Splunk Integration and AI Driven Threat Intelligence

What it is

Splunk is a platform for searching and analysing machine data, and Secure Firewall can send its events there.

Splunk is often a central place where a security team keeps logs from many products. Sending firewall events into it lets analysts search them next to data from servers, applications and other tools.

The second half of this topic is about intelligence. Cisco Talos research feeds Secure Firewall, and some features use machine learning to detect threats.

How it works

There are two ways to deliver events, and several ways in which intelligence improves detection.

eStreamer

The Event Streamer (eStreamer) is a service on the Secure Firewall Management Center (FMC). It streams events to a client program. Splunk uses it through a Cisco add on.

On the FMC, you create a client in the eStreamer settings. This produces a client certificate that you give to the Splunk side. You also choose which event types the client may receive.

The service listens on TCP port 8302. The Splunk add on connects to the FMC, authenticates with the certificate and receives the stream. It keeps the full event detail, in a form that the app can use.

Syslog

The second way is syslog. Devices or the FMC send selected events as syslog messages to Splunk.

This is simpler to set up. It has less detail than eStreamer, and the format of the message matters for parsing.

You choose where to send events in the logging settings of the access control policy and in the syslog settings of the platform. The Splunk side needs an input that listens for the messages.

The Splunk side

Cisco publishes apps and add ons for Splunk that understand Secure Firewall data. The add on collects and parses the events. The app adds dashboards for connections, intrusions, files and more.

Names and packaging of these Splunk apps have changed over time. Check the current documentation for the version you plan to use.

Talos and AI driven intelligence

Cisco Talos is the threat research group behind many Secure Firewall updates. These arrive through the normal update process. They include intrusion rules, the vulnerability database, URL categories and reputation, and Security Intelligence feeds.

Machine learning is used in several places. The Encrypted Visibility Engine uses a model to classify encrypted client traffic.

Recent releases also add machine learning based detection of exploit attempts in Snort 3. Features and release numbers differ, so check which ones your version has.

Cisco also adds AI assistants for security work in some products, which help analysts ask questions and understand events. Treat these as helpers, because the analyst still decides.

Putting the two together

Events in Splunk show what the firewall saw and what it decided. Talos updates and models improve what the firewall can detect.

Together they form a loop. Better detection creates better events, and analysts use those events to tune policy.

Good practice

Send the events that you will use, because volume costs money in Splunk. Keep certificates and the FMC clock in order. Keep updates current so detection stays fresh.