Cisco Security Suite

The Cisco Security Suite provides a single pane of glass interface into Cisco security data. It supports Cisco ASA and PIX firewall appliances, the FWSM firewall services module, the WSA web security appliance, Cisco IronPort Email Security Appliance (ESA), Cisco Identity Services Engine (ISE), and Cisco Sourcefire.

Release Notes

Important note: This app is completely reconstructed and rewritten for Splunk Enterprise 6.

Support for this content

This app is not officially supported by Splunk Support. If you have a current Splunk Enterprise Support entitlement, Splunk will provide best-effort support for cases involving this app directly, but such cases will not be subject to the Splunk Enterprise Support SLA.

Getting Started

The Cisco Security Suite for Splunk application is an "umbrella" application in that several other applications and add-ons are required. Please ensure that you read the "Getting Started" section and "Upgrading" section of the documentation that is included with the application under the "Help" menu.

Upgrading from versions prior to 3.0.x

You must remove all prior versions of the Splunk Cisco Security Suite, including Splunk_CiscoFirewalls, Splunk_CiscoIronportWSA, and Splunk_CiscoIronportESA before installing this app.

Installation (main application)

With any Splunk app, there are 2 parts:

  1. Data collection
  2. Data visualization/analytics

Data Collection

The Cisco Security Suite for Splunk is not configured for any data collection by default. Extra apps known as technology add-ons (TA) must be downloaded to collect data for the various Cisco products. TAs are responsible for collecting data and usually do not have any visualizations. The Cisco Security Suite for Splunk does not contain any TAs itself. These TAs must be downloaded and installed separately for each product type you want to use in the Cisco Security Suite for Splunk. Links to the specific TAs needed for the Cisco Security Suite for Splunk are listed in the steps below detailing setups.

Data Visualizations

Data visualizations including dashboards and forms are contained in a supporting add-on (SA). By default, no SAs are enabled for the Cisco Security Suite for Splunk. Unlike TAs, SAs are contained within the Cisco Security Suite for Splunk. These SAs are located in $SPLUNK_HOME/etc/apps/Splunk_CiscoSecuritySuite/appserver/addons/. In order to enable an SA, the SA folder for the specific product(s) you want to use must be copied to $SPLUNK_HOME/etc/apps/. Please note that the Splunk server must be restarted after the SAs are copied to the correct place. More details follow in the documentation below about TAs and SAs.

This TA/SA separation is by design so that only the data that applies to your environment is collected and presented. This also allows for greater extensibility by using Splunk 6 Pivot features and the Common Information Model framework.


Setting up Cisco ASA

Setup Data Visualization (SA)

Copy the SA-cisco-asa directory from:
    $SPLUNK_HOME/etc/apps/Splunk_CiscoSecuritySuite/appserver/addons/SA-cisco-asa
To:
    $SPLUNK_HOME/etc/apps/SA-cisco-asa

Restart Splunk

Setup Data collection (TA)

  1. Download the Add-on for Cisco ASA. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-asa
  5. For more detailed information about the Cisco ASA data collection, refer to the Cisco ASA configuration detailed documentation (requires that the above SA-cisco-asa be in the correct place) or the README file that is part of the Add-on for Cisco ASA.

Splunk Add-On for Cisco ASA Configuration Tip

Forcing the sourcetype for received Cisco data, where you have multiple types of cisco data flowing to the Splunk Indexer on a single port.

  1. Navigate to the $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-asa directory.
  2. Create a new directory named local.
  3. Navigate into the $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-asa/default directory.
  4. Copy the props.conf configuration file and place it into the previously created $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-asa/local directory.
  5. Navigate into the $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-asa/local directory.
  6. Open the props.conf configuration file.
  7. Remove the # (commented out markers) at the beginning of the below text in the props.conf file.
    • Note: If you have the data going to a different port or protocol then make the appropriate adjustments, such as if you have cisco asa data being received on tcp port 515, then replace source::udp:514 with source::tcp:515.
    • #[source::udp:514]
    • #TRANSFORMS-force_sourcetype_for_cisco = force_sourcetype_for_cisco_asa,force_sourcetype_for_cisco_pix,force_sourcetype_for_cisco_fwsm
  8. Save the props.conf configuration file.
  9. Restart the Splunk Service/Daemon.

Setting up Cisco WSA

Setup Data Visualization (SA)

Copy the SA-cisco-wsa directory from:
    $SPLUNK_HOME/etc/apps/Splunk_CiscoSecuritySuite/appserver/addons/SA-cisco-wsa
To:
    $SPLUNK_HOME/etc/apps/SA-cisco-wsa

Restart Splunk

Setup Data collection (TA)

  1. Download the Add-on for Cisco WSA. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-wsa
  5. For more detailed information about the Cisco WSA data collection, refer to the Cisco WSA configuration detailed documentation (requires that the above SA-cisco-wsa be in the correct place) or the README file that is part of the Add-on for Cisco WSA.

Setting up Cisco ESA

Setup Data Visualization (SA)

Copy the SA-cisco-esa directory from:
    $SPLUNK_HOME/etc/apps/Splunk_CiscoSecuritySuite/appserver/addons/SA-cisco-esa
To:
    $SPLUNK_HOME/etc/apps/SA-cisco-esa

Restart Splunk

Setup Data collection (TA)

  1. Download the Add-on for Cisco ESA. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-esa
  5. For more detailed information about the Cisco ESA data collection, refer to the Cisco ESA configuration detailed documentation (requires that the above SA-cisco-esa be in the correct place) or the README file that is part of the Add-on for Cisco ESA.

Setting up Cisco ISE

The Cisco ISE integration is slightly different than ASA, ESA, or WSA. There is a stand-alone Cisco ISE app that includes data collection and visualizations. This app must be installed for the Cisco Security Suite to include ISE data. If you prefer to hide the stand-alone ISE app, this can be accomplished by launching Splunk Manager and editing the properties of the Cisco ISE app.

Setup Data collection (TA)

  1. Download the Add-on for Cisco ISE. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ise
  5. For more detailed information about the Cisco ISE data collection, refer to the Cisco ISE configuration detailed documentation (requires that the below SA-cisco-ise be in the correct place) or the README file that is part of the Add-on for Cisco ISE.

Setup Data Visualization (SA)

Copy the SA-cisco-ise directory from:
    $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ise/appserver/addons/SA-cisco-ise
To:
    $SPLUNK_HOME/etc/apps/SA-cisco-ise

Restart Splunk


Setting up Cisco Sourcefire

Setup Data collection (TA)

  1. Download the Cisco eStreamer for Splunk app.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/eStreamer
  5. Navigate to the Cisco eStreamer for Splunk app's Help -> Documentation page for futher instructions.

Setup Data Visualization (SA)

Copy the SA-cisco-sourcefire directory from:
    $SPLUNK_HOME/etc/apps/Splunk_CiscoSecuritySuite/appserver/addons/SA-cisco-sourcefire
To:
    $SPLUNK_HOME/etc/apps/SA-cisco-sourcefire

Restart Splunk


More Information

If you want to query the Cisco Security Suite using Data Models, then download and install the Common Information Model app.

13 ratings