Package aruba/clearpass Release Notes
Package aruba/clearpass Release Notes Version 1.2.0
The old parser clearpass-syslog is deprecated, and replaced by the new parser aruba-clearpass. While the old parser will remain available during a transition period, all future changes will only go into the new aruba-clearpass parser. We recommend switching to the newer parser as soon as possible, to make for the smoothest upgrade. The old clearpass-syslog parser will be removed at some point in the future. In your data, the field #type contains the name of the parser, so any queries you may have that searches for this field need to accomodate this change.
Duplicated vendor fields dropped in new parserThe old clearpass-syslog parser would duplicate certain fields, which the new aruba-clearpass parser will not. The fields which were previously duplicated, would be present both under the Vendor namespace (e.g. Vendor.srcIp), and as a field mapped to CPS (e.g. source.ip). If the value of two such fields is byte-for-byte the same, the new parser will no longer preserve the vendor-specific field, but only the CPS field. If the value of the two fields differ, both fields will be preserved. This means the following fields will no longer be present in the parsed data, when using the new parser:
Vendor.Action
Vendor.CppmNode.CPPM-Node
Vendor.Endpoint.IP-Address
Vendor.Endpoint.MAC-Address
Vendor.Endpoint.Username
Vendor.eventId
Vendor.RADIUS.Acct-Framed-IP-Address
Vendor.RADIUS.Acct-NAS-IP-Address
Vendor.RADIUS.Acct-NAS-Port
Vendor.RADIUS.Acct-Username
Vendor.TACACS.Request-Type
Vendor.WEBAUTH.Host-IP-Address
Vendor.swVersion
Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.
Package aruba/clearpass Release Notes Version 1.1.0
Implements new fields:
client.mac
client.ip
server.ip
observer.version
observer.ip
observer.port
event.type
event.outcome
Parser tests have been improved by adding assertions to the test cases
Bumps minimum LogScale version to 1.139 to support parser assertions
Package aruba/clearpass Release Notes Version 1.0.0
Adds new event.module and Cps.version fields
Removes the Product and related.ip fields
Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type