Cisco is in the process of releasing a client for collecting via eStreamer that is supported and maintained by them rather than asking their consumers to write custom client code to collect their data. This client already has a fairly rich data stream and Cisco is currently working through CEF support with the ArcSight team. It would be beneficial to support this over our own internal solution, particularly because the reference libraries do not support collection of all the data contained within the eStreamer stream (for example, X-Forwarded-For references)
by: Brandon L. | over a year ago | Integrations
Comments
https://www.cisco.com/c/en/us/td/docs/security/firepower/622/api/estreamer_encore/eStreamereNcoreOperationsGuide_30.html#_Toc497831322
Need to update our support for eStreamer to nCore for FMC. Navy is very big on cisco products and we need to stay curent with integration methods
Used ArcSight SmartConnector and Cisco's "latest" encore script to achieve this.