Cisco IPS Issue

[jammy3]

Hello,

I've installed the Cisco Security Suite 2.0, Cisco IPS 2.0.0 and Cisco MARS 1.0.0 apps.

MARS works fine.

The IPS app however won't pull any data.

running the search: index="_internal" sourcetype="sdee_connection" generates the following info:
INFO - Checking for exsisting SubscriptionID on host: #.#.#.#
INFO - No exsisting SubscriptionID for host: #.#.#.#
INFO - Attempting to connect to sensor: #.#.#.#
INFO - Successfully connected to: #.#.#.#
ERROR - Connecting to sensor - #.#.#.#: URLError:

Cisco says that splunk needs to connect to https://Ip-address-of-IPS/cgi-bin/sdee-server/ but I don't see anywhere to specify the path to the xml file at that address.

I do have '.run' files.

Anything I'm missing?
Thanks.

[andrew_garvin]

You only have to specify the IP address of the IPS appliance in the config, the app will poll the device on the appropriate URLs.

From the Splunk server, can you open a browser and access https://IPS_IP_Address/cgi-bin/sdee-server? If not, check for network/firewall blocks and make sure the Splunk server is opened up on the IPS appliance. Verify the username and password are correct and that it has at least Viewer rights. Verify everything looks correct in inputs.conf in the IPS app directory. Do the .run files have a subscription ID in them? What version of software is on the IPS appliance?

[jammy3]

does this app work with splunk 5.0.2? could that be the problem?

[jammy3]

Thanks for the reply. Please see answers to your questions:

From the Splunk server, can you open a browser and access https://IPS_IP_Address/cgi-bin/sdee-server? Yes.

make sure the Splunk server is opened up on the IPS appliance. Sorry, don't understand this.

Verify the username and password are correct and that it has at least Viewer rights. Done

Verify everything looks correct in inputs.conf in the IPS app directory. Compared with sample file and all looks good.

Do the .run files have a subscription ID in them? No. They're empty.

version of software? 7.1(6)E4