Aruba ClearPass Role Modified Following Authentication Failures

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a role modification shortly after failed authentication attempts for the same identity. The sequence suggests someone unable to gain access through the front door changing what the door permits, rather than continuing to try credentials. Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261). Integration guide: https://bloo.io/docs/integrations/aruba-clearpass BQL (Bloo Query Language): stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_UPDATED' | groupby user, targetuser, role, srcip