All Apps and Add-ons

Cisco eStreamer for Splunk: Is there any listing or definitions of what the "rec_type_simple" fields mean?

panovattack
Communicator

Is there any listing of the what the "rec_type_simple" fields mean? For example, the events with rec_type_simple=PAYLOAD.

0 Karma
1 Solution

douglashurd
Builder

There is a newer estreamer guide available.. Please mail me at dohurd@cisco.com and I will email you the entire pdf. Or try this one: https://developer.cisco.com/site/firepower/

Download the SDK . It contains the 6.x doc.

View solution in original post

0 Karma

douglashurd
Builder

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

0 Karma

douglashurd
Builder

There is a newer estreamer guide available.. Please mail me at dohurd@cisco.com and I will email you the entire pdf. Or try this one: https://developer.cisco.com/site/firepower/

Download the SDK . It contains the 6.x doc.

0 Karma

Sarmbrister
Path Finder

Were you able to gather any other information on the rec_type_simple fields?

0 Karma

douglashurd
Builder

I think this refers to the level of complexity in an attack that has triggered a snort rule. Its about whether the attack is considered simple, medium, hard, or difficult, and whether or not is can be performed using a script. The estreamer integration guide makes no other record related reference to the word 'simple' so I think thi sis the right answer. I found this info in the 6.0 guide. You can download it here: http://developer.cisco.com/site/firesight/discover/getting-started/estreamer/index.gsp

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...