Splunk Enterprise not recognizing Splunk Add-on for Cisco ESA

[splunkcw17]

Hi All,

I'm trying to install the Cisco ESA Add-on App https://splunkbase.splunk.com/app/1761/

However when setting this up in Cisco Security Suite, it doesn't recognize the app after I've uploaded it - please see screenshots.

It does however recognize it when configuring a data input, please could you advise?

Thanks!

[diogofgm]

the cisco:esa:legacy means you had an older version of the add-on installed before the source types were renamed to follow best practices, your events indexed with the older source types cisco_esa and cisco:esa are now searchable under this new source type.

About data not being visible the email dashboards, there rely on event type = cisco-esa. check your data and see if the event type is present. if you have the latest version of the add-on, they should be.

the eventtype uses this search
(sourcetype="cisco:esa:textmail" OR sourcetype=cisco:esa:legacy) AND (MID OR ICID OR DCID)

Try it and see if you get any results.

[khalidrucker]

Hello, can you please advise on how you bypassed the original error, "No data found. Please install this add-on"?

[splunkcw17]

I've got the ESA add-on app loaded and visible in Cisco Security Suite, however ESA logs appear in the main security suite dashboard (with cisco:esa:legacy sourcetype) but not in the 'email security' tab - any ideas on this please?

Thanks!