Cisco eStremer for firepower logs on splunk

[sabaKhadivi]

As I want to send Cisco Firepower logs as eStreamer to splunk distributed (indexer clustering) environment and I did step by step according to
https://www.network-node.com/blog/2017/7/2/integrating-splunk-and-firepowers-estreamer
but didn't receive any log.
and Im not sure about where do I have to install app and TA , I used heavy forwarder to receive FMC eStreamer , how to send logs to Cluster master,
my machines OS are CentOS 7.
Cisco eStreamer for Splunk and Splunk Add-on for Cisco FireSight are enough to receive logs and where they have to be installed?

[DavidHourani]

Hi @sabaKhadivi,

In order to receive the logs on your HF you will need to follow the guide you shared :
https://www.network-node.com/blog/2017/7/2/integrating-splunk-and-firepowers-estreamer
Or this one based on which version you are working on :
https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreSpl...

Then you need to forward the data to your indexers not your Cluster Master. To do so you should use the outputs.conf file to configure forwarding the logs from the HF. If you haven't done that, then the logs are getting indexed locally on your HF, have a look at your HF and see if you can spot the logs from the search bar.

Cheers,
David

[rajindurbal]

Good Evening @sabaKhadivi

I think the easiest way to set up estreamer is to use the following add-on and app:

• https://splunkbase.splunk.com/app/3662/ <-Cisco eStreamer eNcore Add-on for Splunk
• https://splunkbase.splunk.com/app/3663/ <-Cisco Firepower eNcore App for Splunk

Also, following the guide in the following document:
https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreSpl...