topic Logs Endpoint is available? in DevNet General Discussions

Logs Endpoint is available?

vamsi-mutyala — Tue, 09 Dec 2025 14:35:04 GMT

is there any endpoint available to fetch the security events those starts with 4..series and 3 series

sample:

Dec 9 12:54:40 NS-C200-01 : %FTD-1-430004: DeviceUUID: 04398cda-7a-11f0-8e6a-ff11d6d055ee, InstanceID: 2, FirstPacketSecond: 2025-12-09T12:54:39Z, ConnectionID: 36995, SrcIP: 192.168.50.61, DstIP: 199.23.214.12, SrcPort: 63149, DstPort: 80, Protocol: tcp, FileDirection: Download, FileAction: Invalid ID, FileName: am_delta_patch_1.441.22.0_7ce4d40c58f4be02114ecdb36027ef2481224d7.exe, FileType: MSEXE, ApplicationProtocol: HTTP, Client: Web browser, WebApplication: Microsoft Update, FilePolicy: NS-File-Policy, FileSandboxStatus: File Size Is Too Small, URI: /d/msdownload/update/software/defu/2025/12/am_delta_patch_1.441.822.0_7ce4d40c581f4be02114ecdb36027ef2481224d7.exe, IngressVRF: Global, EgressVRF: Global
Dec 9 12:55:20 ec2-44-28-88-222.us-west-2.compute.amazonaws.com : Dec 09 12:55:20 UTC: %FTD-session-6-302021: Teardown ICMP connection for faddr ff2::1/0 gaddr fe8::f4:3fff:e23:e17d/0 laddr fe8::f4:3ff:fe23:e1d/0 type 134 code 0

Re: Logs Endpoint is available?

bigevilbeard — Tue, 09 Dec 2025 16:25:19 GMT

@vamsi-mutyala what platform is this for and do you mean an API call?

Re: Logs Endpoint is available?

vamsi-mutyala — Tue, 09 Dec 2025 16:59:03 GMT

@bigevilbeard We're building an application where we will show the logs in UI by connecting to cisco ftd. Yes, is there any API available to pull the logs?

Re: Logs Endpoint is available?

bigevilbeard — Tue, 09 Dec 2025 17:17:59 GMT

Maybe this one? https://developer.cisco.com/docs/ftd-api-reference-v6-ftd-v7-0/getcustomlogginglist/

Re: Logs Endpoint is available?

vamsi-mutyala — Wed, 10 Dec 2025 10:41:05 GMT

No, we need an API that will pull the syslogs from cisco FTD. is it possible?

sample:

Dec 9 12:54:40 NS-C200-01 : %FTD-1-430004: DeviceUUID: 04398cda-7a-11f0-8e6a-ff11d6d055ee, InstanceID: 2, FirstPacketSecond: 2025-12-09T12:54:39Z, ConnectionID: 36995, SrcIP: 192.168.50.61, DstIP: 199.23.214.12, SrcPort: 63149, DstPort: 80, Protocol: tcp, FileDirection: Download, FileAction: Invalid ID, FileName: am_delta_patch_1.441.22.0_7ce4d40c58f4be02114ecdb36027ef2481224d7.exe, FileType: MSEXE, ApplicationProtocol: HTTP, Client: Web browser, WebApplication: Microsoft Update, FilePolicy: NS-File-Policy, FileSandboxStatus: File Size Is Too Small, URI: /d/msdownload/update/software/defu/2025/12/am_delta_patch_1.441.822.0_7ce4d40c581f4be02114ecdb36027ef2481224d7.exe, IngressVRF: Global, EgressVRF: Global
Dec 9 12:55:20 ec2-44-28-88-222.us-west-2.compute.amazonaws.com : Dec 09 12:55:20 UTC: %FTD-session-6-302021: Teardown ICMP connection for faddr ff2::1/0 gaddr fe8::f4:3fff:e23:e17d/0 laddr fe8::f4:3ff:fe23:e1d/0 type 134 code 0

Re: Logs Endpoint is available?

bigevilbeard — Wed, 10 Dec 2025 12:17:21 GMT

There is not many for syslog so i see, https://developer.cisco.com/docs/ftd-api-reference-v4-ftd-v6-5-/datasyslogserverlogging/ the others appear to be to create a syslog

Re: Logs Endpoint is available?

vamsi-mutyala — Wed, 10 Dec 2025 12:19:22 GMT

that means no API available to fetch the logs?

Re: Logs Endpoint is available?

bigevilbeard — Wed, 10 Dec 2025 19:01:11 GMT

@vamsi-mutyala If I’m reading the docs right yeah.. might be worth contacting tac or your Cisco AM to see your options, if this is on the road map or an unpublished api.