Secure Firewall Dashboard

[MikeMakai]

I am sending syslog data to Splunk from Cisco FMC. I am using UCAPL compliance and therefore cannot use eStreamer. The data is being ingested into Splunk and the dashboard is showing some basic events, like connection events, volume file events and malware events. When I try to learn more about these events it doesn't drill down into more info. For example, when I click on the 14 Malware Events and chose open in search it just shows the number of events. There is no information regarding these events. When I click on inspect, it shows command.tstats at13 and  command.tstats.execute_output at 1. It doesn't provide further clarity regarding the malware events. When I view the Malware files dashboard on the FMC, is shows no data for malware threats. So based on the FMC it seems that the data in the Splunk dashboard is incorrect or at least interpreting malware events differently from the FMC dashboard. 

[kiran_panchavat]

@MikeMakai  Hi Mike,I recently integrated an FTD appliance with Splunk. Previously, the customer was using a Cisco ASA, and last week they upgraded to FTD. We didn’t make any changes to the Splunk setup and are still using the Cisco ASA add-on. Interestingly, the logs are being parsed correctly. Have you tried using the Cisco ASA add-on? Additionally, when you run a TCP dump on the destination side (Splunk), how are the logs appearing from the FTD device? Are they coming through as expected? It seems the cisco:ftd:syslog sourcetype isn’t parsing them properly. I’ve attached a screenshot for your reference.

I hope this helps. if any reply helps you, you could add your upvote/karma points to that reply.

[kiran_panchavat]

@MikeMakai

Please run `tcpdump` to verify if the expected logs are being received. If the expected output is observed, we can proceed to check from the Splunk side.

If this reply helps you, Karma would be appreciated.

[MikeMakai]

I'm running Splunk on Windows and don't have the tcpdump command.

[kiran_panchavat]

@MikeMakai I think you can use WinDump/Wireshark. You can take help from your network team. 

https://wiki.wireshark.org/WinDump 

[kiran_panchavat]

@MikeMakai

Could you share your `inputs.conf` file? Are you sending data directly from the FMC to Splunk, or is there an intermediate forwarder between your FMC and Splunk?

[MikeMakai]

Hi Kiran,

I'm sending syslog directly from the FTD devices.

Here is the config file.

[tcp://192.168.1.2:1470]
connection_host = dns
index = cisco_sfw_ftd_syslog
sourcetype = cisco:ftd:syslog

[sbg_sfw_syslog_input://FTD_Pier]
event_types = *,syslog_intrusion,syslog_connection,syslog_file,syslog_file_malware
index = cisco_sfw_ftd_syslog
interval = 600
port = 1470
restrictToHost = 192.168.1.2
sourcetype = cisco:ftd:syslog
type = tcp

[tcp://192.168.200.2:1470]
connection_host = dns
index = cisco_sfw_ftd_syslog
sourcetype = cisco:ftd:syslog

[sbg_sfw_syslog_input://FTD_Kona]
event_types = *,syslog_intrusion,syslog_connection,syslog_file,syslog_file_malware
index = cisco_sfw_ftd_syslog
interval = 600
port = 1470
restrictToHost = 192.168.200.2
sourcetype = cisco:ftd:syslog
type = tcp

Thanks,

Mike