Which method to do Cisco Firesight data collection: estreamer vs syslog?

[koshyk]

eStreamer has got lot of disadvantages (eg extra perl modules, pull technology etc..). So was planning to use "syslog" from Cisco Firesight/Defence Centre. Does anyone know if there are issues with Firesight syslog? Is any data missing if we use syslog?
I can see Splunk supported addon works with both estreamer output and syslog. So preferred way for us is to go with syslog.

Would be very helpful to know if any of you have implemented using Firesight syslog.

[douglashurd]

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

[hyunpyun]

Hello Koshyk,

So how did you set up your FMC data collection, via eStreamer or syslog?
I am in a situation where you were about 2 years ago. Any input will be appreciated.

Thank you in advance.

[mosman_splunk]

if you are using splunk ES then eStreamer will populate more dashboard for you as bellow :
1- Intrusion Detection
2- Network Traffic
3- Malware
while syslog give you only Malware
I'd highly recommend using eStreamer even if you are not using ES now .
good luck

[kheli]

With syslog, you are also able to send intrusion events by configuring intrusion policy advanced settings on FireSIGHT.

[hopnscotch6]

But is this just a consequence of the parsing/tagging that is provided with the current Firesight app? Or is there an actual difference in the data that is sent via syslog as opposed to pulled by estreamer?