Increase visibility of your endpoints outside of the traditional enterprise perimeter and the security risks that target them. The views included in this content pack help you to monitor and analyze Aruba ClearPass events from within the McAfee Enterprise Security Manager console. You can filter Aruba events by normalization, source user, event category, applications, vendor identifier, and event subtype. These filters can help you discover anomalous activity, such as the user "testuser" trying to authenticate outside of normal usage. As you navigate views, relevant filters and panes are bound together in the display to help you investigate quickly.

Content Pack Components

Aruba is also a McAfee Security Innovation Alliance partner. Learn More


  • Aruba ClearPass Authentication Events
  • Aruba ClearPass Endpoint
  • Aruba ClearPass Failed Authentication
  • Aruba ClearPass Overview
  • Aruba ClearPass Radius Events
  • Aruba ClearPass System Events
  • Aruba ClearPass TACACS Events

Required Products

  • McAfee SIEM Enterprise Security Manager (ESM) 11.x, 10.x
  • McAfee SIEM Advanced Correlation Engine (ACE) 11.x, 10.x
  • Aruba ClearPass 6.6.0 or newer

Download Content Pack

Registered ServicePortal users can log in to access the Knowledge Center for further documentation or to download the content pack file manually.

Read Article


Find other content packs and partner integrations.

See All

Free Trial

Interested in McAfee Enterprise Security Manager?