Cisco Security Suite as a Bandwidth Monitor

[donwant]

Is there any way to monitor bandwidth through an ASA using Splunk?

I have it tracking syslog but need more information out of the ASA. If there is a different solution I need please let me know!

[Drainy]

Sure. I believe logging level 6 (Informational) will output connections that are built or broken down. For e.g.

Oct 01 10:10:10 *.*.*.* Oct 01 10:10:10: %ASA-6-10212: Teardown TCP connection 5383932 for outside:*.*.*.*/80 to inside:*.*.*.*/1213 duration 0:00:01 bytes 1226 TCP FINs

As you can see, the above one includes the total number of bytes for that constructed connection and so by performing a field extraction on that you could build up bandwidth usage, you wouldn't necessarily need to use the CSS (Cisco Security Suite) but could easily build something like this yourself.
If you wanted more detail on that then feel free to ask 🙂