Definitely aware. Met with your colleague at C Live last week. ... View more

The Splunk team has approved the app for Cloud. The issue comes down to a .py file that we use per Splunk's older guidance which has since been deprecated. There is no suitable replacement for the file currently. ... View more

If you move to version 6.x of firepower you will be best served to use the new TA: https://splunkbase.splunk.com/app/3662/ ... View more

you can collect intrusion events from the device directly as there is eStreamer server code on the device. You'll only get IDS events however. No impact flag. You can get IDS and Connection events off the device in syslog too. TAC can help you set this up. On the port, you need to use 8302, not 8320. Doug ... View more

What version of Firepower are you using? If it's 6.x you want to move right away to the new TA. https://splunkbase.splunk.com/app/3662/ ... View more

On connection events, if you disable them at the FMC's eStreamer configuration page that should prevent them from being sent and free up CPU for eNcore as it won't have to read/write/format those events. On the rate of the events, it should be possible to support 500 events per second with sufficient resources. The CPU clock speed will be a huge factor. What does this 16 CPU platform have for CPUs? Looks like you have plenty of Disk and RAM. ... View more

From an initial read from the experts you may be hitting a performance limitation. The current version generally maxes at 1.33 CPU cores. We're have plans for a more scalable version but I don't have a date yet. What sort of event rate does your deployment run at for Connection Events? Any ideas? If it is a performance limit it might explain the time stamp gap you see. The event queue gets pruned and if eNcore falls behind it could see the older events get pruned before transmission and then when it resumes you're getting subsequent events that didn't pruned. We've seen this in some networks with very rates. ... View more

Makes total sense ! Glad its running. ... View more

Did you get this resolved? What exact version of the FMC are/were you running? ... View more

did you get this resolved? There was a FIPs issue on 6.2.2 that was resolved for now with a HotFix an will be resolved in a future patch as well. ... View more

We've seen a few customers hit some performance limitations where one CPU hits 100 percent and a second at 33%. We know we need to make some enhancements to make it more scalable. Do you have a second CPU available? If you shut off Connection Events, do the Intrusion events show up? ... View more

Couple of easy things to check. Sorry if these are super obvious. - check to make Intrusion Events option in the estreamer config page is toggled on - make sure you see the events in the FMC UI - search for rec_type=400 in the Splunk search The old TA might be requesting an older IDS event type. Not sure this matters. This has to be something super basic. Doug ... View more

We have only seen this when using the CLI as opposed to within our TA. You’ll need a configuration change. Required line is: Sourcetype [cisco:estreamer:data] SHOULD_LINEMERGE = false ... View more

Can you please better describe what you mean by grouping? Do you have a screenshot? Anything? ... View more

you should use the Deployment Server to deploy the eNcore Add-on to heavy forwarder (for the data input/collection), as well as indexer and search head (since the add-on contains field extractions) ... View more

One other question before I try to get the eNcore developer to look at this. Did you read the entire Operations guide? There are some pretty critical dependancies for this to work properly and a number of issues that we've resolved have simply been down to not having a few key files/versions in place. Doug ... View more

You will also want to patch 6.2.0.1 to 6.2.0.5 to address an estreamer bug. ... View more

Highly recommend you use the new eNcore for Splunk add-on for Firepower 6.x. This is s a complete re-write estreamer client built in Python with a Splunk plugin. https://splunkbase.splunk.com/app/3662/ Its able to scale with more CPU/RAM and supports the entire 6.x schema, delivering fully qualified event data. Doug ... View more

try this link for now: https://www.dropbox.com/s/gvp7rd6chdb9mft/eStreamer-eNcore-Operations-Guide-v3.0.0.docx?dl=0 ... View more

I'll find another place to post the doc. In the mean time please email encore-community@cisco.com and I can email the doc directly back to you. Thanks for the heads up. Doug ... View more

I will find another place to post the documentation. In the meantime please email encore-community@cisco.com if you need me to mail it to you. Doug ... View more

while we're on the topic, is this the app you are trying to use? https://splunkbase.splunk.com/app/3662/ The older (1629) app is going to cause you nothing but problems with FP 6.x. ... View more