chambear2809 Cisco ASA TA Setup
Prerequisites
| Tool or access | Purpose | Verify |
|---|---|---|
| Bash and Python 3 | Render and validate the onboarding packet | bash --version && python3 --version |
| Splunk admin access | Install and search | Confirm target tier and index |
| SC4S or managed syslog receiver | Own the ASA/FTD transport path | Confirm listener, source, and routing ownership |
Workflow Overview
┌───────────┐ ┌───────────────┐ ┌─────────────────┐ ┌───────────────┐
│ Preflight │ → │ Render/review │ → │ Install/handoff │ → │ Validate data │
└───────────┘ └───────────────┘ └─────────────────┘ └───────────────┘
When to Activate
- Onboard Cisco ASA or Firepower Threat Defense (FTD) syslog into Splunk.
- Diagnose missing or incorrectly typed
cisco:asaevents. - Validate Common Information Model (CIM) and dashboard readiness after installation.
Scope
This skill renders and validates the Splunk-side plan. It does not silently open network listeners, alter firewall policy, or take ownership from an existing syslog service. Hand off receiver mutation to the named SC4S or platform owner.
Examples
Render a review packet without mutation:
bash skills/cisco-asa-ta-setup/scripts/setup.sh --render \
--index cisco_asa --sourcetype cisco:asa --syslog-owner sc4s --include-ftd
Expected output: a cisco-asa-ta-rendered/ packet containing install, routing,
and validation assets without changing Splunk or the receiver.
Run the strict completion gate after installation and routing:
bash skills/cisco-asa-ta-setup/scripts/validate.sh \
--rendered-dir cisco-asa-ta-rendered --live --completion
Expected output: package, index, source type, event, CIM, and dashboard-handoff
checks report [PASS]; missing evidence exits nonzero.
Troubleshooting
| Issue | Cause | Resolution |
|---|---|---|
No cisco:asa events |
Receiver or route is incomplete | Verify the SC4S/listener handoff before changing the TA |
| Wrong source type | Receiver metadata differs | Correct the receiver route |
| No TA dashboards | The TA ships parsing | Validate consuming ES/firewall content |
| Live checks fail | Splunk is unreachable | Run offline checks and hand off live validation |
TA Completion Gate
For every TA/add-on or dashboard companion run, satisfy the shared TA completion gate: configure and enable the data ingest path owned by this skill or its required companion, validate events or metrics in the target indexes/source types, and verify any pre-built/package-shipped dashboards are visible, macro-aligned, and returning data. If the package ships no dashboards, record that evidence explicitly and hand off dashboard use to the consuming app, ES/ITSI/ARI content, or readiness doctor.
Render-first workflow for Splunk_TA_cisco-asa and Cisco ASA/FTD syslog data.
The skill emits reviewed placement notes, syslog handoffs, validation SPL, and
readiness evidence templates. It does not open syslog listeners, install apps,
or mutate Splunk in render-only mode. The explicit --install and --all
modes delegate package installation to splunk-app-install; syslog receiver
mutation remains a separate handoff.
Commands
bash skills/cisco-asa-ta-setup/scripts/setup.sh --render \
--index cisco_asa --sourcetype cisco:asa --syslog-owner sc4s --include-ftd
Review the rendered install-commands.sh, syslog checklist, and validation
searches before delegating installs or receiver work to splunk-app-install,
splunk-connect-for-syslog-setup, or platform owners.
Execute
Preview the executable plan:
bash skills/cisco-asa-ta-setup/scripts/setup.sh --all --dry-run --json
Install the TA package and run local validation:
bash skills/cisco-asa-ta-setup/scripts/setup.sh --all
Add --live to make validation perform read-only Splunk REST/search checks.
The syslog receiver remains delegated to SC4S/syslog ownership workflows.
bash skills/cisco-asa-ta-setup/scripts/validate.sh \
--rendered-dir cisco-asa-ta-rendered --live
The no-flag/live validator is diagnostic. Add --completion (alias --strict)
to require the installed TA, target index, and cisco:asa event evidence; the
completion flags require --live. setup.sh --all --live invokes this strict
gate automatically. The TA supplies parsing/CIM knowledge rather than
standalone dashboards, so dashboard use is handed off to ES/firewall content.
See reference.md for source type, CIM, and receiver guardrails.