes.
Site Names:
Leave the field empty to export device attributes for all sites.
To limit exports to devices at one or more sites, enter comma-separated
site names.
