# Cisco AnyConnect Network Visibility Module (NVM) App for Splunk

Version 2.0.187

For more information about this solution refer to the Cisco Endpoint Security Analytics for Splunk home page.

The Cisco AnyConnect Network Visibility App for Splunk allows an IT administrator to analyze and correlate user and endpoint behavior in Splunk Enterprise.
This application provides collection and reporting of enhanced IPFIX flows generated by the Cisco AnyConnect Network Visibility Module (NVM) both on and off premise.
The AnyConnect module enriches endpoint flow records with additional context such as user, device, application, location and destination information.

The Cisco AnyConnect Network Visibility Module is based on the Cisco Network Visibility Flow protocol (nvzFlow for short), which leverages standards-based IPFIX vendor extensions.
There are five key attribute collection parameters provided by The Cisco AnyConnect Network Visibility Module:

- Devices
- Users
- Applications
- Locations
- Destinations

The solution allows you to collect valuable telemetry data from endpoints running the Cisco AnyConnect Network Visibility Module (NVM) and to apply analytics and reporting
from the rich context provided by the flows.

Cisco AnyConnect Network Visibility Module (NVM) App for Splunk is comprised of three components:

- The Splunk App with pre-designed Dashboards to visualize and view the data.
- The Splunk Add-on which provides data indexing and formatting inside Splunk Enterprise.
- The NVM Collector Component which is responsible for collecting and translating all IPFIX (nvzFlow) data from the endpoints and forwarding it to the Splunk Add-on.This is a manually installed component that runs on 64-bit Linux.

The Cisco Network Visibility Flow (nvzFlow) collector / translator can be installed on a standalone 64-bit Linux system, or on the same system that Splunk is running on,
depending on system resources available. Refer to the installation guide for more details.

The sample set of Splunk reports are designed to assist enterprise IT administrators to explore the capabilities of the solution. These reports offer varying degrees
of summary information as well as drill down links to fine grain details. Reports that support drill down links will have instructional text on how to introspect further.

This application is not covered by any Cisco support contract. The application is provided as-is, for demonstration purposes, with no implied or express warranty.
Refer to the License Agreement as well as the Cisco Endpoint Security Analytics for Splunk home page for more information.

For questions regarding this application, please send an email to nvzFlow@cisco.com.