Accept License Agreements

Thank You

Downloading Cisco Security Suite
MD5 checksum (cisco-security-suite_312.tgz) 6dbd73a45923b7b6a15150a312431e43 MD5 checksum (cisco-security-suite_311.tgz) 2eb5f9eb32ed0a6bd2c25b45302fda3f
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Description required

Cisco Security Suite

Splunk Built
Overview
Details
The Cisco Security Suite provides a single pane of glass interface into Cisco security data. It supports Cisco ASA and PIX firewall appliances, the FWSM firewall services module, Cisco IPS, Cisco Web Security Appliance (WSA), Cisco Email Security Appliance (ESA), Cisco Identity Services Engine (ISE), pxGrid, and Cisco Advanced Malware Protection / Sourcefire.

Support for this content

Cisco Security Suite is Community Supported, and is not supported by Splunk. Please check Splunk Answers for any issues or questions that are not answered here.

If you have a current Splunk Enterprise Support entitlement, Splunk will provide best-effort support for cases involving this app directly, but such cases will not be subject to the Splunk Enterprise Support SLA.

Getting Started

The Cisco Security Suite for Splunk application is an "umbrella" application in that several other applications and add-ons are required. Please ensure that you read the "Getting Started" section and "Upgrading" section of the documentation that is included with the application under the "Help" menu.

Upgrading from versions prior to 3.0.x

You must remove all prior versions of the Splunk Cisco Security Suite, including Splunk_CiscoFirewalls, Splunk_CiscoIronportWSA, and Splunk_CiscoIronportESA before installing this app.

Installation (main application)

With any Splunk app, there are 2 parts:

  1. Data collection
  2. Data visualization/analytics

Data Collection

The Cisco Security Suite for Splunk is not configured for any data collection by default. Extra apps known as technology add-ons (TA) must be downloaded to collect data for the various Cisco products. TAs are responsible for collecting data and usually do not have any visualizations. The Cisco Security Suite for Splunk does not contain any TAs itself. These TAs must be downloaded and installed separately for each product type you want to use in the Cisco Security Suite for Splunk. Links to the specific TAs needed for the Cisco Security Suite for Splunk are listed in the steps below detailing setups.


Setting up Cisco ASA

Setup Data collection (TA)

  1. Download the Add-on for Cisco ASA. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-asa
  5. For more detailed information about the Cisco ASA data collection, refer to the Cisco ASA configuration detailed documentation.

Setting up Cisco WSA

Setup Data collection (TA)

  1. Download the Add-on for Cisco WSA. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-wsa
  5. For more detailed information about the Cisco WSA data collection, refer to the Cisco WSA configuration detailed documentation.

Setting up Cisco ESA

Setup Data collection (TA)

  1. Download the Add-on for Cisco ESA. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-esa
  5. For more detailed information about the Cisco ESA data collection, refer to the Cisco ESA configuration detailed documentation.

Setting up Cisco ISE

Setup Data collection (TA)

  1. Download the Add-on for Cisco ISE. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ise
  5. For more detailed information about the Cisco ISE data collection, refer to the Cisco ISE configuration detailed documentation.

Setting up Cisco IPS

Setup Data collection (TA)

  1. Download the Add-on for Cisco IPS. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ips
  5. For more detailed information about the Cisco IPS data collection, refer to the Cisco IPS configuration detailed documentation.

Setting up Cisco Sourcefire

Setup Data collection (TA)

  1. Download the Cisco eStreamer for Splunk app.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/eStreamer
  5. Navigate to the Cisco eStreamer for Splunk app's Help -> Documentation page for futher instructions.

More Information

If you want to query the Cisco Security Suite using Data Models, then download and install the Common Information Model app.

Release Notes

Version: 3.1.2

Known Issues === 3.1.2 - Package name still has "Splunk_" prefix. This is required if keeping same Splunkbase path yet this app is no longer Splunk supported - splunkdConnectionTimeout may still need to be set artificially high on some systems for the setup experience What's New === 3.1.2 Change Log - Moved root README to README.txt - Removed the transforms "cisco-wsa-usage" as it was not used in any props, views, searches, or macros - Removed cisco_wsa_usage.csv from lookups as it was not used in any transforms, views, searches, or macros - Restored transforms stanza cisco-wsa-userid which was merged with and corrupting stanza cisco-wsa-ntdomain - Removed transforms stanza cisco-wsa-category as it was not used in any props, views, searches, or macros - Removed cisco_wsa_categories.csv from lookups as it was not used in any views, searches, or macros - Removed cisco_wsa_categories from transforms - Removed README file from lookups folder - Removed message_catalog.csv from lookups as it was

Aug. 23, 2016, 11:39 p.m.

Platform Independent

6.4, 6.3, 6.2, 6.1, 6.0

Version: 3.1.1

May 13, 2015, 9:29 a.m.

Platform Independent

6.2, 6.1, 6.0

1,875
Installs
34,335
Downloads
Share Subscribe LOGIN TO DOWNLOAD
Version
3.1.2
Category
Security, Fraud & Compliance
Product Support
Splunk Enterprise
Splunk Cloud
Content Type
App
Splunk Versions
6.4
6.3
6.2
6.1
6.0
Licensing
Splunk Software License Agreement
Platforms
Platform Independent
Built by

Subscribe Share

Splunk Certified

Splunk's App Certification program uses a specific set of criteria to evaluate the level of quality, usability and security your app offers to its users. In addition, we evaluate the documentation and support you offer to your app's users.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2016 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.