Cisco Firepower App for Splunk
Overview
Details
Major Features Include
- Threat Summary Dashboard
- Advanced Impact Event analysis with directionality
- Network Event data dashboard with IoCs and Firewall Rule usage (Allow/Block)
- Context Explorer with Geo-location Map
- Link back from Malware hash to FMC for File Trajectory
- Link Back to FMC for Host Profile
- Filters for CIDR Blocks and Allow/Block Rule actions
TELL US WHAT WILL MAKE THIS APP BETTER FOR YOU! We want your feedback and any feature requests. Please email fp-4-splunk@cisco.com with any requests.
A User Guide is published here https://cisco.com/go/firepower-for-splunk
TELL US WHAT WILL MAKE THIS APP BETTER FOR YOU! We want your feedback and any feature requests. Please email fp-4-splunk@cisco.com with any requests.
Release Notes
Version 1.3.7
Firepower App for Splunk v 1.3.7
Release to Splunkbase 10/21/2019
v1.3.7 Updates -
*Cleaned up UI on Threats Summary page, and Context Explorer
*Modified queries to reflect encore changes, specifically querying filtered "Blocked" now uses the blocked field vs the action field.
*Modified Data In/Out metrics on Context Explorer
*Modified Umbrella Experience
Cisco Firepower App for Splunk presents security and network event information sent to Splunk from Firepower Management Center running version 6.0 or later.
To bring your Firepower data into Splunk, you must use the Cisco eStreamer eNcore Add-on for Splunk. This technical add-on (TA) is available from https://splunkbase.splunk.com/app/3662/.
The types of data available for analysis are described at https://splunkbase.splunk.com/app/3662/.
Features include:
Presents critical Firepower event information
Threat Summary Dashboard
Intrusion Events with Enrichment for Threat Hunting
Network Summary Dashboard
Context Explorer
Table Views
Event Filters
Version 1.3.5
Firepower App for Splunk v 1.3.5
Release to Splunkbase 9/23/2019
v1.3.5 Updates -
*removed issues that prevented version 1.3.2 from being cloud certified
Cisco Firepower App for Splunk presents security and network event information sent to Splunk from Firepower Management Center running version 6.0 or later.
To bring your Firepower data into Splunk, you must use the Cisco eStreamer eNcore Add-on for Splunk. This technical add-on (TA) is available from https://splunkbase.splunk.com/app/3662/.
The types of data available for analysis are described at https://splunkbase.splunk.com/app/3662/.
Features include:
Presents critical Firepower event information
Threat Summary Dashboard
Intrusion Events with Enrichment for Threat Hunting
Network Summary Dashboard
Context Explorer
Table Views
Event Filters
Version 1.3.2
Firepower App for Splunk v 1.3.2
Release to Splunkbase 7/5/2019
v1.3.2 Updates -
*Fixed duplicate dashboard metric on front page for security intel events
*Added more reports to the "Reports" tab
Cisco Firepower App for Splunk presents security and network event information sent to Splunk from Firepower Management Center running version 6.0 or later.
To bring your Firepower data into Splunk, you must use the Cisco eStreamer eNcore Add-on for Splunk. This technical add-on (TA) is available from https://splunkbase.splunk.com/app/3662/.
The types of data available for analysis are described at https://splunkbase.splunk.com/app/3662/.
Features include:
Presents critical Firepower event information
Threat Summary Dashboard
Intrusion Events with Enrichment for Threat Hunting
Network Summary Dashboard
Context Explorer
Table Views
Event Filters
Version 1.3.1
Firepower App for Splunk v 1.3.1
Release to Splunkbase 5/22/2019
v1.3.1 Updates -
*Updated content to conform to Splunk Cloud Certification standards
Cisco Firepower App for Splunk presents security and network event information sent to Splunk from Firepower Management Center running version 6.0 or later.
To bring your Firepower data into Splunk, you must use the Cisco eStreamer eNcore Add-on for Splunk. This technical add-on (TA) is available from https://splunkbase.splunk.com/app/3662/.
The types of data available for analysis are described at https://splunkbase.splunk.com/app/3662/.
Features include:
Presents critical Firepower event information
Threat Summary Dashboard
Intrusion Events with Enrichment for Threat Hunting
Network Summary Dashboard
Context Explorer
Table Views
Event Filters
Version 1.2.9
Firepower App for Splunk v 1.2.9
Release to Splunkbase 4/24/2019
v1.2.9 Updates -
*Removed default enabled=true for the pythons scripts that support Umbrella, as well as removed other unused python scripts
Cisco Firepower App for Splunk presents security and network event information sent to Splunk from Firepower Management Center running version 6.0 or later.
To bring your Firepower data into Splunk, you must use the Cisco eStreamer eNcore Add-on for Splunk. This technical add-on (TA) is available from https://splunkbase.splunk.com/app/3662/.
The types of data available for analysis are described at https://splunkbase.splunk.com/app/3662/.
Features include:
Presents critical Firepower event information
Threat Summary Dashboard
Intrusion Events with Enrichment for Threat Hunting
Network Summary Dashboard
Context Explorer
Table Views
Event Filters
Version 1.2.7
Firepower App for Splunk v 1.2.7
Release to Splunkbase 4/19/2019
v1.2.7 Updates -
*Umbrella Investigate is now here! Using the Event viewer you can now pull in Umbrella threat feeds. Requires Umbrella API Token
*Modifications made to adhere to Splunk Cloud certification requirements
*Settings has moved to traditional app/settings page
Cisco Firepower App for Splunk presents security and network event information sent to Splunk from Firepower Management Center running version 6.0 or later.
To bring your Firepower data into Splunk, you must use the Cisco eStreamer eNcore Add-on for Splunk. This technical add-on (TA) is available from https://splunkbase.splunk.com/app/3662/.
The types of data available for analysis are described at https://splunkbase.splunk.com/app/3662/.
Features include:
Presents critical Firepower event information
Threat Summary Dashboard
Intrusion Events with Enrichment for Threat Hunting
Network Summary Dashboard
Context Explorer
Table Views
Event Filters
Version 1.1.3
Firepower App for Splunk v 1.1.3
Release to Splunkbase 2/27/2019
v1.1.3 Updates -
*Modified Event Viewer to Link back to the FMC for IPs (Network Mapping) and Malware Hashes (File Trajectory)
*Modified Event Viewer to adhere to Cisco branding schemes
*Fixed issue with Action/Blocked Filters not being used in search queries
Cisco Firepower App for Splunk presents security and network event information sent to Splunk from Firepower Management Center running version 6.0 or later.
To bring your Firepower data into Splunk, you must use the Cisco eStreamer eNcore Add-on for Splunk. This technical add-on (TA) is available from https://splunkbase.splunk.com/app/3662/.
The types of data available for analysis are described at https://splunkbase.splunk.com/app/3662/.
Features include:
Presents critical Firepower event information
Threat Summary Dashboard
Intrusion Events with Enrichment for Threat Hunting
Network Summary Dashboard
Context Explorer
Table Views
Event Filters
Version 1.1.2
Firepower App for Splunk v 1.1.2
Release to Splunkbase 2/19/2019
v1.1.2 Updates -
*Modified queries to utilize configurable index located in Marco settings
*Added Event Viewer for Correlation Events
Cisco Firepower App for Splunk presents security and network event information sent to Splunk from Firepower Management Center running version 6.0 or later.
To bring your Firepower data into Splunk, you must use the Cisco eStreamer eNcore Add-on for Splunk. This technical add-on (TA) is available from https://splunkbase.splunk.com/app/3662/.
The types of data available for analysis are described at https://splunkbase.splunk.com/app/3662/.
Features include:
Presents critical Firepower event information
Threat Summary Dashboard
Intrusion Events with Enrichment for Threat Hunting
Network Summary Dashboard
Context Explorer
Table Views
Event Filters
Version 1.1.1
Cisco Firepower App for Splunk
v1.1.1 updates*
*Fixed issue with cross link to FMC on Threats->Dashboard->Indications of Compromise dashboard, previously the FMC ip didn't not load into the right click menu option
Version 1.1
Release notes
Firepower App for Splunk v1.1
*Updates for v1.1 include fully validated by Splunk App Inspect
*Modification to Intrusion Events Dashboard, displaying High Priority Events by Class Description
*Cross Links back to FMC for File Trajectory on Host IoC Dashboard
Cisco Firepower App for Splunk presents security and network event information sent to Splunk from Firepower Management Center running version 6.0 or later.
To bring your Firepower data into Splunk, you must use the Cisco eStreamer eNcore Add-on for Splunk. This technical add-on (TA) is available from https://splunkbase.splunk.com/app/3662/.
The types of data available for analysis are described at https://splunkbase.splunk.com/app/3662/.
Features include:
Presents critical Firepower event information
Threat Summary Dashboard
Intrusion Events with Enrichment for Threat Hunting
Network Summary Dashboard
Context Explorer
Table Views
Event Filters
Link Backs for File Trajectory, Host Profiles, Packet View