Copyright (c) 2017 by Cisco Systems, Inc.
ALL RIGHTS RESERVED. THESE SOURCE FILES ARE THE SOLE PROPERTY
OF CISCO SYSTEMS, Inc. AND CONTAIN CONFIDENTIAL AND PROPRIETARY
INFORMATION. REPRODUCTION OR DUPLICATION BY ANY MEANS OF ANY
PORTION OF THIS SOFTWARE WITHOUT PRIOR WRITTEN CONSENT OF
CISCO SYSTEMS, Inc. IS STRICTLY PROHIBITED.
The Cisco eStreamer client.
The Cisco Event Streamer (also known as eStreamer) allows you to stream System intrusion, discovery, and connection data from Firepower Management Center or managed device (also referred to as the eStreamer server) to external client applications.
eStreamer responds to client requests with terse, compact, binary encoded messages – this keeps it fast.
eNcore is a new all-purpose client which requests all possible events from eStreamer, parses the binary content and outputs events in various formats to support other SIEMs.
This is a beta version of eNcore. Before the General Availability release this will be updated with details of paying for and receiving support.
Detailed setup instructions for the CLI are included here, the specific implementation correspondences to Microsoft Sentinel integration but the CLI is the same setup https://www.cisco.com/c/en/us/td/docs/security/firepower/70/api/eNcore/eNcore_Operations_Guide_v08.html
The 4.x branches of this project correspond to Python3 support, files use the future library as well as python3 executable, you may have to import the python3 equivalent of pip for openssl support
- Run eNcore:
./encore.sh - Run a connectivity test:
./encore.sh test(and enter the pkcs12 password) - View the log output
tail -f estreamer.log ./encore.sh foreground- run in the foreground./encore.sh start- starts a background task./encore.sh stop- this will stop the background task./encore.sh restart- this will restart the background task
