All Apps and Add-ons

What to do about NGFW logs via syslog

New Member

I've looked at a few apps for Cisco Firepower and it's still not clear to me what I need.

We have the NGFW which are managed via FTD. We get eStreamer events which are parsed via eNcore. That all seems to be working well. But for the actual firewall events (permits/denies/etc), those are being sent via syslog to a syslog forwarder. The events are being ingested, but are not being parsed correctly for searching so rather than the fields we need, the event is basically one big raw blob.

Anyone know what we'd need for the extracts for this? I've looked at this app and it seems to match, but it's not really clear to me.

So any help is appreciated.

Thanks!

0 Karma

Path Finder

Good Evening @mwoods2 ,

Can you tell us which firepower version you are using? You may need a different version of the add-on depending on the version you are running.

https://splunkbase.splunk.com/app/3662/

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!