Hello folks,
Is Splunk able to help me generate rules to put on an ASA?
We're running an ASA in transparent mode with a single allow rule, logging all traffic seen through to Splunk. The plan is to take that data generated and build the ruleset for the firewall based on a ratified version of the data. I was thinking of first running a report that does a summary of all destination addresses, sorted by number of occurrences, and then for each of the results, a further report to show me the ports that were connected to on those IP's. Which I can see working just fine.
So, my question really is: Is there a slicker and quicker way of generating this data? I've toyed with writing a Python script to chew through the logs, but I'd rather have it all centralised in Splunk.
Any guidance will be gratefully received.
Best, Leigh
Hi Leigh,
It sounds like you would be heavily interested in the splunk add on for cisco asa. I think it can get you pretty far as what you are interested in. I included the link below from splunkbase.