topic Re: How to view Security intelligence events from Sourcefire in Splunk? in Getting Data In

How to view Security intelligence events from Sourcefire in Splunk?

Shivangi_Saraf — Mon, 27 Jun 2016 06:20:37 GMT

I am logging events from my Defence centre to Splunk, however, while I do receive the Intrusion events, I am not receiving the Security intelligence events. Whats the script to enable the same on Splunk?

Re: How to view Security intelligence events from Sourcefire in Splunk?

satishsdange — Tue, 28 Jun 2016 08:42:53 GMT

You can use Add-on to get data into Splunk. You can also use Cisco Security Suite App for visualization.

Splunk Add-on for Cisco FireSIGHT (formerly Splunk Add-on for Cisco Sourcefire) - https://splunkbase.splunk.com/app/1808/

Cisco Security Suite - https://splunkbase.splunk.com/app/525/

Re: How to view Security intelligence events from Sourcefire in Splunk?

Shivangi_Saraf — Tue, 28 Jun 2016 13:47:55 GMT

https://splunkbase.splunk.com/app/1629/
The above app says that security intelligence is optional but available in splunk
I already have the app and am currently getting both amp and intrusion events however I'm missing the security intelligence events