Splunk® Supported Add-ons

Splunk Add-on for Cisco ESA

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Source types for the Splunk Add-on for Cisco ESA

The Splunk Add-on for Cisco ESA provides index-time and search-time knowledge for seven types of logs: authentication, textmail, HTTP, Malware, Bounce, Delivery,Consolidated Event, Antispam, Error, System, and Content Scanner data. The add-on does not apply a source type to any incoming logs. You can apply the appropriate source types to your Cisco ESA log data during the data input phase.

Log type Source type Event type Description CIM data models
Authentication cisco:esa:authentication cisco_esa_auth_logs These logs record successful user logins and unsuccessful login attempts. Logs are stored as a <filename>.s (Ex. authentication.@20130302T122552.s) on the server. These logs cannot be configured to send through syslog push, so you must send them to send through ftp or scp. Authentication
Textmail cisco:esa:textmail cisco_esa_change_logs, cisco_esa_alerts, cisco_esa_textmail Text mail logs for Cisco IronPort ESA record email information and status. Logs are stored as a <filename>.s (Ex. mail.@20130712T172736.s) on the server. Change, Alerts, Email
HTTP cisco:esa:http cisco_esa_proxy, cisco_esa_http_session, cisco_esa_logout_logs, cisco_esa_change_logs, cisco_esa_web_logs, cisco_esa_account_management_logs, cisco_esa_alerts The HTTP logs for Cisco IronPort ESA record information about the secure HTTP services enabled on the interface. Logs are stored as a <filename>.s (Ex. gui.@20130302T122618.s) on the server. Network Sessions,

Change, Web

Malware Data cisco:esa:amp cisco_esa_amp

cisco_esa_mar cisco_esa_alerts, cisco_esa_amp_malware, cisco_esa_alerts

Advanced Malware Protection (AMP) of Cisco IronPort ESA records malware detection and blocking, continuous analysis, and retrospective alerting details. Logs are stored as a <filename>.s (Ex. amp.@20180103T132842.s) on the server. Alerts, Malware
Legacy data cisco:esa:legacy cisco_esa_authentication

cisco_esa_email cisco_esa_proxy cisco_esa_auth_logs

If you have an older version of the add-on installed before the source types were renamed to follow best practices, your events indexed with the older source types cisco_esa and cisco:esa are now searchable under this new source type. Authentication
Consolidated Event cisco:esa:cef cisco_esa_cef The Consolidated Event Logs summarize each message event in a single log line. Use this log type to reduce the number of bytes of data (log information) sent to a Security Information and Event Management (SIEM) vendor or application for analysis. The logs are in the Common Event Format (CEF) log message format that is widely used by most SIEM vendors. Email
Bounce Logs cisco:esa:bounce cisco_esa_bounce Bounce logs record information about bounced recipients. The information recorded for each bounced recipient includes:
  • the message ID
  • the recipient ID
  • the Envelope From address
  • the Envelope To address,
  • the reason for the recipient bounce,
  • the response code from the recipient host.

In addition, you can choose to log a fixed amount of each bounced recipient message. This amount is defined in bytes and the default is zero.

Email
Delivery Logs cisco:esa:delivery cisco_esa_delivery Delivery logs record critical information about the AsyncOS email delivery operations. The log messages are "stateless," which means that all associated information is recorded in each log message and users do not need to reference previous log messages for information about the current delivery attempt. Email
Antispam Logs cisco:esa:antispam cisco_esa_change_logs, cisco_esa_alerts Anti-spam logs record the status of the anti-spam scanning feature of your system, including the status on receiving updates of the latest anti-spam rules. Also, any logs related to the Context Adaptive Scanning Engine are logged here. Change, Alerts
Error Logs cisco:esa:error_logs cisco_esa_alerts The Error logs record the errors while sending the alerts, internal Ironport server errors as well as DNS issues. Alerts
System Logs cisco:esa:system_logs cisco_esa_system_logs, cisco_esa_alerts, cisco_esa_account_management_logs System logs record the following: boot information, virtual appliance license expiration alerts, DNS status information, and comments users typed using commit command. System logs are useful for troubleshooting the basic state of the appliance. Network Resolution (DNS), Alerts, Change
Content Scanner Logs cisco:esa:content_scanner cisco_esa_change_logs The Content Scanner logs record the activities of the Content Scanner engine. Change
Last modified on 25 July, 2023
PREVIOUS
Lookups for the Splunk Add-on for Cisco ESA
  NEXT
Troubleshoot the Splunk Add-on for Cisco ESA

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters