All Apps and Add-ons

Update about new version of Splunk Add-on for Cisco FireSIGHT

kondav
New Member

For support of Cisco FireSIGHT 6.x and to support Splunk 7.x.x version.

0 Karma

dbroggy
Path Finder

Confusing title since the FireSight app is for 5.x and lower. The terms 'FirePower' and 'eStreamer' are still valid.

For 6.x and higher I believe these are the correct apps?
https://splunkbase.splunk.com/app/3662/ - eStreamer TA (client/connector) - built by Douglas Hurd
https://splunkbase.splunk.com/app/4388/ - FirePOWER - built by Douglas Hurd. I think this replaces app /3663/? There's no mention of that in splunk base, but it's mentioned in the user guide here:
https://www.cisco.com/c/en/us/td/docs/security/firepower/splunk/Cisco_Firepower_App_for_Splunk_User_...

Here are my references to back up this conclusion:
" It supports version 6.0 of Firepower Management Center."
https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreSpl...

"Allows Splunk to collect all Firepower event data via the eStreamer API from Firepower Management Center version 6.x. Note: Will not work with Firepower version 5.x"
https://splunkbase.splunk.com/app/3662/#/details

To add confusion, the Splunk AddOns doc refer to the old firesight app:
https://docs.splunk.com/Documentation/AddOns/released/Sourcefire/Inputs

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...