Monitoring, Threat Detection, and Incident Response
Core concepts
Know the telemetry sources: controller/gateway logs, switch syslog, ClearPass access tracker and audit logs, Aruba Central alerts, and RF/wireless intrusion detection. Understand WIDS/WIPS functions: rogue AP detection, evil-twin detection, deauth flood detection, and containment (which can be legally sensitive - containment of neighbor APs may be inappropriate).
Detection and response
Threat detection correlates events: repeated auth failures (brute force), anomalous roaming, unexpected MACs, and posture failures. Incident response follows prepare, detect, contain, eradicate, recover, and lessons learned. In Aruba terms, containment may mean quarantining an endpoint via CoA to a restricted role, blocking a MAC, or disabling a port. Understand that ClearPass Access Tracker is the first place to inspect an authentication event, and that syslog/SNMP traps feed central monitoring.
Traps to watch
Do not confuse detection with prevention - WIDS detects, WIPS can contain. Containment of external/neighbor APs is often the wrong answer due to legal and interference concerns. Questions may ask for the first step in response: usually identify and scope, not immediately block. Also distinguish audit logs (admin actions) from access tracker (authentication events).
Rule of thumb
When asked "what do you check first?" for an auth failure, go to ClearPass Access Tracker; for a wireless anomaly, go to WIDS events; for an admin change, go to audit logs.