topic Re: Sourcefire and Splunk in Getting Data In

Sourcefire and Splunk

MrWh1t3 — Wed, 20 Jun 2012 00:23:13 GMT

Is there a way to pull events into Splunk without Defense Center? We use one device in our organization and Defense Center seems a bit overkill for us. We use the web interface for configuration of our Sourcefire 3DS2000 Sensor. I enabled estreamer on the device, installed the Sourcefire for Splunk 2.0 app, set up a listener port on 8320, but I'm not seeing anything. It mentioned something about putting the SFPkcs12.pm cert in the correct directory. I put it in C:\Program Files\Splunk\etc\apps\Sourcefire\bin

Thanks for your help.

Re: Sourcefire and Splunk

layzie88 — Thu, 21 Jun 2012 13:42:03 GMT

isn't estreamer port 8302?

Re: Sourcefire and Splunk

douglashurd — Wed, 02 Aug 2017 23:18:20 GMT

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

Re: Sourcefire and Splunk

bworrellZP — Wed, 17 Jan 2018 13:28:53 GMT

Documentation has some errors and needs a few points of clarification.

Example. There is reference to changing the Port for the app, but nothing about how to change the port on Firepower to account for the change.

Re: Sourcefire and Splunk

douglashurd — Wed, 17 Jan 2018 16:11:36 GMT

you can collect intrusion events from the device directly as there is eStreamer server code on the device. You'll only get IDS events however. No impact flag.

You can get IDS and Connection events off the device in syslog too. TAC can help you set this up.

On the port, you need to use 8302, not 8320.

Doug