Cisco FMC/FTD log parsing issue

[AShwin1119]

We are collecting logs from the Cisco FMC/FTD endpoint into Splunk via syslog. However, after onboarding, the logs are not being parsed correctly. Request your assistance in identifying the appropriate log parsing app or suggesting a suitable solution to resolve this issue.

[livehybrid]

Hi @AShwin1119 

What mechanism are you using for your syslog ingestion? Are you using Splunk tcp/udp input, Splunk Connect for Syslog (SC4S) or something else (eg rsyslog/syslogng)?

The docs (https://www.cisco.com/c/en/us/td/docs/security/cisco-secure-cloud-app/user-guide/cisco-security-clou...) for the Cisco Security Cloud app show that in a distributed environment you need to install the app on your Splunk Cloud SH. 

The docs discuss how to configure the inputs for specific products so please check the link above for more info on how to ingest your specific logs.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[shashankD]

Configure SC4S in your environment, and manually you can manually configure the parser for the cisco related logs from the Splunk SC4S github, you just need to copy paste the parser and the logs will start parsing.

SC4S github - Splunk Connect for Syslog

Master srcrpit to configure sc4s - raw.githubusercontent.com/J-C-B/community-splunk-scripts/master/SC4S-Splunk-Connect-for-Syslog-cento...

Do modify the related details.

[richgalloway]

Which TA(s) are you using?  Splunk is unlikely to parse the logs out-of-the-box so you'll need a TA from Splunkbase or one of your own.  The "Cisco Security Cloud" app (https://splunkbase.splunk.com/app/7404) looks promising.

[ashwinisingh]

We are using Splunk cloud, we have already install this app on our HF but it is not working, Please confirm if this app can be installed at SH and indexer lever.