You can use the Cisco Cloud Security Add-on for Splunk to bring Secure Access and/or Umbrella logs into Splunk from AWS S3 (from either your own bucket or from a Cisco Managed bucket).
Build 1.0.39 brings:
- v10 schema log fields for the DNS, RAVPN, ZTNA, proxy, firewall, intrusion, and DLP logs.
- Updated data models:
- Changed the priority to
1 for the intrusion, firewall, and proxy logs.
- Added the session data for the RAVPN log.
- Added the authentication data for the ZTNA log.
- Applied fixes for the intrusion and ZTNA models.
Please see the following link for installation and configuration guidance.
