topic Re: Cisco Ironport UTF-8 Decode in All Apps and Add-ons

Is there a way to automatically decode Cisco Ironport UTF-8?

ravikirantaleka — Tue, 16 Aug 2022 13:13:53 GMT

Hello,

I am importing Cisco Ironport data into Splunk, field "subject" contains UTF-8 encoded data with jumbled characters. Is there a way to automatically decode the subject to a string format? Now, I am using Powershell and CyberChef application to decode manually.

Kindly let me know how to solve this issue.

Regards,

Re: Cisco Ironport UTF-8 Decode

gcusello — Tue, 16 Aug 2022 08:01:40 GMT

Hi @ravikirantaleka,

which TA are you using to parse the Cisco Ironport logs?

Did you tried with Splunk Add-On for Cisco ESA (https://splunkbase.splunk.com/app/1761/)?

It should contain all the configuration to parse the Cisco Ironport logs.

Ciao.

Giuseppe

Re: Cisco Ironport UTF-8 Decode

ravikirantaleka — Tue, 16 Aug 2022 08:25:28 GMT

Hi @gcusello,

I am using ESA TA that you mentioned, the normal string is parsed well. However, URL, Chinese, and not English characters are still displayed in base64 format. Now, I am wondering if Cisco Ironport has to have some configuration at their end to decode the characters before sending data into Splunk.

What do you think?

//RK