Technology Add-on for Cisco Secure Access Control Server (ACS)
Overview
Details
Technology Add-on for Cisco ACS
Description
This app provides CIM compliant field extractions, eventtypes and tags for Cisco ACS events. This does not include any dashboards or views.
Index-time operations
This app contains index-time operations for timestamping, linebreaking and host rewriting. These are, however, commented out, and should be reviewed prior to use.
Sourcetypes
This TA expects a sourcetype of cisco:acs.
Installation
This TA can be installed by untarring to the $SPLUNK_HOME/etc/apps directory, uploading via the web interface or by using Deployment Server.
Product versions
This TA was created and tested with the following versions of Cisco ACS:
- Versions 5.x
- Versions 4.x
Release Notes
Version 1.5.2
Added extractions for Port and Device_Port
Version 1.5.0
1.3: Made changes to event types (thanks to Vlad from Splunk!)
1.5: Changes to field aliases for changes in fieldalias behavior in Splunk 7.2 (thanks to danverandy)
Version 1.2
Fixes typo app.conf
Version 1.1
First release