All Apps and Add-ons

Can we configure multiple Defense Center's in estreamer app?

adityapavan18
Contributor

The estreamer app provides UI to configure a single Defence Center IP/hostame. Is it possible to configure more than one Defence Centers?

0 Karma
1 Solution

douglashurd
Builder

Hi, thanks for the question. Currently, you need an instance of Cisco eStreamer for Splunk app for each Firepower Management Center (f.k.a. Defense Center).

View solution in original post

douglashurd
Builder

You can with this new version and Firepower 6.x. See below:

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

0 Karma

ebaileytu
Communicator

Doug are you saying we can now configure more than one FMC in the TA? We have 13 FMCs and I dont want to have to manage 13 HFs to support this use case. Would much prefer to load it all into one or two TAs. We have tried to use the Encore command line client, but it is not super stable and disconnects a lot. What you have configured in the TA is much more stable. 

Thanks!

0 Karma

douglashurd
Builder

Hi, thanks for the question. Currently, you need an instance of Cisco eStreamer for Splunk app for each Firepower Management Center (f.k.a. Defense Center).

adityapavan18
Contributor

Ok. Thanks

0 Karma

ChangSeun
Engager

Hi @douglashurd, i'm having the same issue here.

How do you create multiple instances of eStreamer for Splunk with each its own configuration on the same Splunk server ?

Regards,

0 Karma

adityapavan18
Contributor

@douglashurd can you help me with this

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...