Splunk Enterprise Security

Why is the CIM and the Enterprise Security not seeing the data correctly in Cisco Firepower eNcore App for Splunk?

e_mazza
New Member

Hello,
I setup correctly Cisco eStreamer 3.0.0 but I see that is not CIM and Enterprise Security won't see the data correctly.
Does anyone know if there will be a new version of CIM? Or the best way is to use the old 2.2.2 which is CIM?

Many Thanks

0 Karma
1 Solution

mhessel
Path Finder

In the new eStreamer eNcore I found a couple issues that might cause this:

  1. the eventtypes are defined in the eStreamer-Dashboard app, not in the TA-eStreamer one, so make sure you install both.
  2. there are typos in the eStreamer-Dashboard default tags.conf.. all of the eventtypes there use dashes in place of the underscore present in the eventtypes.conf. -- updating the tags.conf and replacing all "-" with "_" resolves that.

Example, I changed:
[eventtype=estreamer-ids-ips-event]

to

[eventtype=estreamer_ids_ips_event]

View solution in original post

0 Karma

e_mazza
New Member

I solved fixing the tags inside the estreamer dashboard.

0 Karma

mhessel
Path Finder

In the new eStreamer eNcore I found a couple issues that might cause this:

  1. the eventtypes are defined in the eStreamer-Dashboard app, not in the TA-eStreamer one, so make sure you install both.
  2. there are typos in the eStreamer-Dashboard default tags.conf.. all of the eventtypes there use dashes in place of the underscore present in the eventtypes.conf. -- updating the tags.conf and replacing all "-" with "_" resolves that.

Example, I changed:
[eventtype=estreamer-ids-ips-event]

to

[eventtype=estreamer_ids_ips_event]

0 Karma

e_mazza
New Member

I confirm this is how I solved.
Many thanks!

0 Karma

tiagofbmm
Influencer

Why do you say it is not CIM?

I took a look at the tags and eventtypes and they will surely be matched agains CIM. Am I missing something here?

0 Karma

e_mazza
New Member

I saw that there's no CIM in the app description, so I thought it was not compliant.
After investigating a bit I could see a few tag and eventypes, but i don't see anything matched.
In the logs I receive there's a lot of fields that are not matched (here the list of the possible fields I have).
source
sourcetype
app
app_proto
dest
dest_ip
fw_rule
http_response
rule
src
src_ip
url
user
time
index
linecount
splunk_server

I'm pretty sure that I should have a ton of other fields. Can you confirm that I should see more things?
Many thanks

0 Karma

tiagofbmm
Influencer

The fields you should see strictly depend on what DataModel are your events being mapped against.
The list of fields you are showing me are pretty much the expected ones for NetworkTraffic DataModel I think, so don't assume it is not CIM compliant.

More, you don't need to have all the fields of a data model in your data. Rarely you'll have them all in fact.

Check here which fields each Data model of enterprise security has.

http://docs.splunk.com/Documentation/CIM/4.9.1/User/Authentication

0 Karma

e_mazza
New Member

It seems that there are no tags so the data cannot be used in any datamodel. Is this a normal behavior?
In estreamer TA there are no Tags, in estreamer dashboard there are eventtypes but again no tags.
I put a picture here:
https://imgur.com/MwrXzqf

0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...