Splunk Cisco Firewalls vs. Add-on for Cisco ASA

[adamblock1]

We are currently running Splunk 5.0.5 together with Splunk Enterprise Security 2.4.1. The Cisco Firewalls (TA-cisco v2.0) app is currently installed. Being that the Add-on for Cisco ASA (3.0) maps firewall data to the CIM, I am considering installing that in place of the TA-cisco 2.0 app.

I am curious if there might be any drawbacks in doing this? Is the upgrade just a question of removing the first app. and then installing the second?

Thank you.

[Splunker]

Taken from the overview of the ASA app:

"This Add-on is not designed to work with the Splunk Cisco Security Suite or the Splunk App for Cisco Firewalls. It uses a different sourcetype and will not conflict."

I'm not sure what sourcetype it sets, but i do know the Cisco Security Suite and ES use sourcetype's such as cisco_asa, cisco_pix, cisco_csa, etc etc.

So, i'd guess it wont work out of the box (as the sourcetype's wont match), but nothing a little tinkering in a development environment wont fix 🙂

Either telling ES cisco firewall logs are a different sourcetype, or renaming the sourcetype in the v3.0.0 app to to what ES expects. Or another thought, aliasing the sourcetype?

But as above, you may want to try this in a test environment as this may have undesirable effects until you get it working right.

Regards.