How would I go about getting Cisco FTD into Splunk Cloud?

[krunaldave]

Hi,

How would I go about getting cisco FTD logs into Splunk Cloud? Would I need to install a forwarder on the same network I have the FTD installed and then send those to the Splunk Cloud from the forwarder? If so, can it be a Windows Forwarder?

[richgalloway]

Perhaps the easiest way is to install a heavy forwarder (HF) on one of your on-prem servers and use the HF to collect FTD data and forward it to Splunk Cloud.

You also may be able to ingest the data directly into Splunk Cloud, but first you'll need and app that fetches the data from FTD.  The app will need inputs.conf in addition to any props or transforms needed for the data.

If your Splunk Cloud stack uses the Victoria experience, then upload the app to the stack.  Enable the input on one search head and Splunk Cloud should do the rest.

If your Splunk Cloud stack uses the Classic experience then the app will need to be installed on your IDM, which Splunk Cloud Support can do for you.

[krunaldave]

@richgalloway thank you for your response. can the heavy forwarder be installed on a windows host or is the heavy forwarder a linux instance? If you have any links to documentation, I will really appreciate it.

[inventsekar]

can the heavy forwarder be installed on a windows host or is the heavy forwarder a linux instance? If you have any links to documentation, I will really appreciate it.

Yep, heavy forwarder can be installed on a windows host.

(HF is nothing but a full Splunk enterprise installation plus "forwarding" enabled.. thus the Splunk enterprise system will work as a "forwarder"... since its "heavier" when compared to the UF, thus the name "heavy forwarder")

Splunk enterprise installation guide for windows:

https://docs.splunk.com/Documentation/Splunk/9.0.4/Installation/ChoosetheuserSplunkshouldrunas

to setup forwarding(heavy forwarder):

https://docs.splunk.com/Documentation/Splunk/9.0.4/Forwarding/Deployaheavyforwarder

[krunaldave]

Hi, 

Just to summarize:

To get Cisco FTD logs into splunk cloud, install a heavy forwarder (could be a windows machine) and have the FTD send logs to it. Then have the heavy forwarder send the logs to splunk cloud. Last question would be how to get the logs into splunk cloud from the heavy forwarder since i only have  a url to log into splunk cloud and not an ip address. do we install credentials package on the HF similar as to what we would do with a UF?

Thanks, really appreciate the support.

[richgalloway]

Yes, install the credentials package just as you do for a UF.  Despite the name, the "Universal Forwarder" app applies to all forwarders.

[inventsekar]

maybe, show your appreciation by giving us some karma points, thanks. 

[richgalloway]

The forwarder can be on any supported platform.

I have links to lots of documentation.  What specifically are you looking for?