All Apps and Add-ons

How to view Access Lists being utilized on Cisco ASA



I have a new Splunk windows instance running. We have configured our Cisco ASA to send syslog data using UDP 514 and created a data input on Splunk listening on UDP 514.

The event type has been set to "cisco:asa"
Index is the default index.

Now we see data being collected on the index, so no problems there.

We installed the Add-on for Cisco ASA app with the hope it will help us see a graphical representation of the Access Control Policies being utilized by the ASA. Does anyone know if this can be achieved with this app? or do we need something else.

Thank you.

0 Karma

Path Finder

If you make sure every access list has the log keyword, you can then analyze the 106100 log events generated and do charts based on the hexid in the log event. Those hexids are unique to the rule.

0 Karma

New Member

You will not see the ACL's but you will see the connections made or denied based on the ACL's. You must have logging down to the informational level as well.

Hope this answers your question.


0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...