How do I install the Cisco IronPort E-mail add-on?

[Will_Hayes]

How do I install and configure the Cisco Ironport E-mail add-on: http://www.splunkbase.com/apps/All/4.x/app:Cisco+IronPort+E-mail+Security+Add+On

[dikaye]

I can search the logs with search command "eventtype=cisco_esa", but nothing appear with command: "eventtype=cisco_esa mailfrom=* | eval accountname=split(mailfrom,"@") | eval from_user=mvindex(accountname,0) | eval from_domain=mvindex(accountname,-1) | table mailfrom, from_user, from_domain", why?

[sgtquezada]

I am unable to bring the app up. I am getting a 500 internal server error. All I did was rename the app/directory.

I do notice there is no nav directory with a listed default.xml. Is anyone else having issues trying to get to the app?

[Will_Hayes]

To install this add-on, unpack this file into $SPLUNK_HOME/etc/apps and restart.

The field extractions are set to sourcetype=cisco_esa by default and the reports use eventtype=cisco_esa together the data.

If you already have the IronPort Mail logs indexed under a different sourcetype you will need to update the props.conf and eventtypes.conf files in the local directory of this app.

In props.conf create the following entry, replacing the stanza name with your the sourcetype for your IronPort Mail logs:

[enter_sourcetype_here]
REPORT-ironport = get_mid, get_to, get_from, get_icid, get_dcid, get_attach_name, get_attach_size, get_subject1, get_subject2, get_subject3

In eventtypes.conf create the following entry, replacing the search terms with the sourcetype for your IronPort Mail logs:

[cisco_esa]
search = sourcetype=your_usa_sourcetype
tags = cisco e-mail security

The sample reports in this add-on rely on the search: eventtype=cisco_esa in order to report on IronPort mail data. There is one scheduled search included in this add-on which creates an cache for the dashboard every 6 hours with a Splunk enterprise license. To change the schedule you can edit the following search under the manager:

Cisco IronPort E-mail - DataCube

The included form search creates a simple interface for mining transactions in the IronPort mail logs.