Managing Filters and Tags

You can filter the device information that is displayed in the Dashboard and List view of the Classified Devices page. The Filters dialog enables you to enter filter criteria to refine the device information that is displayed. These fields are provided as filter criteria within the dialog:

• Category (device category)
• Family (device family)
• Type (device type)
• NAD IP (network access device IP)
• Subnet
• Segments
• Authentication Method
• Authentication Source
• Open Port
• Service
• Destination Host
• Access Type
• User Name
• MDM Server Type (Mobile Device Management server type)
• MDM Server Name (Mobile Device Management server name)

You can enter filter criteria in the Filters dialog in the following ways:

• Directly into the Filters dialog.
• Clicking the Add To Filter action button after filtering information in the Dashboard cards.
• Selecting the Add To Filter option from the Actions action button in the column heading after filtering information in the List view grid.
• Clicking the Add to Filter button after selecting fields in the Filter Devices dialog accessed from the Device Details dialog.

Using the List view, you can also filter the data directly within the columns in the grid. Plus, you can select fields in the Filter Devices dialog accessed from the Device Details dialog and apply them directly as column filters in the List view grid by clicking the Search button.

Tags Overview

ClearPass Device Insight uses tags to group devices together. In ClearPass Device Insight the following two types of tags are available: user tags and system tags. You can create user tags and the system automatically creates system tags.

User Tags

You can group several devices together by creating a user tag for the group of devices. After you have filtered devices using the Filters dialog you can create a tag from the filtered criteria information. The tag is added to each individual device in the group as an additional attribute. User tags are maintained using the Filters dialog.

You can also use user tags as filter criteria to view device information using the Filters dialog.

You can view the user tags associated with a device on the Device Details dialog.

For information on viewing tags, see Classified Devices - Device Details Overview

System Tags

The Category/Family of a device can change when additional attributes are received for the device or when some attributes are not received for the device due to missing packets and on. A device can exhibit this behavior due to the following:

• MAC Media Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. spoofing
• Issue with the correlation of different events
• Dual boot systems
• Missing DHCP Dynamic Host Configuration Protocol. A network protocol that enables a server to automatically assign an IP address to an IP-enabled device from a defined range of numbers configured for a given network.  packets

ClearPass Device Insight creates system tags automatically and attaches them to devices when their classification transitions. Three different types of system tags are created for device classification transition. These system tags are:

• Expected Transition: Devices where there is a valid classification change.

  This tag is defined as a device having conflicting fingerprints and the device classification transitioned between a valid category or family. For example, a transition between Network Boot Agents <=> Computer and Network Book Agents <=> Server is genuine and this tag classifies those valid transitions.

• Suspected Transition: Devices where there is an unexpected classification change.

  This tag is defined as a device having conflicting fingerprints and the device classification does not have valid transitions as those defined under the Expected Transition tag.

• Library Update Transition: Devices where there classification is changed due to a fingerprint library upgrade.

  This tag is defined as a device having no conflicting fingerprints but the device classification (category, family, and type) changed due to an update in the fingerprint library. This tag excludes classification changes due to user defined rules A rule is a user defined classification set used by the system to classify unknown (generic) devices or reclassify devices. Rule classification overrides system classification. and the assigning of classification sets to a device cluster A device cluster is a logical group of devices having similar properties..

You can view the system tags and the devices associated with those tags using the Filters dialog and the Classified Devices - Dashboard and Classified Devices - List view. The system tags are displayed under the System Tags panel of the Filters dialog.

You can also use system tags as filter criteria to view device information using the Filters dialog.

You can view the system tags associated with a device on the Device Details dialog.

For information on viewing tags, see Classified Devices - Device Details Overview