All Apps and Add-ons

Splunk Cisco Firewalls vs. Add-on for Cisco ASA

Explorer

We are currently running Splunk 5.0.5 together with Splunk Enterprise Security 2.4.1. The Cisco Firewalls (TA-cisco v2.0) app is currently installed. Being that the Add-on for Cisco ASA (3.0) maps firewall data to the CIM, I am considering installing that in place of the TA-cisco 2.0 app.

I am curious if there might be any drawbacks in doing this? Is the upgrade just a question of removing the first app. and then installing the second?

Thank you.

0 Karma

Communicator

Taken from the overview of the ASA app:

"This Add-on is not designed to work with the Splunk Cisco Security Suite or the Splunk App for Cisco Firewalls. It uses a different sourcetype and will not conflict."

I'm not sure what sourcetype it sets, but i do know the Cisco Security Suite and ES use sourcetype's such as cisco_asa, cisco_pix, cisco_csa, etc etc.

So, i'd guess it wont work out of the box (as the sourcetype's wont match), but nothing a little tinkering in a development environment wont fix 🙂

Either telling ES cisco firewall logs are a different sourcetype, or renaming the sourcetype in the v3.0.0 app to to what ES expects. Or another thought, aliasing the sourcetype?

But as above, you may want to try this in a test environment as this may have undesirable effects until you get it working right.

Regards.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!