From 3dea657a0dfc1d0ea189b9eb0e3ed0c1a266603d Mon Sep 17 00:00:00 2001 From: v-rusraut Date: Tue, 26 Sep 2023 15:01:01 +0530 Subject: [PATCH] Repackaging - ArubaClearPass --- .../Connector_Syslog_ArubaClearPass.json | 2 +- .../template_ArubaClearPassAMA.json | 2 +- Solutions/Aruba ClearPass/Package/3.0.1.zip | Bin 0 -> 10236 bytes .../Aruba ClearPass/Package/mainTemplate.json | 22 +++++++++--------- 4 files changed, 13 insertions(+), 13 deletions(-) create mode 100644 Solutions/Aruba ClearPass/Package/3.0.1.zip diff --git a/Solutions/Aruba ClearPass/Data Connectors/Connector_Syslog_ArubaClearPass.json b/Solutions/Aruba ClearPass/Data Connectors/Connector_Syslog_ArubaClearPass.json index a2dd3e953ee..74369318b04 100644 --- a/Solutions/Aruba ClearPass/Data Connectors/Connector_Syslog_ArubaClearPass.json +++ b/Solutions/Aruba ClearPass/Data Connectors/Connector_Syslog_ArubaClearPass.json @@ -54,7 +54,7 @@ "instructionSteps": [ { "title": "", - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Aruba%20ClearPass/Parsers/ArubaClearPass.txt).The function usually takes 10-15 minutes to activate after solution installation/update.", + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://aka.ms/sentinel-arubaclearpass-parser).The function usually takes 10-15 minutes to activate after solution installation/update.", "instructions": [ ] }, diff --git a/Solutions/Aruba ClearPass/Data Connectors/template_ArubaClearPassAMA.json b/Solutions/Aruba ClearPass/Data Connectors/template_ArubaClearPassAMA.json index 63a6974c595..940dd63ed98 100644 --- a/Solutions/Aruba ClearPass/Data Connectors/template_ArubaClearPassAMA.json +++ b/Solutions/Aruba ClearPass/Data Connectors/template_ArubaClearPassAMA.json @@ -62,7 +62,7 @@ "instructionSteps": [ { "title": "", - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Aruba%20ClearPass/Parsers/ArubaClearPass.txt).The function usually takes 10-15 minutes to activate after solution installation/update.", + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://aka.ms/sentinel-arubaclearpass-parser).The function usually takes 10-15 minutes to activate after solution installation/update.", "instructions": [ { "parameters": { diff --git a/Solutions/Aruba ClearPass/Package/3.0.1.zip b/Solutions/Aruba ClearPass/Package/3.0.1.zip new file mode 100644 index 0000000000000000000000000000000000000000..92d4c3602aa6c2e5560ec6b720ce89b1ca7b19dd GIT binary patch literal 10236 zcmZ{KV{j%ww`OeHwr$&X-qZD*pL?{3|#t=hfaKhEh>&pAK3 ztNW?0^Qg#!Ltub_fWUy34q)B{LxX_KVuFBR|BITrT9~+7Xxd0vSlT$+xZ5~6 zGTFL0InL-fI1zB7e8mq3;xHC&N&5QAf&`Q4xtAPCQmC}ryd_RS1M8gDhV7W!xYtz3 z?zmqkl@Bsl4*dIi!Z0Aj%ic;Vwo$8+f~@B9pFC3w{t zj(D}1OocNdq#I{11o?#{k&26TO($eu;PGLv~ zN2S$1^LzRwi`sL^bxsdIG|D$-vC9CB=o48#Mr-0OJvtGL$3f|Z4s3=hU)V>sNd zPR8V0HQwKWHe(4dFMGH|Z3GBLZs1CxQ#>`TsXpWyaP+;a5uqxpth6@a&$a24knRZb z;PQ}xAAk7;UUZP!_V#(}TT)nkd2Pt*e)aH6Sn)XR`>E1bn|RdnbHaeJo9e~Bgrl`NX=~f?cIa`Z6bKK&A4?3u;0-2c;2;WDiEW%3 zOO%A*;e)^y0<-?S0sOJ&LM>Jt*_O(ozi6b5RhnE+igB?C>&jZ&WXBrY+Q4-gvDUqM z@bM73LhGkVz;bk#y)J4N+X2Z}6Yy-YHJ+k8jGrp(k)JQ25HrrOtVAMT2LgrM7;zY8 zv1H0{!4hC7ryECOxnx9ibs!)D)f@>;I%>tvQz_!ghIWcK-kq=c~*m+gkTjD%u|frbuht(V15%kDmePTZyUR7%q^YdAs#_CW_I{jH_6>Cx5b?88{Yq z=7j1jOSg|n?j6%(mW}6^_*liGbte~8BdrC@pnPM${bZ7{i!a!E-;1NqX1G_&Z{cHG zTQuLlh8$)T-31T_4L4hks({?SgqYl_plCeDbFsZxvMY_uf6?X(pnJ#guGx*}HbBjH z^se=LE=W>l9!Zg8UvxdyB05d zZOB>6mAf`zQYGgrjl$QkCKn?seYpnv+F z-qu~VF=3!MNvy(D?3l(%gDFwCl7ly7bUhQ+hl3n#9<2w_wOPt=`+a8 zn~JHQO3A<`-(T}9`*x1Oyr-u&tgAQFZmKGMj_gg)Q?VWi1@qEVVUkj>JY`-YGWYLr zbW+`+*mlqg_$VM|l^OH9{KeqR_CaPBMl90Zoam#4QwTfgSW{Pd&st{K@NKSPF@hSK zGG>NAdngxM*N56;yUoAc>Dd-v$Ci?~SN6ACK5K*j>o|vGg+!g8+Sl2 zF{4UP>R~>F-unVob5dm+y_v0hL!{}F9^>y3+TMb+sXS=kw)lG4M*8Y0|9v1r=}ITS z(QA-WwVaVtk)5a>Z1;7Svc}9tC)xw6laos8H@%c49Po))-gEB1vSv@ea10C8S!u&_ zglSJnv1;b$KWG|`~94n_10zk1wCw{`G-X_d|2<_Gtl6szXVO~d7tY#+hqWFnj^#;bLp(l zA8lV3bc`^{>;FB>{@SGB^682-ErhcJ9U48|&iD8C9tC+9*I!K=j>a`5G`{>KO-ACG z3Pbpvu)>!oBBYyVlX~+-0Xq&S`d&gNgn?_JmV+D5kx`mx*LBFQ4&&9F_|TYEmQ}?s zOZH)Sfj4MG)?upfVrREOua?n|vgYm;UjG+6QylkRV-(#76E>7HON`_{CbhU70%fo8 zfnN|R|A)0h|FJePLCA(bF$hQm1}F&XKh}0Iv2oO}aB#N&$KC(M*H;Fgu3KEm-+|T7 zgeuMY^tAlBjpqFNC+oeM=KQK7O&;mV%V|gIG-%m-J`uT;G84^>_1B!&PuH?__{0=4 zU?0imQ(Ql^bz>m#M2h=BKIR|ZiN8h0Pv@p{mP+}3M5G=lbQ__UD!titJB#>>vs zMKMhIH&ggu1MlCHsp@X1)L}4CY5d~K@v21Yy;Qj-ZePhrH;>MQ zP@JIztSs)+*dc?Wj7+7nf3k!*WGJ~~w|nv-qjM1D;qQ|s)Dvr>Qg~o+)$Ggi+d`Z_ zbBJx9BFtM_GKo2?hkuD&GB0JH3syZKfv+m3FKOz>?u=}Ir1HToShheyF(vbtUxqoR zR27hTSXijyM^&=@7?6#ezxjewhLEGZ<1Tu(-CjZ>lGa2Hu)M{x&l9Ga3YSVqP;k!B zZK#6$-O4&!YUw8K4_x2ySrT|2Oth1-%xKdR|I%!g7CWWU4mnwfy^Odv&4VBc?I>ZT zgbv1*X5dpEN3~W#S%g$#E|%@ALXcF?hUZ4wYKC0#IM%qkhvdk#v#WDIa21__*@8rG z$V*d!eD?nsok2|5Mjsth4dkn;I54#%;%Z~#qO$Ip_371 zSW|fr<*Fr3e_jOQbm2L~)_FJDV(E;3P__|&!;62wf$){3R&<NK-ZAuubbhGZ^Q?6T{vr$>OQnUK}j2ShjTI*%I(wWccAwXOG zH0z*wk%wj5v!q!IU))pr&rz$LLI8Va$FnNiI2My1$u94mx2k=XYIU*Tey3SW?LZMB z77a9k)hxD!>|O74)4NnIm72JV$|x8J`Nhv)JARRm?j1a;srejZf&dA>Dbb0-rh#8h z$v9o(7nGt+DCpl|VC5zf%Yo`Ujg;8I^7%_y7qt`D2xSXm_G$TyU|i*#ni3sly%Fbzw1K>q^l_8UdaFWU2z*ia3`R6kw$v z|Mp@{OqY&CMr=(n1~+ZxRLF>)|LE_uT6>d(s!eaRnwt@fxYUd$3cV0gvxnyKIDf7P zPvh0QK=A?y`Bb?ru->3ThD?{F?8Ji~{o@QlUfujtG{;@TG>f-=B6(ia(N>N)A2Dlh zecx|JQiq8ilL{D`0MevI)cp?n7X}>&njrKkh>l)jm~bD-?<^=*?s#BVf3l7eMlr;% zXdG)4Y(8254hGqLh`dCq_$)xm|L&Oj5c)@Ygde-MBjk{DhKWgq=j=;MntY>&Jyuus zTVP~FHI$N|l*Irvx2q`QisP9}YCHU%y$CFgV|~u%kq0(LYJWXcJEvwM==vt->PAfZ z6phC5!w(LASl|@n9<}kMz+d=8=pTNMk-4dlr{=>aS{Ny+MKl>t`{o>MUI(FPPx$P< zS?~dIhQWQ5eE|fuP8;#=rUf`n6+<~+WnIOI)t-%yvO&{3>Oz^sQI}{+HMdOy&Z_g zqN7!tV6q)^XeK})t=cZ}F3}Pqa2zRVy{~TyDQWnuy{J_u%wJtwJKb%)Qq+FFV3LD7 zao&!jPT?YFCnGL88>U6+-&v@u>ML7Z_<*c+zs888&h<0vG4R&~{X`@aE{X-*uR}(a zqo21pI+hMtl0UnJeu4SzNgGD1*1;qP!);`%gzaAIrc&X-mgF)k6jJ3dG@~9=g*lN& ze)Abaf$LZ*xD0{#fD^kg9svgBP}2zmqi4~$VeJ=0OquZ@5edV%n1cTugCa}O7sqD69(Ps@FcIlb(&bk zfVC1hMWX(ATGEF+WT%X;n{JZmjgk!t3?WLR?T_?5Ia+IVIv`|^;TKD+cUZwMTo?2Q zT$y)fDGCK!kYO<;7_+7wk`QpZS6CY88b-y;vuR`g7fR{vJ{jxDWF^C>ep}fD7ZB>{ zgW3Ly&eXZ0fJ=KI^%RK$`s506_zl?F?lrGOEAJKzCD^$OWI-7{@ym^)tw#g%#y-K_ zYXCwfSnx(jd@uPH)a_M>b>sLmuEab=y8I#TIvh7?j<0foLsBuPem?>etyw$j)Y+g0 zpp(_=8BJD`+QStsKP+J)28N1IAKGsKac1gl8u7r zLV|HQxi#Jsjhw$Fx`E#%QaAXGS0tJ#0gFsgvgV~s#e{2p*1XM$03S*(8;q6d80&$& zOL~=F+6?jQRS+c$byJLSuBz2Or>>;2j7QHzs_a#D*0F)C;Pp&e2g&!y>qRUc$8=6- zpML_u4WS(2R(>Kli*|!~RB7rS6mYAj@X$GLx|jvO3Quk_5pgS7s$D!Pkn|iY;x?#8 zf>1g?d|b+t>QLBa69o`Qg18@_-he~u(6pS;HhHx&iYFPkQMmoOEQc#3h2ZQE?xr$e z1djCTU=7e3AI$m8Hs}$H8{!FiI>aNZz&lb)_#vy~XYB7Mg-vr)zc??DLE|5M%(%4z zXP~dUPSk=c*4D^2NK2K$o{e%sd3X9&X&*A0vXV`6g5Q;qg4@6$DE}btLDcV>LjH9@ zW0A>Z(x`l31L`_hHa}z25#IL^?j<5;Q~C+K@gwPT3bZzN%_BrtZhLRRu3hzpxX)$p z?#<@B93E?83{7awH^6WYrHjjSKOzHD(Nf6e+g4#|%E+3$7lj(nZ;CjA0sjz&+wF)H z+sKp&FboT+PC#KmkNtRJXL^23gWc+4qf|WMhkZJ3@6Wc(%Majx+k9jRF?RLuM|M1@ z6tK*_CL|)t-FLi2re%mN>k^U(S0D9#cqGI-vKjzmoUOcgFW>(>;|=uSJK&d!nGn!* zjA~c#V&?QiH#g2S_6tlG`T7(GV;t_6d)#=4q{Jl=@X8Sa0+X#aOZ!!9V(RzfsJ-Pd zqFZg0dPXfzLZCl=sNVI6M#0PiVl&~@J=IM!r$j`-8o-TzgT;=8C!XmqA-Wx!)X3-^tzS$f)o9$1bThuEhe=s z3+n^LYsJV46%LNPS+y!=`Xf2!N&C8n7rKhVOIK}+SHk&F-88!pjfo9OKW;FlyJ3fv zS}ajh>2~?kvlbZU6}~?(q9KM$Dxk{3ya-LJCwDZ91rR=xWQ_2P^kEg+hgLq!PDjxe^N3TMK| zad!19Lu;^=%kXegncbg%;m~w(Duk=B>A-kR^WVJ;nk1GklEDB?^AKX_&eM^S6^5Le z(*71?*RK45`a6T#BfKILM`t$BsI{=;q|mxjnc7Gf(6VfY!PgV7aYjzGlHu6C!-9`Of$f;Se&KPgSuPJpkubc3gqThlwHT?{MYJ` z^X6Xqj;D3Ig37kpsmqVTq0(SwAKk)sYnq9ALJPprf~Lxd5n6V8d{KVeAARti-%hTa z;#U_W&%`-7#K?NzWuF8bTke(jz27tGM8AbQx2$b;@UL9lN~H_z5^(_G7@W4au7ZQ>*!tFc>>x&7z=nPg!+QFehgHC+QKw`VOZ0Mt7`9U7J<=N|IG5@L! zg~d%+%z6LpBeDmM^Fb91;D&~BiaKDELlvsM)30sRzY^WK>fiR*txNB(s}AYt!$A2> zxU>R0w}LOGkvCZ#)X2|&)dTAOxe`=Yk8HoKI}N4sv<6k>xED5K0>D4noV;rTk>C8V zmM7i-C-^)H`ZW{Z+`4pm2%{gI$B$pSiD-KbXIZydeVrL}!$qMr^}ZCV(+-B$|IWdy z>lFmY@AcN^`5_*Nc=1&e$vl5#IIMm#0HR{|}h+je#cdRnDcoojQ7q{6tDih}9Olm^2kP#2X% zUDg1|_bk-25YSHqN(tW$G9`FTy&Os&*j+@Tv&6E7k+7HONHl}-DE zAewr4q-hRj&nuva)~0gY8pc{T7 zvIoVy1`MNb!hx9gTK?d9L^py!ZQw)TAhhrL@|=`L{JVoSe}~D?4;tlwmFoR;I`kB0 zDb7*+A2Ta|#_hwMbLD=;OV1HT3Vem#DnL_hOz633^?TOkn`VRsKJ~OmC}YW9?*en~ z8qaNdSnzL~jED?Zd-<$|-nEo_G@abA@-bIU#4}$(rGDfOG2y_uJ{308M0z+z{a!F+ zzb`KWz8?BZSDAZ>J;U|bbLnr74s0^moSwn!R0}xsG|>(@%G3{IqP|51$OgHzZ(Egn zkHUWh>>2LHGjN(Ew~CCqYNRj+j~L zDJ%vXh)QzIG@g#YN&!cGl2=gIFGdRPd}_QM5;jyQhz+`Ws$c=@G$VPu6GmemHJCEK z%O+k_OpslgQ>a{1)r5LnbIUvPcV1(VD6pcu>sKHU_vh+5tok&&2tl7pq**Zw2WC5L z(GGiP8lHZY-1U`&VgOU&L_$zjx8Zn+D9HwN^4pS_>D?Iy;COCEl)O3tlA+T6hPHh) zM^X_^U8vTsA+oUMDm(OI%Q9!Az;cKpf7N^H+-w_ul6Xp0@rz@=qSi=w_yeN8 zy|W6puvNazjar^tkNL`pJC@_373s?flv-2yCWf&Td**bDzOcD>c&nY?$k!17f1BVw z7i<;U%y}|6CFeOFW#!;79#>67en-k(cc(nFdTx*Jdho3A_0{3h1!h>EiT-=>u8!A* z9-#}(`e03fx`%|BK$RS1FXY{)aE5)?a>)us> zKO~H`-04Uq=-~F1e)#r@P=2?xRq4GHko{9*P@Ha$G|f3@3Wo7+!@zkXE(0l>8K1*| zt-_H`YaFl!fm9jxaHPC+6kL}9;qi0s53d**MzA zDV~CV5C&TEjT!W)Z(KF4)q-evP9^%vNFfl&@Hup17IFoh_zBWPEb^>{8dPi~|HNWhv zVhN?0!0tjG4V~!CPD8csrV~pr2-Az}WzFYEHJ(>2#7PB5Nz|oKQb(K;BHbL#wuN{0 zB4vSb(3?VX#71EkHU1*^7$8ZOrY-{2b)M-X`N)?64CE8AL1VU)XcBERka12TYs4Bb z|M_@_YPeW9zWDxoJ!ABnOIfMc_xq$a?(RAB(z5QNvMCIKL2E`GXpDR5%!XEc&;_Xa zrY>fUy)$pIC~xJQ?dwrMXTfcms~}g^j3a>hN|KrxqvzkTZ0DImtJoV(WgaU4c)!!1 z(niK(BpEc;5aFMSnAq?)E#5n+pB3{^`&0OB?|D&^PPTCn`H_FCGM#m(+*GX)V{7Q< zI(>xlkUx^5FP^`oIP+0f6#$j4?V9pT*okbGe&dT#<~cl&}L_Z}qi*)sr23Jggbm5H4ii zxNE)92)UPG`$E@I*V;uHu2_&f~1v5A^8*@P=%!OWFeY^Cf->3Y3yfWg1e&Tr4Rz;zrQqLMm@ZJJ2 ztXCOqOIM$_0~=tvOC;s1tZ&*#eCAE3NO*u4q{BpGy9AW4L(N`qvzfQ&RXY+GZjb%5 zD(Vr!>FEU>^4)gEb}xpCUB9Y2R(zjoCv}Fljz6=x8h>?+ymK;!NUB_b$mamFHzd?a z&$Dtqv^Xm_*f|i@MErGbmTae9JvWz`>JKid)@{-DBHY08tMt68Z?n8Crn-#>%D|~q zX3n2h+tEnloB8yCsHjQTWh5is=+w{p;U(PyNtg<(HkCoEKtAm_^2?LbxFUzi*REB& zrg#8joT^pz?m6mFIfcW4pY9gk33gwOjvmfu^)~gpFtMVi;0;_7eJAofXmjX-ej+5H z?&8_C?emakcK4&mY*s6#;V5c&=VIRkj_P!5_qoY+C&N(rFZxfbcI`uaGMFAv)l;~} zFca3I)6jaazqPbTG&P^orlAreCv_5(%yz@7E?r$XlaVc^3en34)5;#D%-W#Li$}Pv z%9gUxAQaTLsaol=zn(25rx= z-7PDu$I?tqh3%Ufw@J$P#o2?8cG5hx$NE;lI&I1mpB|a*mWP9#x!qSkAD1o0({no5 zzss72g*+uD{i-m!H5{wlGGpQE?lrKpQK(L-c>)CI%Pvo#=?`1U$^ za%a?`Sl$xx7_4HX2+k33se5f@mYW0YX9-!^in$Ui6n?1CpI7s-vfvklER5kpdM zT~kMcM_pVF@i%a|27hxCu@gwHPL9ICZwIq%P9z+DJ?H;*6!N6}K@^qEE-r7I9&uo) z+d)d5llww<@Z`wcUX#-aS=d_X zHx-{clh#=ZsM%_hrJZ`oIe-{tI)uz77;pv^b%rS2I8+pSo5J+4gXy>kY01_v-&Ec^ z0BZQpf%29uO#?MdUb_5^DbO#kz(BN1DQSVTO9|dxGXGyU3B21pCsl{rEt zT@yGiK^g0jNVjMYbjCp$?rcZ@jr)>&8X1z;>z8A2Mk9|cafjK2;xY}6u^!9%V{-gN zD77*m%-1jUw}5k-DOaY;2!d^2Y@-Cd-QzWZJ{NlPj_3+m`$=xd=_b<|*WeZ>&lzX? z4x5;qI(l+f)hg_gR@Dcew0h7s8K8KiN}Wwef?Iar)=Y8I7o#qx>hKpdODcH5e<5Ka z8Gd$X<=`hnRI&4O=1GYkPg-EoPxrUi%%57B!dJ1$Kbf+|9zPZ)#*;;~&aiy(r7}$V zb>s%jgpUJJ?@op)-*KAbOv)Uyj%Wt_dZUYtfkDU!OWk=xrauFrfPqqTM{|EDOxKL> zo#D29c?<-FU`=2$f3 z%~ob*gkK0~EFAx%OE9T1o>BIdX~ciilw{(AXO$nl%8N)a1a7b&2Sy~qtuE}Pyq0h~;O&r{QC>!W^!*s^`!NZVBYh@z%qX;!Qa<%W=ALp= zrx@uTmRa*{vOqNyXroz|j@_(sU6df4|BhYdCeDmM#8(E08qwJrwwiB= z^!|R21Dlxs@tR~sRxbcS-2U%B{kgi&kFOe8g?<#mXdGEv?L)@kjl*CSHj+P@9xy>B z8b`*(`0J4B($td;4EccC&3f1AMf+xVj(5bH;r-oZ$|IOCTu*1arTRV%>XRF5nY)&% z6Z&%`NYxzhh`>!CwQmJVewPx*oS%yKd^ndDr$-TB_YtS9JIhqudxy=>h Notice that the data from all regions will be stored in the selected workspace", @@ -352,7 +352,7 @@ }, "instructionSteps": [ { - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Aruba%20ClearPass/Parsers/ArubaClearPass.txt).The function usually takes 10-15 minutes to activate after solution installation/update." + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://aka.ms/sentinel-arubaclearpass-parser).The function usually takes 10-15 minutes to activate after solution installation/update." }, { "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", @@ -420,7 +420,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Aruba ClearPass data connector with template version 3.0.0", + "description": "Aruba ClearPass data connector with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -509,7 +509,7 @@ }, "instructionSteps": [ { - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Aruba%20ClearPass/Parsers/ArubaClearPass.txt).The function usually takes 10-15 minutes to activate after solution installation/update.", + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://aka.ms/sentinel-arubaclearpass-parser).The function usually takes 10-15 minutes to activate after solution installation/update.", "instructions": [ { "parameters": { @@ -701,7 +701,7 @@ }, "instructionSteps": [ { - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Aruba%20ClearPass/Parsers/ArubaClearPass.txt).The function usually takes 10-15 minutes to activate after solution installation/update.", + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias ArubaClearPass and load the function code or click [here](https://aka.ms/sentinel-arubaclearpass-parser).The function usually takes 10-15 minutes to activate after solution installation/update.", "instructions": [ { "parameters": { @@ -710,12 +710,12 @@ { "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - + }, { "title": "Step B. Forward Aruba ClearPass logs to a Syslog agent", "description": "Configure Aruba ClearPass to forward Syslog messages in CEF format to your Microsoft Sentinel workspace via the Syslog agent.\n1. [Follow these instructions](https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/Content/CPPM_UserGuide/Admin/syslogExportFilters_add_syslog_filter_general.htm) to configure the Aruba ClearPass to forward syslog.\n2. Use the IP address or hostname for the Linux device with the Linux agent installed as the Destination IP address." - + }, { "title": "Step C. Validate connection", @@ -755,7 +755,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ArubaClearPass Data Parser with template version 3.0.0", + "description": "ArubaClearPass Data Parser with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserVersion1')]", @@ -881,7 +881,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.0", + "version": "3.0.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Aruba ClearPass",