Cisco Security Suite
Overview
Details
Support for this content
Cisco Security Suite is Community Supported, and is not supported by Splunk. Please check Splunk Answers for any issues or questions that are not answered here.
If you have a current Splunk Enterprise Support entitlement, Splunk will provide best-effort support for cases involving this app directly, but such cases will not be subject to the Splunk Enterprise Support SLA.
Getting Started
The Cisco Security Suite for Splunk application is an "umbrella" application in that several other applications and add-ons are required. Please ensure that you read the "Getting Started" section and "Upgrading" section of the documentation that is included with the application under the "Help" menu.
Upgrading from versions prior to 3.0.x
You must remove all prior versions of the Splunk Cisco Security Suite, including Splunk_CiscoFirewalls, Splunk_CiscoIronportWSA, and Splunk_CiscoIronportESA before installing this app.
Installation (main application)
With any Splunk app, there are 2 parts:
- Data collection
- Data visualization/analytics
Data Collection
The Cisco Security Suite for Splunk is not configured for any data collection by default. Extra apps known as technology add-ons (TA) must be downloaded to collect data for the various Cisco products. TAs are responsible for collecting data and usually do not have any visualizations. The Cisco Security Suite for Splunk does not contain any TAs itself. These TAs must be downloaded and installed separately for each product type you want to use in the Cisco Security Suite for Splunk. Links to the specific TAs needed for the Cisco Security Suite for Splunk are listed in the steps below detailing setups.
Setting up Cisco ASA
Setup Data collection (TA)
- Download the Add-on for Cisco ASA. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
- From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
- Click the "Install app from file" button, locate the downloaded file and click "Upload".
- Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-asa
- For more detailed information about the Cisco ASA data collection, refer to the Cisco ASA configuration detailed documentation.
Setting up Cisco WSA
Setup Data collection (TA)
- Download the Add-on for Cisco WSA. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
- From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
- Click the "Install app from file" button, locate the downloaded file and click "Upload".
- Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-wsa
- For more detailed information about the Cisco WSA data collection, refer to the Cisco WSA configuration detailed documentation.
Setting up Cisco ESA
Setup Data collection (TA)
- Download the Add-on for Cisco ESA. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
- From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
- Click the "Install app from file" button, locate the downloaded file and click "Upload".
- Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-esa
- For more detailed information about the Cisco ESA data collection, refer to the Cisco ESA configuration detailed documentation.
Setting up Cisco ISE
Setup Data collection (TA)
- Download the Add-on for Cisco ISE. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
- From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
- Click the "Install app from file" button, locate the downloaded file and click "Upload".
- Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ise
- For more detailed information about the Cisco ISE data collection, refer to the Cisco ISE configuration detailed documentation.
Setting up Cisco IPS
Setup Data collection (TA)
- Download the Add-on for Cisco IPS. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
- From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
- Click the "Install app from file" button, locate the downloaded file and click "Upload".
- Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ips
- For more detailed information about the Cisco IPS data collection, refer to the Cisco IPS configuration detailed documentation.
Setting up Cisco Sourcefire
Setup Data collection (TA)
- Download the Cisco eStreamer for Splunk app.
- From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
- Click the "Install app from file" button, locate the downloaded file and click "Upload".
- Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/eStreamer
- Navigate to the Cisco eStreamer for Splunk app's Help -> Documentation page for futher instructions.
More Information
If you want to query the Cisco Security Suite using Data Models, then download and install the Common Information Model app.
Release Notes
Version 3.1.2
Known Issues
===
3.1.2
- Package name still has "Splunk_" prefix. This is required if keeping same Splunkbase path yet this app is no longer Splunk supported
- splunkdConnectionTimeout may still need to be set artificially high on some systems for the setup experience
What's New
===
3.1.2 Change Log
- Moved root README to README.txt
- Removed the transforms "cisco-wsa-usage" as it was not used in any props, views, searches, or macros
- Removed cisco_wsa_usage.csv from lookups as it was not used in any transforms, views, searches, or macros
- Restored transforms stanza cisco-wsa-userid which was merged with and corrupting stanza cisco-wsa-ntdomain
- Removed transforms stanza cisco-wsa-category as it was not used in any props, views, searches, or macros
- Removed cisco_wsa_categories.csv from lookups as it was not used in any views, searches, or macros
- Removed cisco_wsa_categories from transforms
- Removed README file from lookups folder
- Removed message_catalog.csv from lookups as it was