How do I install the Cisco IronPort E-mail add-on?

Splunk Employee
Splunk Employee

How do I install and configure the Cisco Ironport E-mail add-on:

Tags (3)

Path Finder

I can search the logs with search command "eventtype=cisco_esa", but nothing appear with command: "eventtype=cisco_esa mailfrom=* | eval accountname=split(mailfrom,"@") | eval from_user=mvindex(accountname,0) | eval from_domain=mvindex(accountname,-1) | table mailfrom, from_user, from_domain", why?

0 Karma

New Member

I am unable to bring the app up. I am getting a 500 internal server error. All I did was rename the app/directory.

I do notice there is no nav directory with a listed default.xml. Is anyone else having issues trying to get to the app?

0 Karma

Splunk Employee
Splunk Employee

To install this add-on, unpack this file into $SPLUNK_HOME/etc/apps and restart.

The field extractions are set to sourcetype=cisco_esa by default and the reports use eventtype=cisco_esa together the data.

If you already have the IronPort Mail logs indexed under a different sourcetype you will need to update the props.conf and eventtypes.conf files in the local directory of this app.

In props.conf create the following entry, replacing the stanza name with your the sourcetype for your IronPort Mail logs:

REPORT-ironport = get_mid, get_to, get_from, get_icid, get_dcid, get_attach_name, get_attach_size, get_subject1, get_subject2, get_subject3

In eventtypes.conf create the following entry, replacing the search terms with the sourcetype for your IronPort Mail logs:

search = sourcetype=your_usa_sourcetype
tags = cisco e-mail security

The sample reports in this add-on rely on the search: eventtype=cisco_esa in order to report on IronPort mail data. There is one scheduled search included in this add-on which creates an cache for the dashboard every 6 hours with a Splunk enterprise license. To change the schedule you can edit the following search under the manager:

Cisco IronPort E-mail - DataCube

The included form search creates a simple interface for mining transactions in the IronPort mail logs.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...