I put in a Splunk ticket for this problem, but they told me the Splunk eNcore app wasn't a supported app and that I need to contact Douglas Hurd. Here are the details from the ticket.
We are running Splunk 7.1.3 and using TA-eStreamer version 3.0 to pull events from Cisco FirePower Manager into Splunk. The app is working and we are getting events, but some alerts are coming in without the "msg" field. If the alerts are coming into Splunk without names, it hinders our analyst's ability to do their job. We have spoken to Cisco about this problem and they have identified a bug. They told us how to fix it, but they weren't technical and I'm not sure how to make the change in Splunk. They told me to open a trouble ticket with Splunk. Listed below is the information from the bug :
eStreamer rec_type:400 shows different SID value from seen in FMC
CSCvg90331
Description
Symptom:
When eStreamer is configured on FMC and eStreamer client tries to get rec_type:400(IPS EVENT) triggered by local rule, it only shows local SID that is assigned locally and this value is different from what we can see from FMC.
This makes it difficult for the customer to search intrusion event by SID from eStreamer client.
Conditions:
This only occurs on local rule only and doesn't occur on Cisco defined rule update.
Especially when customer tries to import rule list from local file and SIDs are specified for each rule, symptom occurs.
Workaround:
None, Use local sid for search criteria that can be obtained from rec_type:66(RULE)
Further Problem Description:
Regarding attribute name of eStreamer, rec_type:66(RULE) shows rule_id(local_sid) and signature_id(SID seen from FMC). But rec_type:400(IPS EVENT) only shows signature_id(local_sid)
Please make sure same attribute name(signature_id) has different meaning.
I have no idea how to make this change within the eStreamer app. Can someone point me in the right direction?
Thank you.
