Cisco Security Suite is Community Supported, and is not supported by Splunk. Please check Splunk Answers for any issues or questions that are not answered here.
If you have a current Splunk Enterprise Support entitlement, Splunk will provide best-effort support for cases involving this app directly, but such cases will not be subject to the Splunk Enterprise Support SLA.
The Cisco Security Suite for Splunk application is an "umbrella" application in that several other applications and add-ons are required. Please ensure that you read the "Getting Started" section and "Upgrading" section of the documentation that is included with the application under the "Help" menu.
You must remove all prior versions of the Splunk Cisco Security Suite, including Splunk_CiscoFirewalls, Splunk_CiscoIronportWSA, and Splunk_CiscoIronportESA before installing this app.
With any Splunk app, there are 2 parts:
The Cisco Security Suite for Splunk is not configured for any data collection by default. Extra apps known as technology add-ons (TA) must be downloaded to collect data for the various Cisco products. TAs are responsible for collecting data and usually do not have any visualizations. The Cisco Security Suite for Splunk does not contain any TAs itself. These TAs must be downloaded and installed separately for each product type you want to use in the Cisco Security Suite for Splunk. Links to the specific TAs needed for the Cisco Security Suite for Splunk are listed in the steps below detailing setups.
If you want to query the Cisco Security Suite using Data Models, then download and install the Common Information Model app.
Known Issues
===
3.1.2
- Package name still has "Splunk_" prefix. This is required if keeping same Splunkbase path yet this app is no longer Splunk supported
- splunkdConnectionTimeout may still need to be set artificially high on some systems for the setup experience
What's New
===
3.1.2 Change Log
- Moved root README to README.txt
- Removed the transforms "cisco-wsa-usage" as it was not used in any props, views, searches, or macros
- Removed cisco_wsa_usage.csv from lookups as it was not used in any transforms, views, searches, or macros
- Restored transforms stanza cisco-wsa-userid which was merged with and corrupting stanza cisco-wsa-ntdomain
- Removed transforms stanza cisco-wsa-category as it was not used in any props, views, searches, or macros
- Removed cisco_wsa_categories.csv from lookups as it was not used in any views, searches, or macros
- Removed cisco_wsa_categories from transforms
- Removed README file from lookups folder
- Removed message_catalog.csv from lookups as it was
Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.