Cisco IPS for Splunk cut events

[glmartin]

Hello

I'm getting started with Splunk but my environment was set by another person.

I keep reading strange events from cisco IPS, when I select "show source" something like this appears:

1358522528604486000 eventid="1337599901669938718"  trigger_packet="AABeAAEB+GbyxMzPCABFAABPfDlAAIAG

rNXABgFaCrUFhQG9CIKTXK915Wedu1AY/RjWLgAAAAAAI/9TTUJzbQAAwJgH

yAAAQlNSU1BZTCAAAAAA//4A6IAAAAAA" trigger_packet_details="=00=00^=00=01=01=F8f=F2=C4=CC=CF=08=00E=00=00O|9@=00=80=06=AC=D5=C0=06=01Z

=B5=05=85=01=BD=08=82=93\=AFu=E5g=9D=BBP=18=FD=18=D6.=00=00=00=00=00#=FFSMB=

sm=00=00=C0=98=07=C8=00=00BSRSPYL =00=00=00=00=FF=FE=00=E8=80=00=00=00=00"

Those lines account for 5 events in the search app. I can't make any sense of that. Is it an expected log? In that case what does it means?

Thanks

[glmartin · Accepted solution]

Hi again!

The best solution I found was updating the application to the latest version. From the changelog:

• Changed packet data to remove new-line characters so it will all fit on one line instead of being spread out over many lines. And included the packet data into one big event instead of a separate one.

Now it works like a charm (even tough I had to uninstall the app completely and install the new version) and I get more features like a decent timestamp.

Thanks to everyone.

[dshpritz]

hHey glmartin,

Most likely what you are seeing is packet captures which are present in the events being pulled via SDEE. There isn't an option in the Splunk app to ignore packet data, but if you look for a line like this:

syslog_msg = syslog_msg + packet_info

change it to:

# syslog_msg = syslog_msg + packet_info

To comment it out. Realize, however, that if you comment it out, if you upgrade the version of the App, you will need to comment it out again.

Hope that helps,

Dave

[glmartin]

Hello Dave

Thanks a lot for our answer I'll try that as soon as possible.

However I'd like to keep the packet info, but tightly coupled to an event, maybe having one or more fields containing the same information. It would greatly improve the analysis of the data.

Thanks again!