Why is our Cisco 4507 switch also appearing in the Cisco Security Suite app rather than the Cisco Networks app?

[jejaifeii]

Hello all,

In our test environment, I've set up Splunk running the Cisco Security Suite App with ASA add-on, as well as the Cisco Networks App with Cisco Networks add on.

We're showing great traffic on our ASA in Cisco Security Suite App, however our Cisco 4507 switch is also appearing in the Cisco Security Suite, rather than the Cisco Networks App.

Has anyone else had this issue?

Globally, I've set inputs to listen on UDP 514 in Spunk. Is there some other configuration setting I need to perform to keep our ASA traffic separate from our IOS devices?

John

[mikaelbje]

Hi!

The switch events should show up with sourcetype cisco:ios and the ASA events as cisco:asa .

Cisco Security Suite is written in such a fashion that it looks for all events with sourcetype=cisco:* which is why you're seeing the events for the switch in that app.

A lot of the users I've spoken to think this is nifty as they also get i.e. access list events from IOS devices in the Security Suite app. If you want to override this you should change the base search in eventtypes.conf or macros.conf (I can't remember which one) in the Security Suite app in the local/ dir to exclude sourcetype=cisco:ios

Regards,
Mikael, the author of the Cisco Networks app (not the Cisco Security Suite 🙂