All Apps and Add-ons

Cisco eStreamer for Splunk: What configurations should I make so that I see only IDS/IPS event logs?

Builder

What configurations are to be made on the Defense Center and on Cisco eStreamer for Splunk in order to get the IDS/IPS events only? Right now we are getting a huge amount of RNA logs in Splunk. We have enabled Log flows, Log packets in the application, and on the Defense Center everything is enabled. What changes do I have to make to avoid huge amount of logs?
alt text

0 Karma
1 Solution

Builder

I cannot see the important parts of the estreamer configuration page due to how the screen grab is cropped. By checking the event types you make them available to a requesting client like the Cisco eStreamer App for Splunk.

Uncheck them and the events will not be forwarded.

On the actual eStreamer configuration options page on the Splunk console there is a box you can enable or disable to eliminate flow logs as well.

In the Overview Tab on this page: https://splunkbase.splunk.com/app/1629/ you can see the option.

View solution in original post

Builder

I cannot see the important parts of the estreamer configuration page due to how the screen grab is cropped. By checking the event types you make them available to a requesting client like the Cisco eStreamer App for Splunk.

Uncheck them and the events will not be forwarded.

On the actual eStreamer configuration options page on the Splunk console there is a box you can enable or disable to eliminate flow logs as well.

In the Overview Tab on this page: https://splunkbase.splunk.com/app/1629/ you can see the option.

View solution in original post

Builder

HI Douglashurd,

What boxes i have to check on Splunk app if i have to see only IDS/IPS events but not RNS events?

0 Karma

Builder

Just the Intrusion Events. I'd recommend you also check Impact Flag, Intrusion Extra data and Intrusion Event Packet Data if you want the packet payload. Leave everything else unchecked.

0 Karma

Builder

Thanks douglashurd, Do i have to check log flows on the splunk estreamer?

0 Karma

Builder

The flow on/off switch in the Splunk configuration page will only allow flow data to be sent to the Splunk platform if Connection Events (we used to call them RNA flow events) are enabled at the Firepower Management Center eStreamer configuration page other wise they won't be available to splunk.

0 Karma

Ultra Champion
0 Karma