Release notes for the Splunk Add-on for Cisco ESA¶

Version 1.8.0 of the Splunk Add-on for Cisco ESA was released .

Compatibility¶

Version 1.8.0 of the Splunk Add-on for Cisco ESA is compatible with the following platforms, CIM versions, and products:

Version 1.8.0 of the Splunk Add-on for Cisco ESA has the following new features:

Added support for Cisco ESA Anti-Virus lifecycle logs under the cisco:esa:antivirus source type.
Added Malware Operations mapping for Cisco ESA Anti-Virus IDE signature serial events.
Added Network Sessions Session_Start mapping for HTTP session-established events in cisco:esa:system_logs.
Updated Cisco ESA GUI HTTP session-established events to map to Authentication instead of Network Sessions.
Updated the Cisco ESA dashboard Change panel to filter Cisco ESA sourcetypes only.

Review the following search-time behavior changes before upgrading to version 1.8.0:

GUI HTTP session-established events in cisco:esa:http now map to Authentication through the cisco_esa_auth_logs event type with action=success. Previous releases mapped these events to Network Sessions Session_Start with action=started. The cisco_esa_http_session event type was removed, so saved searches that reference this event type must be updated to use cisco_esa_auth_logs.
HTTP session-established events in cisco:esa:system_logs now map to Network Sessions Session_Start through the cisco_esa_network_sessions_start event type. For these events, src is populated from the initiating client IP extracted from SourceIP.
Cisco ESA Network Traffic events now use application-specific app values such as http, https, and SMTP instead of the generic Cisco Email Security Appliance value when the protocol is known.
System-generated Change events no longer synthesize user_type=User when there is no user context in the event.

sourcetype	DM Identification Criteria	Previous CIM model	New CIM model
`cisco:esa:http`	HTTP GUI session-established events	Network Sessions:Session_Start	Authentication
`cisco:esa:system_logs`	HTTP session-established events	None	Network Sessions:Session_Start
`cisco:esa:antivirus`	Anti-Virus IDE signature serial events	None	Malware:Malware_Operations

Source type	Fields added	Fields removed
`cisco:esa:antivirus`	log_type, av_engine, update_phase, product_version, signature_version, vendor_product, app, dest, dvc
`cisco:esa:system_logs`	src and src_ip for HTTP session-established events
`cisco:esa:system_logs`		synthetic user_type=User for system-generated Change events
`cisco:esa:http`, `cisco:esa:textmail`	application-specific app values for Network Traffic events

Version 1.8.0 of the Splunk Add-on for Cisco ESA fixes the following issues.

Version 1.8.0 of the Splunk Add-on for Cisco ESA contains the following known issues.

If no issues appear here, no issues have yet been reported.