All Apps and Add-ons

Cisco eStremer for firepower logs on splunk

sabaKhadivi
Path Finder

As I want to send Cisco Firepower logs as eStreamer to splunk distributed (indexer clustering) environment and I did step by step according to
https://www.network-node.com/blog/2017/7/2/integrating-splunk-and-firepowers-estreamer
but didn't receive any log.
and Im not sure about where do I have to install app and TA , I used heavy forwarder to receive FMC eStreamer , how to send logs to Cluster master,
my machines OS are CentOS 7.
Cisco eStreamer for Splunk and Splunk Add-on for Cisco FireSight are enough to receive logs and where they have to be installed?

Tags (1)
0 Karma

DavidHourani
Super Champion

Hi @sabaKhadivi,

In order to receive the logs on your HF you will need to follow the guide you shared :
https://www.network-node.com/blog/2017/7/2/integrating-splunk-and-firepowers-estreamer
Or this one based on which version you are working on :
https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreSpl...

Then you need to forward the data to your indexers not your Cluster Master. To do so you should use the outputs.conf file to configure forwarding the logs from the HF. If you haven't done that, then the logs are getting indexed locally on your HF, have a look at your HF and see if you can spot the logs from the search bar.

Cheers,
David

0 Karma

rajindurbal
Path Finder

Good Evening @sabaKhadivi

I think the easiest way to set up estreamer is to use the following add-on and app:

Also, following the guide in the following document:
https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreSpl...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...