Reporting

How do I install the Cisco IronPort E-mail add-on?

Will_Hayes
Splunk Employee
Splunk Employee

How do I install and configure the Cisco Ironport E-mail add-on: http://www.splunkbase.com/apps/All/4.x/app:Cisco+IronPort+E-mail+Security+Add+On

Tags (3)

dikaye
Path Finder

I can search the logs with search command "eventtype=cisco_esa", but nothing appear with command: "eventtype=cisco_esa mailfrom=* | eval accountname=split(mailfrom,"@") | eval from_user=mvindex(accountname,0) | eval from_domain=mvindex(accountname,-1) | table mailfrom, from_user, from_domain", why?

0 Karma

sgtquezada
New Member

I am unable to bring the app up. I am getting a 500 internal server error. All I did was rename the app/directory.

I do notice there is no nav directory with a listed default.xml. Is anyone else having issues trying to get to the app?

0 Karma

Will_Hayes
Splunk Employee
Splunk Employee

To install this add-on, unpack this file into $SPLUNK_HOME/etc/apps and restart.

The field extractions are set to sourcetype=cisco_esa by default and the reports use eventtype=cisco_esa together the data.

If you already have the IronPort Mail logs indexed under a different sourcetype you will need to update the props.conf and eventtypes.conf files in the local directory of this app.

In props.conf create the following entry, replacing the stanza name with your the sourcetype for your IronPort Mail logs:

[enter_sourcetype_here]
REPORT-ironport = get_mid, get_to, get_from, get_icid, get_dcid, get_attach_name, get_attach_size, get_subject1, get_subject2, get_subject3

In eventtypes.conf create the following entry, replacing the search terms with the sourcetype for your IronPort Mail logs:

[cisco_esa]
search = sourcetype=your_usa_sourcetype
tags = cisco e-mail security

The sample reports in this add-on rely on the search: eventtype=cisco_esa in order to report on IronPort mail data. There is one scheduled search included in this add-on which creates an cache for the dashboard every 6 hours with a Splunk enterprise license. To change the schedule you can edit the following search under the manager:

Cisco IronPort E-mail - DataCube

The included form search creates a simple interface for mining transactions in the IronPort mail logs.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...