# Cisco AnyConnect Network Visibility Module (NVM) App for Splunk

Getting started
Data Source for Splunk
Data Model and Correlation Index
Syslog Fields

## Getting started

Cisco AnyConnect Network Visibility Module (NVM) App for Splunk is comprised of three components:

- The Splunk App with pre-designed Dashboards to visualize and view the data.
- The Splunk Add-on which provides data indexing and formatting inside Splunk Enterprise.
- The NVM Collector Component which is responsible for collecting and translating all IPFIX (nvzFlow) data from the endpoints and forwarding it to the Splunk Add-on.This is a manually installed component that runs on 64-bit Linux.

The collector needs to be configured and must be running before the Splunk App can be used. Refer to the installation guide for more information.

The Splunk App consists of the following Dasboards:

- All Categories Top 15 View - Provides a pie chart view of all 5 categories of data - Devices, Users, Applications, Locations, Destinations. The grouping is based on number of flows, total incoming bytes and total outgoing bytes at layer 4.
- Device to Destination Intersection Map - Provides a Sankey diagram mapping the top destinations to the devices that are connecting to them.
- Destination Address View - Provides a pie chart view of top 15 Destination Domains, Destination IPv4 addresses and Destination IPv6 addresses. The grouping is based on number of flows, total incoming bytes and total outgoing bytes at layer 4.
- Source and Destination Ports View - Provides a pie chart view of top 15 Source and Destination Ports. The grouping is based on number of flows, total incoming bytes and total outgoing bytes at layer 4.
- Locations View - Provides a pie chart view of top 15 DNS Suffix Addresses from where network traffic has been generated. The grouping is based on number of flows, total incoming bytes and total outgoing bytes at layer 4. The view also allows you to drilldown to visualize a list of destination domains reached from a Location as both a bar chart and Sankey diagram.
- Devices View - Provides a pie chart view of top 15 Devices generating network traffic. The grouping is based on number of flows, total incoming bytes and total outgoing bytes at layer 4. The view also allows you to drilldown to visualize a list of destination domains reached from a Device as both a bar chart and a Sankey diagram.
- Applications View - Provides a pie chart view of top 15 Applications generating network traffic. The grouping is based on number of flows, total incoming bytes and total outgoing bytes at layer 4. The view also allows you to drilldown to visualize a list of destination domains reached from an Application as both a bar chart and a Sankey diagram.
- Users View - Provides a pie chart view of top 15 logged in Users in the Network. The grouping is based on number of flows, total incoming bytes and total outgoing bytes at layer 4. The view also allows you to drilldown to visualize a list of destination domains reached by a User as both a bar chart and a Sankey diagram.
- Process Accounts Info - Provides a list of fully Qualified domain names of all User accounts under whose context Applications have generated network traffic. This view also allows you to drilldown to obtain more information about the Applications executed by that user.
- Process Listing - Provides a list of All Applications generating network traffic. The view also allows you to drilldown to obtain more information on the different versions of the Application available on the network and the destinations reached by the Application.
- Process Usage View - Provides a pie chart view of top 15 Applications in the network. The view also allows you to drilldown to obtain greater detail on a selected application.
- Logged In Users Info - Provides a list of All Logged-In Users on the Network. You can also drilldown on any row to obtain Device, Locations and Destinations of that User.
- DNS Suffix Addresses Info - Provides a list of DNS Suffix Addresses from where Users have accessed the network. Selecting a particular row allows you to obtain the list of Devices from a given DNS Suffix Address.
- Network Interfaces - Summarizes flows based on client interface type, SSID, and trusted network state.

## Data Source for Splunk

The Splunk Add-on is configured to receive continuous stream of UDP data in the form of Syslog on 3 ports - 20519, 20520, and 20521.

The collector receives the IPFIX data and translates that to 3 syslog data formats.

- Network Flow Data

Splunk sourcetype = cisco:nvm:flowdata

The Network Flow Data consists of flow information from every endpoint in the network.
A sample Flow Data syslog entry would look like this:
fv=nvzFlow_v3 fss='unknown' fes='unknown' liuid=Work-Mac\boris sa=10.1.1.2 da=54.225.176.53 sa6= da6= sp=67 dp=68 ibc=304 obc=0 pr=17 pap=root paa=Work-Mac pa=Work-Mac\root pn='configd' ph=2B11A34A89CDA70DC8DDD9B9ECE431828799D28FCBE7FB1485CA47E5976BA0C2 udid=E1EBB2667A8D48F5D04F28AB41E24D1DE7541BF9 ppap=root ppaa=Work-Mac ppa=Work-Mac\root ppn='launchd' pph=6A18C33DBCD8E681878F19990276D1554D2D2A6C1FDB074627ABAA79D32885D3 ds=acme.com dh=www.netflix.com

- Endpoint Data

Splunk sourcetype = cisco:nvm:sysdata

The Endpoint flow data provides information associated with every device in the network.
A sample Endpoint syslog entry would look like this:
fv=nvzFlow_v3 udid=6F8FB6208DE57D9FCFEE53DEF639CE54B5459D72 vsn=JaneDoe-Win-PC osn=WinNT osv=6.1.7601 sm=VMware, Inc. st=x86

- Interface Info Data

Splunk sourcetype = cisco:nvm:ifdata

The Interface Info flow data provides information associated with each network interface on an endpoint. Any changes to the attributes of an interface will trigger the sending of a new record.
A sample Interface Info syslog entry would look like this:
fv=nvzFlow_v3 udid=E1EBB2667A8D48F5D04F28AB41E24D1DE7541BF9 iid=27 ii=5 it=2 in='en1' ssid='ACMECORP' ist='Trusted' im="7c:d1:c3:72:2a:58"

For more infomation on the various fields in the above sample syslog entries, refer to the section "Syslog Fields".

## Data Model and Correlation Index

The following diagram depicts the relationship between the three data sources, Per Flow, Endpoint Identity, and Interface Info. The UDID field is used as a means of correlating records between these sources.

The 3 syslog data sources are correlated by one field - udid or the Unique Identifier associated with the device. The InterfaceInfoUDID field can be used to correlate a Per Flow record with an Interface Info record to obtain details on that specific interface.

## Syslog Fields

Search Key | Key Name | Key Description
udid | UDID | unique identifier for each end point in the network. This is used to correlate records back to a single source. Note that this matches the same value sent by AnyConnect VPN to an ASA. |
liuid | LoggedInUser | The logged in username, in the form Authority\Principle, on the endpoint from which the network flow is generated. |
liuida | LoggedInUserAuthority | The Authority portion of the logged in username on the endpoint from which the network flow is generated. |
liuidp | LoggedInUserPrinciple | The Principle portion of the logged in username on the endpoint from which the network flow is generated. |
fss | StartSeconds | Time stamp of when the network flow was initiated by the endpoint. |
fes | EndSeconds | Time stamp of when the network flow was completed by the endpoint. |
osn | OSName | Name of the Operating System on the endpoint (e.g. WinNT). Note that this matches the same value sent by AnyConnect VPN to an ASA. |
osv | OSVersion | Version of the operating system on the endpoint(e.g. 6.1.7601). Note that this matches the same value sent by AnyConnect VPN to an ASA. |
vsn | VirtualStationName | Device name configured on the endpoint (e.g. Boris-Macbook). |
sm | SystemManufacturer | Endpoint Manufacturer (e.g. Lenovo, Apple, etc.). |
st | SystemType | Endpoint Type (e.g. x86, x64). |
sa | SourceIPv4Address | IPv4 address of the interface from where the flow was generated on the endpoint. |
da | DestinationIPv4Address | IPv4 address of the destination to where the flow was generated from the endpoint. |
sa6 | SourceIPv6Address | IPv6 address of the interface from where the flow was generated on the endpoint. |
da6 | DestinationIPv6Address | IPv6 address of the destination to where the flow was generated from the endpoint. |
sp | SourceTransportPort | Source port number from where the flow was generated on the endpoint. |
dp | DestinationTransportPort | Destination Port number to where the flow was generated from the endpoint. |
ibc | InBytesCount | The total number of Bytes downladed during a given flow on the endpoint at layer 4, not including L4 headers. |
obc | OutBytesCount | The total number of Bytes uploaded during a given flow on the endpoint at layer 4, not including L4 headers. |
pr | ProtocolIdentifier | Network Protocol number associated with each flow. For now we only support TCP (6) and UDP(17). |
ph | ProcessHash | Unique SHA256 hash for the executable generating the Network Flow on the endpoint. |
pa | ProcessAccount | The fully qualified account, in the form Authority\Principle, under whose context the application generating the Network Flow on the endpoint was executed. |
pap | ProcessAccountPrinciple | The Principle portion of the fully qualified account under whose context the application generating the Network Flow on the endpoint was executed. |
paa | ProcessAccountAuthority | The Authority portion of the fully qualified account under whose context the application generating the Network Flow on the endpoint was executed. |
pn | ProcessName | Name of the executable generating the Network Flow on the endpoint. |
pph | ParentProcessHash | Unique SHA256 hash for the executable of the parent process of the application generating the Network Flow on the endpoint. |
ppa | ParentProcessAccount | The fully qualified account, in the form Authority\Principle, under whose context the parent process of the application generating the Network Flow on the endpoint was executed. |
ppap | ParentProcessAccountPrinciple | The Principle portion of the fully qualified account under whose context the parent process of the application generating the Network Flow on the endpoint was executed. |
ppaa | ParentProcessAccountAuthority | The Authority portion of the fully qualified account under whose context the parent process of the application generating the Network Flow on the endpoint was executed. |
ppn | ParentProcessName | Name of the parent process of the application generating the Network Flow on the endpoint. |
ds | FlowDNSSuffix | The DNS suffix configured on the network to which the user was connected to when the network flow was generated on the endpoint. |
dh | FlowDestinationHostName | The Destination Domain of the Destination Address to where the network flow was sent to from the endpoint. |
fv | FlowVersion | Network Visibility Flow (nvzFlow) version sent by the client. |
mnl | ModuleNameList | List of 0 or more names of the modules hosted by the process that generated the flow. This can include the main DLLs in common containers such as dllhost, svchost, rundll32, etc. It can also contain other hosted components such as the name of the jar file in a JVM. |
mhl | ModuleHashList | List of 0 or more SHA256 hashes of the modules associated with the nvzFlowModuleNameList |
iit | InterfaceInfoUID | Unique ID for an interface meta-data. Should be used to lookup the interface meta-data from the InterfaceInfo records. |
ii | InterfaceIndex | The index of the Network interface as reported by the OS. |
it | InterfaceType | Interface Type, such as Wired, Wireless, Cellular, VPN, Tunneled, Bluetooth, etc. Enumeration of network types, defined by this spec. |
in | InterfaceName | Network Interface/Adapter name as reported by the OS |
id | InterfaceDetailsList | List of name value pair (delimited by ‘=') of other interface attributes of interest. E.g., SSID=internet. |
im | InterfaceMacAddress | Mac address of the interface. |
liuat | LoggedInUserAccountType | Account type of the logged-in user. As per the enumeration of AccountType, defined by this spec. |
puat | ProcessAccountType | Account type of the process account. As per the enumeration of AccountType, defined by this spec. |
ppuat | ParentProcessAccountType | Account type of the parent-process account. As per the enumeration of AccountType, defined by this spec. |