Can we setup Cisco Firepower eNcore App for Splunk on HF?

[mallempatisreed]

hi Team,

We are using FMC v6.* version. To integrate the logs of FirePower managemnet console can someone guide me how to setup the Firepower eNcore App for Splunk.

We have Splunk ES on Dedicated standalone SH and also we have one HF where we are DB Connect App for pulling sec data. Do we need to install the Addon on HF to pull the data? there is no clear installation document for the same. Can someone help me with the installation steps.

Thanks,
Sree

[douglashurd]

Sorry it took forever to respond. You need to install on a HF or use the CLI version. TA on the HF is best. Make sure you're using the latest version of the TA. 3.5.3.