Sourcefire and Splunk

[MrWh1t3]

Is there a way to pull events into Splunk without Defense Center? We use one device in our organization and Defense Center seems a bit overkill for us. We use the web interface for configuration of our Sourcefire 3DS2000 Sensor. I enabled estreamer on the device, installed the Sourcefire for Splunk 2.0 app, set up a listener port on 8320, but I'm not seeing anything. It mentioned something about putting the SFPkcs12.pm cert in the correct directory. I put it in C:\Program Files\Splunk\etc\apps\Sourcefire\bin

Thanks for your help.

[douglashurd]

you can collect intrusion events from the device directly as there is eStreamer server code on the device. You'll only get IDS events however. No impact flag.

You can get IDS and Connection events off the device in syslog too. TAC can help you set this up.

On the port, you need to use 8302, not 8320.

Doug

[douglashurd]

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

[bworrellZP]

Documentation has some errors and needs a few points of clarification.

Example. There is reference to changing the Port for the app, but nothing about how to change the port on Firepower to account for the change.

[layzie88 · Accepted solution]

isn't estreamer port 8302?