All Apps and Add-ons

Why is the Splunk eNcore app not displaying msg field for all events?

Loves-to-Learn Lots

I put in a Splunk ticket for this problem, but they told me the Splunk eNcore app wasn't a supported app and that I need to contact Douglas Hurd. Here are the details from the ticket.

We are running Splunk 7.1.3 and using TA-eStreamer version 3.0 to pull events from Cisco FirePower Manager into Splunk. The app is working and we are getting events, but some alerts are coming in without the "msg" field. If the alerts are coming into Splunk without names, it hinders our analyst's ability to do their job. We have spoken to Cisco about this problem and they have identified a bug. They told us how to fix it, but they weren't technical and I'm not sure how to make the change in Splunk. They told me to open a trouble ticket with Splunk. Listed below is the information from the bug :

eStreamer rec_type:400 shows different SID value from seen in FMC
When eStreamer is configured on FMC and eStreamer client tries to get rec_type:400(IPS EVENT) triggered by local rule, it only shows local SID that is assigned locally and this value is different from what we can see from FMC.
This makes it difficult for the customer to search intrusion event by SID from eStreamer client.

This only occurs on local rule only and doesn't occur on Cisco defined rule update.
Especially when customer tries to import rule list from local file and SIDs are specified for each rule, symptom occurs.

None, Use local sid for search criteria that can be obtained from rec_type:66(RULE)

Further Problem Description:
Regarding attribute name of eStreamer, rec_type:66(RULE) shows rule_id(local_sid) and signature_id(SID seen from FMC). But rec_type:400(IPS EVENT) only shows signature_id(local_sid)
Please make sure same attribute name(signature_id) has different meaning.

I have no idea how to make this change within the eStreamer app. Can someone point me in the right direction?

Thank you.

0 Karma
Get Updates on the Splunk Community!

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...

Observability Cloud | AWS PrivateLink Enabled for Splunk Observability Cloud

We’ve enabled AWS PrivateLink for Observability Cloud, giving you an additional inbound connection to send ...

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...