Cisco Secure Network Analytics (Stealthwatch) App for Splunk Enterprise
Overview
Details
Cisco SNA App for Splunk Enterprise
Note: Any Splunk User that installs/configures/uses this App must have the following Capabilities on the Role assigned to them. list_settings and list_storage_passwords
The Cisco Secure Network Analytics (SNA) App provides a rich set of Splunk dashboards designed to interact with Cisco SNA and facilitate a workflow for incident response and investigation. Most queries in dashboards leverage StealthwatchAPIs, and present the data on-demand. Because of this approach to fetching data, this app will not impact your Splunk license usage limits.
The Splunk Dashboards include:
- Alarms
- Alarms Dashboard
- Top Alarming Hosts Dashboard
- Monitor
- Host Snapshot Dashboard
- User Report Dashboard
- Analyze
- Flows Dashboard
- Top Reports Dashboard
- Security Events Dashboard
Leverage custom SNA configuration data to dynamically filter results in Splunk, similar to queries directly on the SMC. Filter results by:
- IP Addresses/Ranges
- Host Groups
- Applications
- Ports
- Protocols
- And more...
Smart drilldown capabilities are enabled throughout the app. More details on a given host are only a click away. API features also available for use with Splunk free-form searches.
Requirements
- Splunk Enterprise Versions 8.0+
- Cisco Secure Network Analytics (SNA) Versions 7.0+
Installation of App
Note: Any Splunk User that installs/configures/uses this App must have the following Capabilities on the Role assigned to them. list_settings and list_storage_passwords
- Download the add-on from Splunkbase
- From the Splunk Web home screen, click the gear icon next to Apps.
- Click Install app from file.
- Locate the downloaded file and click Upload.
- If Splunk Enterprise prompts you to restart, do so.
- Verify that the add-on appears in the list of apps and add-ons. You can also find it on the server at
$SPLUNK_HOME/etc/apps/<Name_of_add-on>.
Configuration of App
Note: Any Splunk User that installs/configures/uses this App must have the following Capabilities on the Role assigned to them. list_settings and list_storage_passwords
Once the app has been installed on Splunk Enterprise, click on the icon of the app in the list of add-ons. You will be prompted to configure the App based on your SNA environment. All fields are required
- SMC Address
- This is the Host Name or IP address of your SMC server
- SMC Domain ID
- This is the ID of the Domain you want to utilize when querying the SNA API. It can be retrieved by navigating to:
- https://[Your-SMC-Address]/smc/index.html
- Support -> Browse Files.
- In the Files Panel: smc -> config
- You will then see a directory(s) named: domain_***
- That 3 digit number is your domain ID
- This is the ID of the Domain you want to utilize when querying the SNA API. It can be retrieved by navigating to:
- SMC Username/Password
- This will be the account the App uses to fetch the data from the SMC using APIs. This account needs to have Master Admin permission in the SMC.
If you ever need to update any of these settings you can come back to this page by navigating to Manage Apps then next to Cisco SNA App you can click Set Up.
Logging
The log file for this app can be located on the Splunk Enterprise Server at: /opt/splunk/var/log/splunk/cisco_sna_app.log
This can be a useful place to track down issues with the App such as incorrect SMC Username/Password when setting up the App.
Release Notes
Version 2.0.3
2.0.3
Fix for bug in Flows panels when using a CDS SNA Environment.
Version 2.0.2
Version 2.0.2
Fixed an issue where SNA Jobs were filling up the DB and causing a 400/BAD_REQUEST. This version now cleans up/deletes the Search Jobs once the data has been returned.