All Apps and Add-ons

When will Cisco Security Suite support Cisco IPS devices on Splunk 6.x?

ragingwire
Path Finder

When will Cisco IPS device be supported on this app? It is very frustrating that Splunk for Cisco IPS is deprecated. I was able to hack it to work for Splunk v6. But upgrading to Splunk v6.1 it has broke again.

It is nice that you have supported SourceFire and ISE, though IPS has been around far longer and I'm sure has far more installs.

Please look at this please!

1 Solution

jbrodsky_splunk
Splunk Employee
Splunk Employee

The app used to be listed as deprecated - it is not listed that way anymore. I have customers that have had success with the app by installing it on a 5.x forwarder dedicated to this purpose (which will report into a Splunk 6 instance just fine). The issue is, as I am sure you are aware, the app relies on a specific version of openSSL, and the version of openSSL in 6 isn't compatible. Not saying that this is a fix, but at least it's something.

View solution in original post

friea
Splunk Employee
Splunk Employee

Great news! Cisco Security Suite has been updated to include IPS support. Check out https://apps.splunk.com/app/525/#/overview.

The Cisco Security Suite now supports Cisco ASA and PIX firewall appliances, the FWSM firewall services module, Cisco IPS, Cisco Web Security Appliance (WSA), Cisco Email Security Appliance (ESA), Cisco Identity Services Engine (ISE), pxGrid, and Cisco Advanced Malware Protection / Sourcefire.

klaxdal
Contributor

Happy Day !

sorenmaigaard
Path Finder

Hi.

Can this app be used for your purpose?
https://apps.splunk.com/app/1903/

Best
Soren

0 Karma

klaxdal
Contributor

Unfortunately ...no . I would like the IPS information pulled into the existing Cisco Security Suite as it was previously

0 Karma

jbrodsky_splunk
Splunk Employee
Splunk Employee

The app used to be listed as deprecated - it is not listed that way anymore. I have customers that have had success with the app by installing it on a 5.x forwarder dedicated to this purpose (which will report into a Splunk 6 instance just fine). The issue is, as I am sure you are aware, the app relies on a specific version of openSSL, and the version of openSSL in 6 isn't compatible. Not saying that this is a fix, but at least it's something.

ragingwire
Path Finder

I totally understand that. It is just sad that such a great app has not been updated to keep up with splunk versions. At some point running a v5 forwarder will not work with splunk indexer etc... It seems the developers do not have this on their road map. I believe they originally did, but it's been pushed aside.

thanks,

0 Karma

klaxdal
Contributor

Please get this working 🙂 I need my IPS info in my Cisco Security Suite

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...