A SOC wants data from several Cisco security products, such as Secure Firewall, Secure Endpoint and Duo, brought into Splunk through one Cisco-supported integration that also provides ready-made dashboards for those products. Which approach fits best?
Select an answer to reveal the explanation.
Short Explanation
Why wire six separate plugs when there's a power strip built for the job? The Cisco Security Cloud app gives you one place to set up inputs for multiple Cisco products, with dashboards included. The trap is the do-it-yourself route — it works, but it isn't the single supported integration the stem asks for.
Full Explanation
The Cisco Security Cloud app on Splunkbase is a Cisco-supported integration that consolidates data collection for many Cisco security products, including Cisco Secure Firewall, Secure Endpoint, Duo, Secure Malware Analytics, Email Threat Defense and Cisco XDR. Administrators install the app, then configure an input for each product, supplying the API credentials or connection details that product requires, and the app normalizes the data and provides dashboards and health monitoring for the integrations. That meets both requirements: one supported integration and prebuilt visibility. Building a custom HTTP Event Collector token per product and designing dashboards manually can ingest data, but it is neither a single integration nor ready-made, and it leaves parsing and maintenance to the SOC. Sending everything to one syslog input under a shared sourcetype relies on automatic search-time extraction, which produces inconsistent fields, no CIM mapping and no product dashboards. Exporting XDR incidents as a weekly CSV lookup moves a small summary, late, and does not ingest the products' event data at all. Exam caveat: the app replaced several older per-product Splunk apps, so expect it to be the answer when the stem stresses one Cisco-supported integration. Operational check: open the app, confirm each configured product input shows a healthy status, and verify events from each product appear in the expected index.