Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Re: When will Cisco Security Suite support Cisco I...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When will Cisco IPS device be supported on this app? It is very frustrating that Splunk for Cisco IPS is deprecated. I was able to hack it to work for Splunk v6. But upgrading to Splunk v6.1 it has broke again.
It is nice that you have supported SourceFire and ISE, though IPS has been around far longer and I'm sure has far more installs.
Please look at this please!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The app used to be listed as deprecated - it is not listed that way anymore. I have customers that have had success with the app by installing it on a 5.x forwarder dedicated to this purpose (which will report into a Splunk 6 instance just fine). The issue is, as I am sure you are aware, the app relies on a specific version of openSSL, and the version of openSSL in 6 isn't compatible. Not saying that this is a fix, but at least it's something.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great news! Cisco Security Suite has been updated to include IPS support. Check out https://apps.splunk.com/app/525/#/overview.
The Cisco Security Suite now supports Cisco ASA and PIX firewall appliances, the FWSM firewall services module, Cisco IPS, Cisco Web Security Appliance (WSA), Cisco Email Security Appliance (ESA), Cisco Identity Services Engine (ISE), pxGrid, and Cisco Advanced Malware Protection / Sourcefire.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Happy Day !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unfortunately ...no . I would like the IPS information pulled into the existing Cisco Security Suite as it was previously
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The app used to be listed as deprecated - it is not listed that way anymore. I have customers that have had success with the app by installing it on a 5.x forwarder dedicated to this purpose (which will report into a Splunk 6 instance just fine). The issue is, as I am sure you are aware, the app relies on a specific version of openSSL, and the version of openSSL in 6 isn't compatible. Not saying that this is a fix, but at least it's something.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I totally understand that. It is just sad that such a great app has not been updated to keep up with splunk versions. At some point running a v5 forwarder will not work with splunk indexer etc... It seems the developers do not have this on their road map. I believe they originally did, but it's been pushed aside.
thanks,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please get this working 🙂 I need my IPS info in my Cisco Security Suite
Splunk Observability as Code: From Zero to Dashboard
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Shape the Future of Splunk: Join the Product Research Lab!
