Got Cisco Umbrella data in Splunk and annoyed that Cisco didn't build an app to show Dashboard and Reports in Splunk?
Here is a simple, but powerful Splunk app for Umbrella.
There are a few options to get Umbrella data into Splunk:
- Cisco-managed AWS S3 <- Preferred Method
- Customer-managed AWS S3
Data Flow
Splunk Enterprise Customers
Heavy Forwarder
- Linux Server OS (Cisco Requirement)
- aws-cli installed in Linux
- Splunk Enterprise >=7.x
- Cisco Umbrella Add-on for Splunk (https://splunkbase.splunk.com/app/3926/)
- Contains Linux Bash Scripts to pull data from S3 to a flat file log in Splunk
- Follow instructions of this Add-on to get data into Splunk Enterprise
- >50GB of Storage on Heavy Forwarder
- Depending upon Linux file system type and settings and volume of DNS traffic from Umbrella, local storage can fill up.
- You can edit the included bash scripts in the Add-on to be more aggressive with deleting old flat file log data.
- If you're a Linux expert or have advanced knowledge, I suggest ZFS or BTFS for the file system and enable compression to save on storage.
Indexer
- Create new index with any name or use an existing one
- Splunk Enteprise >=7.x
Search Head
- Cisco Umbrella Add-on for Splunk (https://splunkbase.splunk.com/app/3926/)
- Cisco Umbrella App (this app)
- Sankey Diagram Visualization: (https://splunkbase.splunk.com/app/3112/)
- (Optional, but highly recommended): Common Information Model (CIM) App (https://splunkbase.splunk.com/app/1621/)
Splunk Cloud Customers
- Splunk Cloud IDM or on-prem Splunk Heavy Forwarder (see notes above for Heavy Forwarder)
- Cisco Umbrella Add-on for Splunk (https://splunkbase.splunk.com/app/3926/) installed on IDM and Splunk Cloud; may require Cloud Support Ticket for installation on both IDM and Splunk Cloud instance.
- Cisco Umbrella App (this app), use Custom App upload function in Splunk Cloud
- Sankey Diagram Visualization: (https://splunkbase.splunk.com/app/3112/)
- (Optional, but highly recommended): Common Information Model (CIM) App (https://splunkbase.splunk.com/app/1621/)
- Create new index with any name or use an existing one
- Install this app on your Search Head - Apps -> Manage Apps -> Install App from File
- Open the App
- Settings -> Advanced Search -> Search Macros -> umbrella_index
- Edit the macro with the appropriate index name -> Save
- Open the App
- (Optional Step - CIM Data Model) - add Umbrella index name to "Network Resolution" Data Model and accelerate it