splunk
Cisco Cloud Web Security (CWS) Add-on for Splunk
This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
The Cisco Cloud Web Security (CWS) Add-on for Splunk allows a Splunk Enterprise administrator to analyze and correlate Cisco Cloud Web Security (CWS) log data through the Common Information Model in Splunk Enterprise. You can then use the data with other Splunk apps, such as Splunk Cisco Security Suite.
Setting up Cisco CWS Add-on for Splunk
Setup Data collection (TA)
- Download the Cisco CWS Add-on for Splunk. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
- From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
- Click the "Install app from file" button, locate the downloaded file and click "Upload".
- Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Cisco_CWS_TA
Setting up the CWS TA Data Inputs
- Navigate to Settings -> Data Inputs.
- Under Local inputs, click on "Cisco CWS Logs".
- Configure the entries to match the AWS S3 account, where:
- client_id/CWS Client ID is the S3 bucket name,
- S3 Key and S3 Secret for your Amazon S3 account and Click Save.
- Click Enable on the Status column.
- Sync should begin in a few minutes as the cron job runs in the background and ingests the CWS log data.
- By default, the sync begins for log data that is 4 hours from the current time.
DISCLAIMER
This app is written and maintained by Cisco (cws-splunksupport at cisco.com), but is only community supported -- no official support is available. Be sure to read the above sections for initial assistance with setup and configuration.
Release Notes
Version 1.1
April 11, 2017
Changes for passing Splunk AppInspect validation.
Cisco CWS Add-on for Splunk. Copyright (C) 2017 Cisco Systems Inc. All rights reserved.
Version 1.0
July 13, 2015
Cisco CWS Add-on for Splunk. Copyright (C) 2015 Cisco Systems Inc. All rights reserved.