New Features and Enhancements

The vulnerability, posture, and risk score features are deprecated in ClearPass Device Insight.

The following new features are introduced in ClearPass Device Insight:

Auto Discover Switches

Auto discover switches is a method by which ClearPass Device Insight automatically discovers switches in a segment. Automatic discovery of switches is independent of any augmentation method. For more information, see Auto Discover Switches.

The following new features and enhancements were introduced in ClearPass Device Insight:

Ability to Classify Devices Using MDM Attributes

With this release, ClearPass Device Insight introduces the capability to classify devices using Mobile Device Management (MDM Mobile Device Management. MDM is an administrative software to manage, monitor, and secure mobile devices of the employees in a network. ) attributes. ClearPass Device Insight gives precedence to MDM attributes while classifying devices. For example, if a device has both DHCP Dynamic Host Configuration Protocol. A network protocol that enables a server to automatically assign an IP address to an IP-enabled device from a defined range of numbers configured for a given network.  attributes and MDM attributes, ClearPass Device Insight gives precedence to MDM attributes. MDM attributes are displayed in the Device Details > Profile > Static Attributes card.

The following MDM attributes are displayed:

  • Server Name—MDM server name.
  • Manufacturer—Manufacturer of the device.
  • Model—Model of the device.
  • Operating System—Operating system of the device.
  • Server Type—Type of MDM server.

For more information, see Classified Devices - Device Details Overview.

Support for Bulk Actions in the All NADs Page

You can now perform bulk changes in the All NADs page. The Actions menu is located in the upper right hand corner above the grid:

The menu has the following options that enable different bulk actions to be performed against the NADs that are displayed in the grid:

  • Update Collector—Opens the Update Collector dialog where you can update the collector associated to all the NADs that are displayed in the grid.
  • Update Frequency—Opens the Update Frequency dialog where you can update the polling frequency for all the NADs that are displayed in the grid.
  • Update Status—Opens the Update Status dialog where you can update the status for all the NADs that are displayed in the grid.
  • Delete—Opens the Delete dialog where you can delete all the NADs that are displayed in the grid from polling.

For more information, see the following topics:

TCP-based Clustering

With this release, ClearPass Device Insight introduces TCP Transmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. -based clustering. If a device cannot be assigned a device cluster A device cluster is a logical group of devices having similar properties. using LDA-based clustering, an additional TCP fingerprint classifier is run based on the availability of TCP fingerprint data for the device. If it can, device clusters are formed based on similar TCP fingerprints of generic devices Generic devices are unknown devices which cannot be classified using any of the system or user defined classification criteria. Generic devices do not contain enough fingerprint data to classify them. Generic devices are grouped into device clusters by similar properties and can then be classified by the user either by assigning a classification set to the device cluster or creating a user defined rule. within the device cluster. Devices with or without MAC Media Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. address are considered for TCP fingerprint clustering. This process also provides classification recommendations and they are based on the percentages of the Random Forest class assignments to the generic devices.

Auto classification is not available for TCP fingerprint device clusters. You can view these device clusters on the Generic Devices - Dashboard page.

Using the Cluster Details dialog you can manage the classification details for a specific cluster. The classification recommendations are displayed on the Cluster Details dialog. If a device cluster is based on TCP fingerprint clustering, the following message is displayed below Classification Recommendations:

Recommendations based on similar TCP fingerprints within this cluster of generic devices.

For more information, see About Generic Devices Page.

Label Seeding

With this release, ClearPass Device Insight introduces label seeding. If sufficient data is not available to assign a device to a cluster, ClearPass Device Insight leverages device data (seed data) from other tenants (customers) to assign the device to a cluster.

If a device cluster is based on LDA clustering, but also includes seed data from the other tenants, the following message is displayed below Classification Recommendations:

Recommendations based on [XXX (quantity of devices)] similar and augmented classified devices.

For more information, see About Generic Devices Page.

The following new features and enhancements were introduced in ClearPass Device Insight:

Ability to Delete Attributes for an Individual Device

Previously, we provided the capability to delete device attributes for multiple devices at one time. Now with this feature, you can delete the device attributes for an individual device. You can delete all device attributes (static attributes and flow attributes) or just the flow attributes for an individual device. A Delete Attributes button has been added to the Device Details dialog of the Classified Devices page, Generic Devices page, and User Classified Devices page.

To use this feature, perform the following:

  1. Go to one of the following:
    • Menu > Classified Devices.
    • Menu > Generic Devices.
    • Menu > User Classified Devices.
  2. Select the Devices tab to view the specific devices represented in the dashboard.
  3. Hover over the device in the grid in which you want to delete the attributes and click the details icon or click the MAC address.

    The Device Details dialog opens displaying additional details for the device in the Profile tab. The attributes for the device are displayed in the Static Attributes card and the Flow Attributes card in the Profile tab. The Delete Attributes button is displayed In the upper right hand corner of the Static Attributes card.

  4. Click Delete Attributes in the Static Attributes card.

    The Delete Attributes dialog opens displaying an All attributes button and a Flow Attributes button.

  5. Delete the attributes for the device by performing one of the following:
    • Click All attributes to delete all attributes for the device.
    • Click Flow attributes to delete only the flow attributes for the device.
  6. Click Confirm.

For more information, see Deleting Device Attributes.

Machine Learning Clustering

With this release, ClearPass Device Insight introduces machine learning clustering. This feature replaces similarity-based clustering for the creation of generic device clusters. Machine learning clustering clusters generic devices with classified devices that have similar attributes. The different device attributes for these devices including communication and behavior patterns are extracted for each of these devices. Latent Dirichlet Allocation (LDA) topic modeling is then run against this device data. Machine learning clustering then generates device clusters for the generic devices in the cluster using Eucledian distance. These device clusters are displayed on the Generic Devices page.

In addition, the clusters now provide recommendations of possible classifications to help you easily classify the generic devices. These recommendations are available on the Cluster Details dialog and depend on the devices that formed the cluster. If recommendations are not provided, you can enter a custom classification. Classification recommendations were not provided with similarity-based clustering.

Finally, similarity-based clustering enabled you to create user defined rules A rule is a user defined classification set used by the system to classify unknown (generic) devices or reclassify devices. Rule classification overrides system classification. using the device attributes from the cluster as a template. Machine learning clustering does not enable you to create user defined rules from the clusters.

For more information, see Classifying Generic Devices and Reclassifying Devices.

Redesigned Device Details User Interface

The Device Details dialog has been redesigned. The existing Device Details dialog and the Search Results dialog were combined into one newly designed Device Details dialog that contains all of the device details for a device. This newly designed dialog contains multiple tabs (Profile, Network and History) and has a different look and feel than the old one. Now you can easily view the device details for a device in one place.

Plus, this dialog now opens when you perform a global search for a device using the global search functionality.

Figure 1  Example of the New Device Details Dialog (Partial)

For more information, see Classified Devices - Device Details Overview and Searching for Devices Using Global Search.

The following new features and enhancements were introduced in ClearPass Device Insight:

Bulk Deletion of Device Attributes

You can now delete all device attributes or just flow attributes (Application ID, Application Group, Destination Connections, Destination Hosts, and Ports) from devices. A new Actions menu with a Delete Attributes option has been added to the List view of the Classified Devices page, Generic Devices page, and User Classified Devices page.

To use this feature, perform the following:

  1. Go to one of the following:
    • Menu > Classified Devices.
    • Menu > Generic Devices.
    • Menu > User Classified Devices.
  2. Select the Devices tab to view the specific devices represented in the dashboard.
  3. (Optional) Filter the devices that display in the List view.
  4. Click the down arrow in the Actions menu and select Delete Attributes.

    The Delete Attributes dialog opens displaying an All attributes button and a Flow Attributes button.

  5. Delete the attributes for the devices by performing one of the following:
    • Click All attributes to delete all attributes for the devices displayed in the List view including the flow attributes.
    • Click Flow attributes to delete only the flow attributes for the devices displayed in the List view.
  6. Click Confirm.

    The attributes are deleted from the devices. Device reclassification may occur.

For more information, see Deleting Device Attributes.

Polling of Network Access Devices Without the Need for Span Port

ClearPass Device Insight now provides the capability to poll network access devices (NADs) to discover devices on the network.

The NADs to be polled are managed using the new All NADs page. Using the All NADs page you can enable or disable the polling of a NAD Network Access Device. NAD is a device that automatically connects the user to the preferred network, for example, an AP or an Ethernet switch. and enter the polling frequency for a NAD. Any NADs discovered during a network discovery scan are automatically displayed on the All NADs page. You can also enter new NADs to be polled that were not discovered during a network discovery scan using the new New NAD page. After you add a NAD using the New NAD page, it is displayed on the All NADs page where it can be managed.

Any devices that are discovered during the polling of a NAD are displayed on the Classified Devices page, Generic Devices page, or User Classified Devices page.

To use this feature, perform the following:

  1. Go to Menu > Discovery Settings > All NADs.

    The All NADs page opens displaying all of the NADs available to be polled. If a network discovery scan has been run, any NADs discovered during the scan are automatically displayed on this page. For these NADs, Network Discovery scan is displayed in the Created By field, 60 minutes is displayed by default in the Frequency field, and these NADs are not enabled for polling by default (Enabled field is set to No).

  2. Enable a NAD for polling by performing the following:
    1. Hover over the NAD row in the grid and click the edit icon located in the Frequency column.
    2. (Optional) Modify the frequency.
    3. Click the Enable NAD check box to enable the NAD for polling or clear the check box to disable the NAD for polling.
    4. Click Save.
    5. Click Close.
  3. Add additional NADs by performing the following:
    1. Go to Menu > Discovery Settings > New NAD.
    2. Enter information (Name, Assigned Collector, IP Address, and Frequency) for the new NAD.
    3. Click the Enable NAD check box to enable the NAD for polling.
    4. Click Save.
    5. Click Close.

      This NAD is displayed in the All NADs page. For this NAD, the individual's email that created the NAD is displayed in the Created By field.

      For more information, see Managing Network Access Devices.

The following new features and enhancements were introduced in ClearPass Device Insight:

View Active Scans

You can now view the scans that are active for each collector or segment. To use this feature, go to the following:

  • Menu > Discovery Settings > All Collectors and select the new Active tab within a collector card. The name of the scans that are active are displayed along with the date and time that the scans started.
  • Menu > Discovery Settings > All Segments and select the new Active tab within a segment card. The name of the scans that are active are displayed along with the date and time that the scans started.

Create User Defined Rules From Scratch

The user defined rule functionality was enhanced. You can now create a user defined rule from scratch from the Generic Devices - Dashboard. To use this feature, go to Menu > Generic Devices and click the Create Rule action button. The Classify Devices Using Rule dialog opens giving you the capability to create a rule from scratch.

New User Interface or User Experience Enhancements

Several new user interface or user experience enhancements were introduced. They are:

  • When adding a filter, you can now add and configure additional fields besides those associated with the specific device. The Select fields to configure icon was added to the Filter dialog. When you click this icon, a dialog box opens where you can select the additional fields you wish to configure for the filter. The Filter dialog is accessed by clicking the Filter button from the Classified Devices - Device Details dialog.
  • You can now view the collector that discovered a specific device by using the new Device Source field or column. The Device Source field is available on the Device Details dialog and the Search Results page.

    The Device Source column is available in the Classified Devices - List view, Generic Devices - List view, and User Classified Devices - List view.

  • You can no longer schedule subnet Subnet is the logical division of an IP network. scans from the Edit Subnet Segment page. The Device Discovery card has been removed from this page. All scans are now scheduled using the Edit Collector page.

    This does not impact any existing functionality as all scans scheduled at the segment level have been duplicated at the collector level.

  • You can now view when the device attributes were last updated for a device in the Device Attributes card of the Search Results page. In the heading of the card, the date and time the attributes were last updated is now displayed.
  • You can now view the change history for several more device attributes within the Device History card of the Search Results page. The device attributes that were added to this card are:
    • Category
    • Family
    • Host Name
    • MAC Address
    • Type
    • User Name
  • The data retention period has been changed for the data records that are displayed in the Device History card and the Network Digest card of the Search Results page. ClearPass Device Insight now retains the records that are displayed in these cards for two weeks.

The following new features and enhancements were introduced in ClearPass Device Insight:

ClearPass Policy Manager Integration

ClearPass Device Insight can now seamlessly integrate with ClearPass Policy Manager ClearPass Policy Manager is a baseline platform for policy management, AAA, profiling, network access control, and reporting. With ClearPass Policy Manager, the network administrators can configure and manage secure network access that accommodates requirements across multiple locations and multivendor networks, regardless of device ownership and connection method. where appropriate access control enforcement policies or quarantines can automatically be applied to the spectrum of devices discovered by ClearPass Device Insight.

After the integration between ClearPass Device Insight and ClearPass Policy Manager has been enabled, device information is exchanged between the two applications. Devices that are discovered on the network and classified by ClearPass Device Insight are passed to ClearPass Policy Manager for comprehensive policy control and real-time enforcement. At the same time, information related to those devices that is within ClearPass Policy Manager is sent to ClearPass Device Insight.

You can view all of the devices that are on the network using the Classified Devices page, Generic Devices page, and User Classified Devices page in ClearPass Device Insight. Using the Device Details dialog in ClearPass Device Insight you have a comprehensive view of a specific device and all of its attributes (including those sent from ClearPass Policy Manager).

For more information about the integration between ClearPass Device Insight and ClearPass Policy Manager, see ClearPass Policy Manager 6.8 User Guide.

The following user interface changes were made in ClearPass Device Insight for this feature:

  • The Filters dialog has been enhanced. You will now be able to filter devices by additional attributes provided by ClearPass Policy Manager.
  • The All Collectors page will now display the ClearPass Policy Manager instances that are registered for integration with ClearPass Device Insight in collector cards on the page. For these types of cards, the following information is displayed:
    • ClearPass Policy Manager instance name.
    • When the ClearPass Policy Manager instance was lasted edited.
    • Status of the ClearPass Policy Manager instance.
    • ClearPass Policy Manager instance integration status whether it is enabled or disabled.

    For a ClearPass Policy Manager instance, the card only contains a System tab and does not contain a Segments tab or Scan tab. The System tab, displays the IP address of the ClearPass Policy Manager instance and the ClearPass Policy Manager version.

    You cannot edit this collector card and you cannot disable or enable the integration with ClearPass Policy Manager using this card. Enabling or disabling the integration between ClearPass Device Insight and ClearPass Policy Manager is performed in ClearPass Policy Manager on the Device Insight Integration page.

Reporting Enhancements

The reporting functionality was enhanced. You can now create reports from the Classified Devices page (Dashboard and List view), Generic Devices page (Dashboard and List view) and User Classified Devices page (Dashboard and List view) and then manage all of the reports that are created using the All Reports page and its associated dialogs.

You create reports using the Create Report dialog accessed from the Classified Devices page, Generic Devices page, or User Classified Devices page by clicking the Create Report action button. You can schedule reports to run at a frequency of your choosing and you can send these reports to the email addresses of one or more individuals.

After the reports are created, using the All Reports page and its associated dialogs you can easily manage the reports. From the All Reports page you can:

  • Edit report configuration options.
  • Clone a report.
  • Delete a report.
  • Download or delete a specific run of a report.

To use this feature:

  1. Go to one of the following:
    • Menu > Classified Devices.
    • Menu > Classified Devices > Select the Devices Tab.
    • Menu > Generic Devices.
    • Menu > Generic Devices > Select the Devices Tab.
    • Menu > User Classified Devices.
    • Menu > User Classified Devices > Select the Devices Tab.
  2. Display information in the Dashboard or List view of the Classified Devices page, Generic Devices page, or User Classified Devices page using the display options.
  3. Click the Create Report action button.

    The Create Report dialog opens.

  4. Create the report by selecting the report configuration options and save.
  5. Go to Menu > Reports > All Reports.

    The All Reports page appears displaying all of the different reports that you have created. Each report is displayed in an individual card on the page.

  6. Manage the reports by performing one or more of the following:
    • Select the Runs tab and download or delete a specific run of the report.
    • Click the Edit icon to open the Edit Report dialog. Use the Edit Report dialog to edit the report configuration options.
    • Click the Clone icon to open the Clone Report dialog. Use the Clone Report dialog to clone a report.
    • Click the Delete icon to delete the report.

New User Interface or User Experience Enhancements

Several new user interface or user experience enhancements were introduced. They are:

The Excludes operator is now available to be selected when creating a rule on the Classify Devices Using Rule dialog or when editing a rule on the Edit Rule dialog.

The operator associated with each property for a rule is now displayed next to each property on the Manage Rule dialog.

When viewing the device details for a device using global search, a Show field and a Full Screen icon have been added to the Network Digest card of the Search Results page. The Show field enables you to select the number of destination hosts to show in the sankey chart for each application or protocol. Options are:

Top 5

Top 10

None

The Full Screen icon enables you to render the sankey chart in a full screen view.

Export PDF action button has been replaced by the Create Report action button on the Dashboard of the Classified Devices page, Generic Devices page, and User Classified Devices page. Using the new Create Report functionality you have the option to immediately export a Dashboard to a PDF file.

Export CSV action button has been replaced by the Create Report action button on the List view of the Classified Devices page, Generic Devices page, and User Classified Devices page. Using the new Create Report functionality you have the option to immediately export a List view to a comma separated file (CSV Comma-Separated Values. A file format that stores tabular data in the plain text format separated by commas.) file.

Synthetic MAC addresses for devices are now displayed as Not Available on the List view of the Classified Devices page, Generic Devices page, and User Classified Devices page.

The following new features and enhancements were introduced in ClearPass Device Insight:

Upload List of Subnets to a Segment From a File

The Edit Subnet Segment page has been enhanced so that when you are creating or editing a segment you can add subnets to the segment by uploading them from a comma separated value (CSV) file that contains a list of the subnets. An Upload icon was added to the right of the Subnet List card.

To use this feature, go to Menu > Discovery Settings > New Subnet Segment. Enter the name and description for the segment then click the Save button. Hover over the Subnet List card and click the Upload icon to the right of the card.

Ability to Add Tags Based on WMI or SSH Log Ins

To assist with identifying which devices are corporate-owned versus employee-owned, a new Access Type device attribute is now collected for a device if Secure Shell (SSH Secure Shell. SSH is a network protocol that provides secure access to a remote device. ) or Windows Management Instrumentation (WMI Windows Management Instrumentation. WMI consists of a set of extensions to the Windows Driver Model that provides an operating system interface through which instrumented components provide information and notification.) log in was successful or not for a device. ssh is displayed for the Access Type attribute if SSH log in was successful or wmi if WMI log in was successful. If the Access Type attribute is displayed for a device that indicates the device is corporate-owned. Otherwise, the device is considered employee-owned. Existing tag and filter functionality is extended to this new attribute and you can use this attribute to correctly identify devices. You can view the Access Type attribute for a device on the Classified Devices - Device Details dialog or on the Search Results page if performing a global search for a device.

To use this feature, perform one of the following:

  • Go to Menu > Classified Devices > Select the Devices tab. Hover over a device and click the details icon. Select the Attributes tab.
  • Go to global Search (click the Search icon at the top of the ClearPass Device Insight user interface) and search for a device.

New User Interface or User Experience Enhancements

Several new user interface or user experience enhancements were introduced. They are:

  • Device count is now displayed beside the Tag Name in the Filters dialog.
  • Sort capability has been added to the columns in the grid on the Classified Devices - List view.
  • An Action button has been added above the grid on the Classified Devices - List view, Generic Devices - List view, and User Classified Devices - List view that opens a column selector dialog. This dialog lists all of the columns available to be displayed in the grid. Using this dialog you can add and remove the columns that display in the grid.
  • The User Defined Rule Classification card in the Search Results page has been enhanced to also display the classification information for a device classified by a system rule. The title of the card has been changed from User Defined Rule Classification to Rule Classification and a new value of System has been added to the Classified By field.
  • The Filter By field has been added to the Network Digest card in the Search Results page enabling you to filter the traffic flow data by a specific protocol.
  • The term cluster has been changed to device cluster in several places on the ClearPass Device Insight user interface. For example, on the Generic Devices - Dashboard page the following changes have been made:
    • In the Generic Devices Overview card, the Clusters field label has been changed to Device Clusters.
    • The title of the Clusters card has been changed to Device Clusters.