About the Splunk Add-on for Cisco IPS
|Vendor Products||Cisco IPS sensors that use the SDEE data format (versions 1.0, 1.1, and 2.0)|
|Viisible in Splunk Web||No. This add-on does not contain any views.|
The Splunk Add-on for Cisco IPS allows a Splunk administrator to consume, analyze, and report on Cisco IPS data that conforms to the Security Device Event Exchange (SDEE) standard. The add-on includes a scripted input to bring your IPS data into the Splunk platform as well as knowledge objects (source type definition, field extractions, event types, and tags) to help you view and interpret that data with the Splunk CIM. You can then use the data with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.
Download the Splunk Add-on for Cisco IPS from Splunkbase at http://splunkbase.splunk.com/app/1903.
Discuss the Splunk Add-on for Cisco IPS on Splunk Answers at http://answers.splunk.com/answers/app/1903.
Source types for the Splunk Add-on for IPS
This documentation applies to the following versions of Splunk® Supported Add-ons: released