Cisco Security Suite 3.0.2 now includes Cisco IronPort Email Security Appliance (ESA) Data

By Jason Conger

The Cisco Security Suite app continues to get updated for Splunk 6.x. The latest addition is support to Cisco IronPort Email Security Appliance (ESA). A new add-on has been published that provides Common Information Model compliant field extractions and tags for data from Cisco ESA. So now, the Cisco Security Suite supports:

Cisco ASA and PIX firewall appliances, the FWSM firewall services module
WSA web security appliance
Cisco IronPort Email Security Appliance (ESA)
Cisco Identity Services Engine (ISE)

Also, with each release, we incorporate more feedback about documentation. So, in addition to documentation found within the Cisco Security Suite app itself, a subset of “getting started” documentation has been published under the Documentation tab on http://apps.splunk.com/app/525/.

Stay tuned, there is more to come…

Jason Conger

Jason Conger is the Partner Field CTO for Splunk, driving innovation and technical alignment with Splunk partners around the globe. With deep expertise in product architecture, integration, and cloud technologies, he helps align the Splunk technical roadmap with partners’ goals to drive innovative solutions that enhance customer success. Jason joined Splunk in 2012 and has fostered partner innovation and practices ranging from Mainframe to Cloud and everything in between.

Security 12 Min Read

Detecting & Hunting Named Pipes: A Splunk Tutorial

Named pipes can be threats, too. In this comprehensive article, we are going to talk about detecting, hunting and investigating named pipes.

Security 13 Min Read

From Macros to No Macros: Continuous Malware Improvements by QakBot

This blog, the Splunk Threat Research Team (STRT) showcases a year's evolution of QakBot. We also dive into a recent change in tradecraft meant to evade security controls. Last, we reverse engineered the QakBot loader to showcase some of its functions.

Security 3 Min Read

Macros, We Don’t Need No Stinking Macros! — Featuring the New Microsoft O365 Email Add-On

Using Microsoft O365 for your emails? Take a look at the new Microsoft O365 Email Add-on for Splunk to start getting in-depth security and non security data from your emails today.

About Splunk

The world’s leading organizations rely on Splunk, a Cisco company, to continuously strengthen digital resilience with our unified security and observability platform, powered by industry-leading AI.

Our customers trust Splunk’s award-winning security and observability solutions to secure and improve the reliability of their complex digital environments, at any scale.