topic Re: FireSight logs in Network Security

FireSight logs

kashifglobal12 — Tue, 12 Mar 2019 13:53:02 GMT

Hello All,

I have one fmc on which 5 sourcefire is added. My question is how many logs can fmc Store from each sourcefire. And if we have external syslog server which retrieve logs from fmc does this effect reporting on fmc because all the events like user activity, malware and etc will be maintain in external syslog server?

Thank you....

Re: FireSight logs

mikael.lahtela — Wed, 15 Aug 2018 21:43:56 GMT

Hi,

FMC has a shared database for different logging.
You can find the number of event logged under System>Configuration>Database.
Here you can find the limitations:
https://www.cisco.com/c/en/us/products/collateral/security/firesight-management-center/datasheet-c78-736775.html?cachemode=refresh

Not sure about what you are thinking about the syslog vs reporting, can you elaborate on that?

br, Mikael

Re: FireSight logs

kashifglobal12 — Fri, 17 Aug 2018 07:51:44 GMT

Hi Mikael,

What i thinking is that fmc make reports(Dashboard, overview) on basis of
logs created as events. right ! So if we maintain logs or events on
external syslog server will this effect reporting or dashboard information
because logs are maintaining not on fmc but on external syslog server?

Re: FireSight logs

mikael.lahtela — Sat, 18 Aug 2018 22:23:51 GMT

Hi,

The reports will only show what is logged in the fmc database.
It will not keep track on what has been sent to an external syslog.

br, Mikael