Set up Aruba ClearPass for Integration
Set up Aruba ClearPass for integration with IoT Security through Cortex XSOAR.
Note: These instructions are based on Aruba ClearPass 6.9.0. They should remain valid with later versions of ClearPass although it’s possible that some elements in the UI might change in the future.
- Create an operator profile.You must use an operator profile that has full access to API services, ClearPass Insight, and ClearPass Policy Manager. If you already have such a profile, you can use that when configuring the RESTful API client. Otherwise, create a new profile as described here:
- Log in to ClearPass Guest, click.AdministrationOperator LoginsProfilesCreate a new operator profile
- Enter the following in the Operator Profile Editor that appears, leave the other settings at their default values, and thenSave Changes:Name: Enter a name for the profile, such asiot-security_api.PrivilegesAPI Services:Full AccessInsight:Full AccessPolicy Manager:Full Access
- Add a RESTful API client.Define a client for the XSOAR engine to use when accessing the Aruba ClearPass API. There are two important settings that you must record so that you can enter them later when configuring an Aruba ClearPass instance on Cortex XSOAR: the client ID and client secret. The client uses the operator profile that you created in the previous step.
When IoT Security connects through XSOAR to Aruba ClearPass, ClearPass automatically generates custom endpoint attribute names that IoT Security populates with the device data it learns. You don’t have to define these names in ClearPass; they are automatically created. The following list shows some of the default attribute names.Attribute NameEntityData TypeCommentsPanwIoTProfileEndpointStringDevice profilePanwIoTIPEndpointStringDevice IP addressPanwIoTCategoryEndpointStringCategory to which the device belongsPanwIoTRiskScoreEndpointStringRisk score of the devicePanwIoTConfidenceEndpointStringConfidence score for device identificationPanwIoTTagEndpointStringAsset tag, which IoT Security learns from an integrated CMMS solutionPanwIoTHostnameEndpointStringDevice hostnamePanwIoTOSEndpointStringOperating system of the devicePanwIoTModelEndpointStringDevice modelPanwIoTVendorEndpointStringDevice vendorPanwIoTSerialEndpointStringSerial number of the devicePanwIoTEPPEndpointStringWhether the device has endpoint protectionPanwIoTInternetAccessEndpointStringWhether the device has Internet accessPanwIoTAETEndpointStringApplication entity title (if learned from X-ray machines, ultrasound machines, PACS servers, DICOM workstations, and DICOM viewers)If you want to use different names than those shown here, change the default attribute names in the Aruba ClearPass incremental and bulk export job settings in Cortex XSOAR. See Configure IoT Security and Cortex XSOAR for Aruba ClearPass. When XSOAR next connects with ClearPass, ClearPass automatically generates the customized attribute names.
- While still logged in to Aruba ClearPass Guest, click.AdministrationAPI ServicesAPI ClientsCreate API Client
- Enter the following in the Create API Client dialog box, leave the other settings at their default values, and then clickCreate API Client:Client ID: Enter a unique text string for the client ID. Note what it is so that you can enter it later when configuring the integration settings in Cortex XSOAR.Operator Profile: Choose the operator profile you configured in the previous section; for example,iot-security_api.Grant Type:Client credentials (grant_type=client_credentials)When you choose this, ClearPass Guest automatically generates a client secret and displays it. Record the client secret for later use when configuring Cortex XSOAR.
- Enable Insight.By enabling Insight, IoT Security can enrich the device characteristics it learns from monitoring network traffic with data from ClearPass.
- While logged in to ClearPass Policy Manager, click, and then click your server name.AdministrationServer ManagerServer Configuration
- On the System tab, selectEnable InsightandEnable as Insight Master, leave the other settings as they are, and thenSave.
- Configure policies and profiles.Once IoT Security and Aruba ClearPass are integrated, IoT Security provides ClearPass with device profiles that you can then use to create security groups for defining network segments and access policies.
- In ClearPass Policy Manager, clickand add policies to segment IoT devices into VLANs based on PanwIoTProfile attribute values.ConfigurationEnforcement
- While in the same Enforcement section, add enforcement profiles to isolate and quarantine devices based on alert-triggered notifications.
Recommended For You
Recommended videos not found.