I am running Splunk version 4.2, build 96430 on a Windows server. I have just installed Cisco Security Suite 1.0.1, Cisco Ironport Web Security Appliance 1.0.0 and MAXMIND 1.0.6. I need to find some documentation regarding configuration for these apps. I have tried the following URL but it ends up with a 404 error.
I configured log subscriptions on the WSA and ESA to FTP logs to separate directories on the splunk indexer.
Then I created a file data input for each, setting the sourcetype manually to cisco_esa for email and cisco_wsa_squid for the web filter.