Examples

This page provides some real world scenarios giving you guidance on how to configure the Log Exporter for your scenario.

Example 1: General Authentication Information

Scope and Assumptions

The scope of the query provided below is as follows:

  • The admin is interested in understanding which users and/or devices are authenticating (successful or unsuccessful) and to built frequency statistics based on that

  • No VLAN tagging is used

  • Only certificate-based authentication is used (no username-password-based authentication)

Target

Log Analytics or General Webhook

Message Filter Configuration

Rule Engine

Authorization System

Proxy Authentication

Data Configuration

{
    "Decision": {{ data.get('Packet-Type') }},
    "Level": {{ data.level }},
    "IP": {{ data.get('Packet-Dst-Address') }},
    "Username": {{ data.get('User-Name') }},
    {% if data.get('TLS-OCSP-Cert-Valid') != None %}
        "OCSPStatus": {{ data.get('TLS-OCSP-Cert-Valid') }},
    {% endif %}
    {% if data.level == "warning" %}
      "FailReason": {{ data.get('Module-Failure-Message') }},
    {% endif %}
    "Datetime" : {{ data.Datetime }}
}

Example 2: Detailed Authentication Information

Scope and Assumptions

The scope of the query provided below is as follows:

  • The admin is interested in understanding which users and/or devices are authenticating (successful or unsuccessful)

  • The OCSP response of the CA if certificates are used

  • The used Access Point (via MAC address)

  • The RADIUS Rule that was triggered / VLAN that was tagged

  • Both, certificate-based authentication and username-password-based authentication are considered

Target

Log Analytics or General Webhook

Message Filter Configuration

Rule Engine

Authorization System

Proxy Authentication

Data Configuration

{
    "Decision": {{ data.get('Engine-Decision') }},
    "Datetime" : {{ data.Datetime }},
    "Level": {{ data.level }},
    "Authtype": {{ data.get('Auth-Source-Type') }},
    "Client-MAC": {{ data.get('Client-MAC') }},
    "Username": {{ data.get('User-Name') }},
    "Applied-Rule": {{ data.get('Applied-Rule') }},
    "VLAN": {{ data.get('Assigned-VLAN', 'No VLAN assigned') }},
    {% if data.get('Auth-Source-Type') == "WiFi" %}
        "SSID": {{ data.get('SSID') }},
        "AP-MAC": {{ data.get('AP-MAC') }},
    {% endif %}
    {% if data.get('Authtype') == "Certificate" %}
        "OCSPStatus": {{ data.get('OCSP-Response', "Not performed") }},
    {% endif %}
    {% if data.level == "WARNING" %}
        "FailReason": {{ data.get('Reject-Description') }}
    {% endif %}
}

Example 3: General Error Notifications

Scope and Assumptions

The scope of the query provided below is as follows:

  • The admin is interested in receiving pro-active notifications about errors on the RADIUSaaS platform for the operations team.

Target

Teams

Message Filter Configuration

Rule Engine

Authorization System

Proxy Authentication

Data Configuration

The RADIUS system has issues!
Message: {{ data.get('message') }}

Raw data:
{{ data }}

Last updated