Does the Cisco eStreamer for Splunk app support retrieving payload for intrusion events?

[ctan123]

Does the Cisco eStreamer for Splunk app support retrieving payload for intrusion events?

[douglashurd · Accepted solution]

Yes. This is a configurable option in the Splunk eStreamer app because packet data will consume significant disk space if you choose to collect all packets with all IPS/IDS events. Docs on the app here: https://splunkbase.splunk.com/app/1629/#/documentation