Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tags.conf firepower_network missing "communicate" and "session" CIM compliant tags #6

Open
s33butler opened this issue Feb 13, 2023 · 1 comment

Comments

@s33butler
Copy link

TA-eStreamer v5.1.9 tags.conf firepower_network does not honor CIM "Network Sessions" or "Network Traffic"

missing "communicate" and "session" tags

CIM "Network Sessions" looks for (cim_Network_Sessions_indexes) tag=network tag=session
CIM "Network Traffic" looks for (cim_Network_Traffic_indexes) tag=network tag=communicate

v5.1.9 tags.conf....
[eventtype=firepower_network]
network = enabled
start = enabled
end = enabled

In order to work with CIM, probably should be... (though may need their own eventtypes if not true for all)
[eventtype=firepower_network]
network = enabled
communicate = enabled
session = enabled
start = enabled
end = enabled

@s33butler
Copy link
Author

Related docs
https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic

Session may only be related to VPN and DHCP, but it's unclear
https://docs.splunk.com/Documentation/CIM/5.1.0/User/NetworkSessions

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant