What to do about NGFW logs via syslog

[mwoods2]

I've looked at a few apps for Cisco Firepower and it's still not clear to me what I need.

We have the NGFW which are managed via FTD. We get eStreamer events which are parsed via eNcore. That all seems to be working well. But for the actual firewall events (permits/denies/etc), those are being sent via syslog to a syslog forwarder. The events are being ingested, but are not being parsed correctly for searching so rather than the fields we need, the event is basically one big raw blob.

Anyone know what we'd need for the extracts for this? I've looked at this app and it seems to match, but it's not really clear to me.

So any help is appreciated.

Thanks!

[rajindurbal]

Good Evening @mwoods2 ,

Can you tell us which firepower version you are using? You may need a different version of the add-on depending on the version you are running.

https://splunkbase.splunk.com/app/3662/