Cisco Secure Email Web Gateway Setup

Cisco Secure Email/Web Gateway Setup

Prerequisites

Workflow Overview

┌───────────┐   ┌─────────────────┐   ┌──────────────────┐   ┌───────────────┐
│ Preflight │ → │ Render packages │ → │ Configure ingest │ → │ Validate data │
└───────────┘   └─────────────────┘   └──────────────────┘   └───────────────┘

When to Activate

• Onboard Cisco Email Security Appliance (ESA) or Web Security Appliance (WSA) logs.
• Configure email/netproxy indexes, macros, parser placement, or transport ownership.
• Diagnose missing source types, CIM fields, or dashboard evidence.

Scope

This skill renders and validates Splunk-side ESA/WSA onboarding. It does not configure appliance policy or silently create competing syslog and file-monitor paths. Select one transport owner and preserve parser placement.

Examples

Render both product paths for SC4S ownership:

bash skills/cisco-secure-email-web-gateway-setup/scripts/render_ingestion_assets.sh \
  --product both

Expected output: reviewable package, index, macro, parser, transport, and validation assets are written without changing an appliance.

Run strict validation after events arrive:

bash skills/cisco-secure-email-web-gateway-setup/scripts/validate.sh \
  --completion --product both

Expected output: ESA and WSA package, source type, event, CIM, and dashboard handoff checks report [PASS] or exit nonzero.

Troubleshooting

TA Completion Gate

For every TA/add-on or dashboard companion run, satisfy the shared TA completion gate: configure and enable the data ingest path owned by this skill or its required companion, validate events or metrics in the target indexes/source types, and verify any pre-built/package-shipped dashboards are visible, macro-aligned, and returning data. If the package ships no dashboards, record that evidence explicitly and hand off dashboard use to the consuming app, ES/ITSI/ARI content, or readiness doctor.

Automates Splunk-side setup for:

• Cisco Email Security Appliance add-on (Splunk_TA_cisco-esa, Splunkbase 1761)
• Cisco Web Security Appliance add-on (Splunk_TA_cisco-wsa, Splunkbase 1747)

These packages are parser/search-time add-ons. They do not contain device API inputs, credentials, or custom REST account handlers. Collection is handled by ESA/WSA syslog export, SC4S, or file-monitor deployment.

Package Verification Boundary

The ESA package-derived behavior was verified against 1.7.1, the current public listing, which advertises Splunk 10.5. That package was downloaded, unpacked, and inspected here, so the shared installer's default pin needs no review override and no historical-pin acknowledgement. The WSA package carries no verified/public-version drift in the registry either. When Splunkbase publishes a newer release for either add-on, re-check its manifest, source types, eventtypes, and parser/dashboard evidence before advancing the pin.

Workflow

Install and configure one or both products:

bash skills/cisco-secure-email-web-gateway-setup/scripts/setup.sh \
  --product both \
  --install

Render collector handoff assets:

bash skills/cisco-secure-email-web-gateway-setup/scripts/render_ingestion_assets.sh \
  --product both \
  --output-dir ./cisco-secure-email-web-gateway-rendered

Validate Splunk-side readiness:

bash skills/cisco-secure-email-web-gateway-setup/scripts/validate.sh --completion --product both

Defaults

Use splunk-connect-for-syslog-setup for SC4S runtime deployment. This skill only prepares the Splunk-side add-ons, indexes, macros, and rendered handoff snippets.

Validation Modes

Run scripts/validate.sh for diagnostics. Use --completion (alias --strict) to require the selected parser TA, index, macro, and matching event data. The ESA/WSA parser packages do not provide standalone dashboards, so the explicit SC4S/file-monitor transport handoff plus data evidence is the completion gate.