Can you input Cisco ASA Firepower IPS alerts into Splunk?

[Keef2112]

Hi, can you input Cisco ASA Firepower IPS alerts and events into Splunk? Then present these events as a dashboard?

[Dijanad]

As far as the estreamer app...the instructions say data import doesn't work in windows, is that correct?

Is there a way to do it by connecting the IPS eStreamer to splunk and get the events that way, without using apps?

[Richfez]

Yes you can!

Take a look at the two apps for Cisco eNcore (I hate that capitalization). The eStreamer one is what you use to collect the data from the FMC, and the other one should give you pretty dashboards of that data.

Follow the instructions carefully for the eStreamer app to start collecting that data, but if you have any problems ask us about them!

Happy Splunking,
Rich