When will Cisco Security Suite support Cisco IPS devices on Splunk 6.x?

[ragingwire]

When will Cisco IPS device be supported on this app? It is very frustrating that Splunk for Cisco IPS is deprecated. I was able to hack it to work for Splunk v6. But upgrading to Splunk v6.1 it has broke again.

It is nice that you have supported SourceFire and ISE, though IPS has been around far longer and I'm sure has far more installs.

Please look at this please!

[friea]

Great news! Cisco Security Suite has been updated to include IPS support. Check out https://apps.splunk.com/app/525/#/overview.

The Cisco Security Suite now supports Cisco ASA and PIX firewall appliances, the FWSM firewall services module, Cisco IPS, Cisco Web Security Appliance (WSA), Cisco Email Security Appliance (ESA), Cisco Identity Services Engine (ISE), pxGrid, and Cisco Advanced Malware Protection / Sourcefire.

[klaxdal]

Happy Day !

[sorenmaigaard]

Hi.

Can this app be used for your purpose?
https://apps.splunk.com/app/1903/

Best
Soren

[klaxdal]

Unfortunately ...no . I would like the IPS information pulled into the existing Cisco Security Suite as it was previously

[jbrodsky_splunk · Accepted solution]

The app used to be listed as deprecated - it is not listed that way anymore. I have customers that have had success with the app by installing it on a 5.x forwarder dedicated to this purpose (which will report into a Splunk 6 instance just fine). The issue is, as I am sure you are aware, the app relies on a specific version of openSSL, and the version of openSSL in 6 isn't compatible. Not saying that this is a fix, but at least it's something.

[ragingwire]

I totally understand that. It is just sad that such a great app has not been updated to keep up with splunk versions. At some point running a v5 forwarder will not work with splunk indexer etc... It seems the developers do not have this on their road map. I believe they originally did, but it's been pushed aside.

thanks,

[klaxdal]

Please get this working 🙂 I need my IPS info in my Cisco Security Suite