Examples

This page provides some real world scenarios giving you guidance on how to configure the Log Exporter for your scenario.

Example 1: General authentication information

Scope and assumptions

The scope of the query provided below is as follows:

• The admin is interested in understanding which users and/or devices are authenticating (successful or unsuccessful) and to built frequency statistics based on that

• No VLAN tagging is used

• Only certificate-based authentication is used (no username-password-based authentication)

Target

Log Analytics or General Webhook

Message Filter configuration

Rule Engine

Log Level	Enabled
Success	False
Failed	False
Error	False

Authorization System

Log Level	Enabled
Requests	False
Success	True
Failed	True
Error	False

Proxy Authentication

Log Level	Enabled
Connections	False
Success	False
Failed	False
Error	False

Data Configuration

{
    "Decision": {{ data.get('Packet-Type') }},
    "Level": {{ data.level }},
    "IP": {{ data.get('Packet-Dst-Address') }},
    "Username": {{ data.get('User-Name') }},
    {% if data.get('TLS-OCSP-Cert-Valid') != None %}
        "OCSPStatus": {{ data.get('TLS-OCSP-Cert-Valid') }},
    {% endif %}
    {% if data.level == "warning" %}
      "FailReason": {{ data.get('Module-Failure-Message') }},
    {% endif %}
    "Datetime" : {{ data.Datetime }}
}

Example 2: Detailed authentication information

Scope and assumptions

The scope of the query provided below is as follows:

• The admin is interested in understanding which users and/or devices are authenticating (successful or unsuccessful)

• The OCSP response of the CA if certificates are used

• The used Access Point (via MAC address)

• The RADIUS Rule that was triggered / VLAN that was tagged

• Both, certificate-based authentication and username-password-based authentication are considered

Target

Log Analytics or General Webhook

Message Filter Configuration

Rule Engine

Log Level	Enabled
Success	True
Failed	True
Error	False

Authorization System

Log Level	Enabled
Requests	False
Success	False
Failed	False
Error	False

Proxy Authentication

Log Level	Enabled
Connections	False
Success	False
Failed	False
Error	False

Data configuration

{
    "Decision": {{ data.get('Engine-Decision') }},
    "Datetime" : {{ data.Datetime }},
    "Level": {{ data.level }},
    "Authtype": {{ data.get('Auth-Source-Type') }},
    "Client-MAC": {{ data.get('Client-MAC') }},
    "Username": {{ data.get('User-Name') }},
    "Applied-Rule": {{ data.get('Applied-Rule') }},
    "VLAN": {{ data.get('Assigned-VLAN', 'No VLAN assigned') }},
    {% if data.get('Auth-Source-Type') == "WiFi" %}
        "SSID": {{ data.get('SSID') }},
        "AP-MAC": {{ data.get('AP-MAC') }},
    {% endif %}
    {% if data.get('Authtype') == "Certificate" %}
        "OCSPStatus": {{ data.get('OCSP-Response', "Not performed") }},
    {% endif %}
    {% if data.level == "WARNING" %}
        "FailReason": {{ data.get('Reject-Description') }}
    {% endif %}
}

Example 3: General error notifications

Scope and assumptions

The scope of the query provided below is as follows:

• The admin is interested in receiving pro-active notifications about errors on the RADIUSaaS platform for the operations team.

Target

Teams

Message Filter Configuration

Rule Engine

Log Level	Enabled
Success	False
Failed	False
Error	False

Authorization System

Log Level	Enabled
Requests	False
Success	False
Failed	False
Error	True

Proxy Authentication

Log Level	Enabled
Connections	False
Success	False
Failed	False
Error	True

Data configuration

The RADIUS system has issues!
Message: {{ data.get('message') }}

Raw data:
{{ data }}