What add-on for Cisco Firepower syslog (excluding estreamer)?

ojay — Thu, 24 Mar 2022 10:36:52 GMT

Hi all,

I am ingesting Cisco FTD logs and currently using the Cisco ASA add-on which works fine for a lot of event messages.

Unfortunately it is not working perfect as there is one event message that is not getting recognized by the add-on.

What Splunk supported method is the best for a standardized onboarding with full CIM knowledge?

I do not want to use the estreamer as it is mostly creating issues and is not Splunk supported.

Currently used: "Splunk_TA_cisco-asa-4.2.0"

Best

topic What add-on for Cisco Firepower syslog (excluding estreamer)? in Getting Data In