Splunk Add-on for Cisco IPS

The Splunk Add-on for Cisco IPS allows a Splunk® Enterprise administrator to consume, analyze, and report on Cisco IPS data that conforms to the Security Device Event Exchange (SDEE) standard. The add-on includes a scripted input to bring your IPS data into Splunk Enterprise as well as knowledge objects (source type definition, field extractions, event types, and tags) to help you view and interpret that data with the Splunk CIM. This add-on is designed to work with the Splunk Cisco Security Suite. Install these together to access reports and dashboards that give you visual insight into your Cisco IPS data.