Nikhil Chawla Add-on for Cisco Secure Firewall eStreamer (FMC)

Collects connection events from a Cisco Secure Firewall Management Center (FMC) over eStreamer and indexes them as sourcetype cisco:sfw:estreamer, with the field names the Cisco Security Cloud app uses for that sourcetype (InitiatorIP, ResponderIP, FirewallRule, AC_RuleAction, ...). That app's field aliases, CIM mappings and dashboards therefore work on these events, and existing searches keep working. Busy FMCs send thousands of connection events per second. This add-on is built for that volume: each input decodes in parallel processes, keeps events on disk until Splunk has read them, and resumes from a bookmark after a restart, so a restart does not skip events. - One input per FMC, several FMCs per heavy forwarder - Inputs page in Splunk Web: add, edit, enable, disable and restart inputs, and upload the eStreamer client certificate (the PKCS12 file from the FMC, or PEM). Certificates are stored encrypted in Splunk's credential store. - Status dashboard: throughput, minutes behind the FMC, connects and errors, indexed volume and index delay per FMC - Names from the FMC's metadata: rules, access control policy (FirewallPolicy), prefilter policy (PrefilterPolicy), tunnel/prefilter rule (TunnelRule), zones, interfaces, devices, applications, URL categories and countries - host is a name you choose for each FMC; the FMC's address is in every event as SourceHost - Disk buffer with a size cap: files are deleted once Splunk has read them; when the buffer is full, delete the oldest files or pause - Python standard library only, no third-party packages Connection events only. Intrusion, file/malware and packet events can come from the Cisco Security Cloud app. Independent project, not affiliated with or endorsed by Cisco. Cisco, Cisco Secure Firewall, Firepower and FMC are trademarks of Cisco Systems, Inc.