@pradjswl - 60 Karma points are required to attach files. Here's a general outline of how to earn Karma points on Answers as well as how much Karma is required in order to unlock certain site capabilities. ... View more

Within the Splunk_CiscoISE App, Go to Settings -> Event Types Create a new Event Type named "cisco-ise" and its definition should be - sourcetype=cisco:ise:syslog eventtype=cisco-ise-* Change the permissions to **Global* and RW privileges as needed Now all the graphs should have data populated ... View more

Hi TonyLeeVT, Agreeed that some of these extractions aren't doing exactly what's intended. Internally we're working on some updates however don't have a time frame just yet. First the message_type needed some rework. EVAL-message_type = if(match(_raw,"Response:|response:"),"Response",if(match(_raw,"query:\s(\S+)\s(\w+)\s(\S+)\s((?:\+|\-)\S*)\s\((\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\)"),"Query","unknown")) Then split the request and response regex. [dns_request] REGEX = client\s(?<dns_request_client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|(?:::)?(?:[a-zA-Z\d]{1,4}::?){1,7}[a-zA-Z\d]{0,4})#(?<dns_request_client_port>\d+).*\squery:\s(?<dns_request_queried_domain>\S+)\s(?<dns_request_class_name>\w+)\s(?<dns_request_type_name>\w+)\s(?<dns_request_setDC>(?:\+|\-)\S*)\s\((?<dns_request_name_serverIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|(?:::)?(?:[a-zA-Z\d]{1,4}::?){1,7}[a-zA-Z\d]{0,4})\) [dns_response] REGEX = \S+\s+(?<server_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\snamed\[(?<pid>\d+)\]\:\s(?<log_date>\S+)\s(?<log_time>\S+)\sclient\s(?<dns_response_client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|(?:::)?(?:[a-zA-Z\d]{1,4}::?){1,7}[a-zA-Z\d]{0,4})#(?<dns_response_client_port>\d+)?[\D]*\s(?<dns_response_protocol>\w+):\squery:\s(?<dns_response_queried_domain>\S+)\s(?<dns_response_class_name>\w+)\s(?<dns_response_type_name>\w+)\sresponse:\s(?<dns_response_rcode>\w+)\s(?<dns_response_flags>\S+)\s?(?<dns_response_RR_in_TEXT>[\S+\s+]*)? And to deal with the multiple records within the response we can split out again [dns_incepted] REGEX=(?<dns_record>[^;]+) SOURCE_KEY=dns_response_RR_in_TEXT MV_ADD=true [dns_records_extract] REGEX = (?<dns_answer_name>\S+)\s(?<dns_answer_ttl>\d+)\s(?<dns_class>\S+)\s(?<dns_type>\S+)\s(?<dns_rdata>\S+) SOURCE_KEY = dns_record MV_ADD=true Hope this helps for now, however with all the changes it may be better to wait for the update. Don ... View more

Hi, Thanks for your help. I had been setting it to the wrong sourcetype, cisco:esa, which was renaming it to cisco:esa:legacy and in turn using a different set of field extractions. This is why none of the panels in the Cisco Security Suite were populating data. I got it going by adding the stanza to my props.conf file to set the sourcetype as cisco:esa:textmail : [host::Host-IP-Address] TRANSFORMS-changesourcetype = cisco_esa_textmail_sourcetype and then added this stanza to my transforms.conf file: [cisco_esa_textmail_sourcetype] REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)[?(Host-IP-Address)[\w.-]]?\s FORMAT = sourcetype::cisco:esa:textmail DEST_KEY = MetaData:Sourcetype Thanks again! ... View more

Hi secfrit, I looked at the second part of your request and did indeed find an issue in the way src_ip was being extracted for some log lines. I reworked your suggestion into something i believe covers all logging scenarios. [src_dest_fields_for_cisco_esa] REGEX = (?:DCID|ICID)\s+\d+\s+interface(?:[\S\s]* [\(]?)(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}).*\s+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:\s+port\s+(\d+))? FORMAT = src_ip::$1 dest_ip::$2 dest_port::$3 Happy to hear some feedback if this doesn't rectify your field extraction scenario. Thank You Kindly Don ... View more