topic Ironport Integration with Splunk in Web Security

Ironport Integration with Splunk

sreejith_r — Tue, 17 Jan 2012 09:26:23 GMT

Hi;

I am trying to integrate ironport and splunk for the reporting feature. Have anyone tried with this.

Thanks & Regards

Sreejith R

Ironport Integration with Splunk

Atazazuddin Shaikh — Thu, 09 Feb 2012 21:32:04 GMT

Hi Sreejith

We have few customer being in transition over to Splunk, Please let me know if you have ANY specific questions.

Regards,

Zack

Ironport Integration with Splunk

tidavids — Fri, 10 Feb 2012 19:30:32 GMT

Cisco has developed, sells and directly supports a Advanced Reporting for WSA Application for Splunk.

Not only does the application properly extract the various fields in both access and trafmonlogs, but also directly emulates the functionality of on-box reporting while still allowing for additional Splunk searches.

Ironport Integration with Splunk

sreejith_r — Wed, 22 Feb 2012 09:34:14 GMT

Do you have any proper document for doing this. I downloaded the WSA from cisco and added in the splunk. But its not fetching the information from the ironport. Maybe i missed one or two steps. If you have any documents , please share it. it will be very helpful.

Thanks & Regards

Sreejith R

Ironport Integration with Splunk

tidavids — Wed, 22 Feb 2012 12:15:13 GMT

There are Install, User and Troubleshooting Guides posted to the Cisco Support portal. The "Install Guide" steps one through the process of importing logs, first time set-up, etc.

The "Troubleshooting Guide" will help diagnose any problems you may be having. In short, I would insure that the data is being properly indexed (search "*" in the logs and make sure fields are properly extracted, eg. acl_tag).

Next, with the fields being properly extracted, you may need a one-time run of the summary script if you have imported historical logs.

All of this is documented in the guides.

~Tim

Re: Ironport Integration with Splunk

Atazazuddin Shaikh — Wed, 22 Feb 2012 13:25:59 GMT

Hi Sreejith

Enclosing a step by step document please let me know if you have ANY specific questions after reviewing this.

Regards,

Zack