Reporting

How do I install the Cisco IronPort E-mail add-on?

Will_Hayes
Splunk Employee
Splunk Employee

How do I install and configure the Cisco Ironport E-mail add-on: http://www.splunkbase.com/apps/All/4.x/app:Cisco+IronPort+E-mail+Security+Add+On

Tags (3)

dikaye
Path Finder

I can search the logs with search command "eventtype=cisco_esa", but nothing appear with command: "eventtype=cisco_esa mailfrom=* | eval accountname=split(mailfrom,"@") | eval from_user=mvindex(accountname,0) | eval from_domain=mvindex(accountname,-1) | table mailfrom, from_user, from_domain", why?

0 Karma

sgtquezada
New Member

I am unable to bring the app up. I am getting a 500 internal server error. All I did was rename the app/directory.

I do notice there is no nav directory with a listed default.xml. Is anyone else having issues trying to get to the app?

0 Karma

Will_Hayes
Splunk Employee
Splunk Employee

To install this add-on, unpack this file into $SPLUNK_HOME/etc/apps and restart.

The field extractions are set to sourcetype=cisco_esa by default and the reports use eventtype=cisco_esa together the data.

If you already have the IronPort Mail logs indexed under a different sourcetype you will need to update the props.conf and eventtypes.conf files in the local directory of this app.

In props.conf create the following entry, replacing the stanza name with your the sourcetype for your IronPort Mail logs:

[enter_sourcetype_here]
REPORT-ironport = get_mid, get_to, get_from, get_icid, get_dcid, get_attach_name, get_attach_size, get_subject1, get_subject2, get_subject3

In eventtypes.conf create the following entry, replacing the search terms with the sourcetype for your IronPort Mail logs:

[cisco_esa]
search = sourcetype=your_usa_sourcetype
tags = cisco e-mail security

The sample reports in this add-on rely on the search: eventtype=cisco_esa in order to report on IronPort mail data. There is one scheduled search included in this add-on which creates an cache for the dashboard every 6 hours with a Splunk enterprise license. To change the schedule you can edit the following search under the manager:

Cisco IronPort E-mail - DataCube

The included form search creates a simple interface for mining transactions in the IronPort mail logs.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...