icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Cisco Security Suite
SHA256 checksum (cisco-security-suite_312.tgz) e57f6fa435496f32d0d7071600aea47a92fcc506283c8e8fe2d0c2669a153e9e SHA256 checksum (cisco-security-suite_311.tgz) 406985e815e0a2316a9d54b7d8e2c5fe48adfde2890e49c8002eedf69c62a5d2
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

splunk

Cisco Security Suite

Splunk Cloud
Splunk Labs
This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
The Cisco Security Suite provides a single pane of glass interface into Cisco security data. It supports Cisco ASA and PIX firewall appliances, the FWSM firewall services module, Cisco IPS, Cisco Web Security Appliance (WSA), Cisco Email Security Appliance (ESA), Cisco Identity Services Engine (ISE), pxGrid, and Cisco Advanced Malware Protection / Sourcefire.

Support for this content

Cisco Security Suite is Community Supported, and is not supported by Splunk. Please check Splunk Answers for any issues or questions that are not answered here.

If you have a current Splunk Enterprise Support entitlement, Splunk will provide best-effort support for cases involving this app directly, but such cases will not be subject to the Splunk Enterprise Support SLA.

Getting Started

The Cisco Security Suite for Splunk application is an "umbrella" application in that several other applications and add-ons are required. Please ensure that you read the "Getting Started" section and "Upgrading" section of the documentation that is included with the application under the "Help" menu.

Upgrading from versions prior to 3.0.x

You must remove all prior versions of the Splunk Cisco Security Suite, including Splunk_CiscoFirewalls, Splunk_CiscoIronportWSA, and Splunk_CiscoIronportESA before installing this app.

Installation (main application)

With any Splunk app, there are 2 parts:

  1. Data collection
  2. Data visualization/analytics

Data Collection

The Cisco Security Suite for Splunk is not configured for any data collection by default. Extra apps known as technology add-ons (TA) must be downloaded to collect data for the various Cisco products. TAs are responsible for collecting data and usually do not have any visualizations. The Cisco Security Suite for Splunk does not contain any TAs itself. These TAs must be downloaded and installed separately for each product type you want to use in the Cisco Security Suite for Splunk. Links to the specific TAs needed for the Cisco Security Suite for Splunk are listed in the steps below detailing setups.


Setting up Cisco ASA

Setup Data collection (TA)

  1. Download the Add-on for Cisco ASA. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-asa
  5. For more detailed information about the Cisco ASA data collection, refer to the Cisco ASA configuration detailed documentation.

Setting up Cisco WSA

Setup Data collection (TA)

  1. Download the Add-on for Cisco WSA. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-wsa
  5. For more detailed information about the Cisco WSA data collection, refer to the Cisco WSA configuration detailed documentation.

Setting up Cisco ESA

Setup Data collection (TA)

  1. Download the Add-on for Cisco ESA. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-esa
  5. For more detailed information about the Cisco ESA data collection, refer to the Cisco ESA configuration detailed documentation.

Setting up Cisco ISE

Setup Data collection (TA)

  1. Download the Add-on for Cisco ISE. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ise
  5. For more detailed information about the Cisco ISE data collection, refer to the Cisco ISE configuration detailed documentation.

Setting up Cisco IPS

Setup Data collection (TA)

  1. Download the Add-on for Cisco IPS. The add-on needs to be installed to the search head to allow a user to use the search-time knowledge provided within the add-on.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ips
  5. For more detailed information about the Cisco IPS data collection, refer to the Cisco IPS configuration detailed documentation.

Setting up Cisco Sourcefire

Setup Data collection (TA)

  1. Download the Cisco eStreamer for Splunk app.
  2. From the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.
  3. Click the "Install app from file" button, locate the downloaded file and click "Upload".
  4. Verify (if necessary) that the app is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at $SPLUNK_HOME/etc/apps/eStreamer
  5. Navigate to the Cisco eStreamer for Splunk app's Help -> Documentation page for futher instructions.

More Information

If you want to query the Cisco Security Suite using Data Models, then download and install the Common Information Model app.

Release Notes

Version 3.1.2
Aug. 23, 2016

Known Issues

3.1.2
- Package name still has "Splunk_" prefix. This is required if keeping same Splunkbase path yet this app is no longer Splunk supported
- splunkdConnectionTimeout may still need to be set artificially high on some systems for the setup experience

What's New

3.1.2 Change Log
- Moved root README to README.txt
- Removed the transforms "cisco-wsa-usage" as it was not used in any props, views, searches, or macros
- Removed cisco_wsa_usage.csv from lookups as it was not used in any transforms, views, searches, or macros
- Restored transforms stanza cisco-wsa-userid which was merged with and corrupting stanza cisco-wsa-ntdomain
- Removed transforms stanza cisco-wsa-category as it was not used in any props, views, searches, or macros
- Removed cisco_wsa_categories.csv from lookups as it was not used in any views, searches, or macros
- Removed cisco_wsa_categories from transforms
- Removed README file from lookups folder
- Removed message_catalog.csv from lookups as it was

Version 3.1.1
May 13, 2015

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.