https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4113773#M1071730 <P>This is already done, we are receiving syslogs from FTD devices, but they do not contain the users who performed the changes.</P><P>&nbsp;</P><P>We are after the policy changes on FTD devices, performed through FMC, containing usernames.</P> Mon, 06 Jul 2020 07:52:31 GMT borutlape 2020-07-06T07:52:31Z https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4112900#M1071667 <P>Hi,</P><P>&nbsp;</P><P>we need to collect&nbsp;FTD configuration changes logs in SIEM, which are mainly performed via FMC.<BR />On ASA we are just collecting 111010 syslog messages, but&nbsp;on FTD's no 111010 messages are sent, only 111008 and in each log the username is&nbsp;enable_1.</P><P>We enabled "Send Audit Log to Syslog" in FMC, but no configuration changes details are sent, only "Login/Logout, Page view, Save policy, Deploy policy".</P><P>&nbsp;</P><P>Any suggestions?</P><P>&nbsp;</P><P>Regards,<BR />Borut</P><P>&nbsp;</P> Fri, 03 Jul 2020 10:35:07 GMT https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4112900#M1071667 borutlape 2020-07-03T10:35:07Z https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4113096#M1071676 <P>is this make sense to send policy Logs to Syslog server or you looking after policy push from FMC to FTD?</P> <P>&nbsp;</P> <P>here is some config I do with Tuffin hope this help you.</P> <P>&nbsp;</P> <P><A href="https://forum.tufin.com/support/kc/latest/Content/Suite/12108.htm" target="_blank">https://forum.tufin.com/support/kc/latest/Content/Suite/12108.htm</A></P> <P>&nbsp;</P> Fri, 03 Jul 2020 18:14:16 GMT https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4113096#M1071676 balaji.bandi 2020-07-03T18:14:16Z https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4113773#M1071730 <P>This is already done, we are receiving syslogs from FTD devices, but they do not contain the users who performed the changes.</P><P>&nbsp;</P><P>We are after the policy changes on FTD devices, performed through FMC, containing usernames.</P> Mon, 06 Jul 2020 07:52:31 GMT https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4113773#M1071730 borutlape 2020-07-06T07:52:31Z https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4114139#M1071760 <P>how about configuring FMC</P> <P>&nbsp;</P> <P>system --&gt; audit log --- <SPAN>Send Audit Log to Syslog</SPAN></P> Mon, 06 Jul 2020 19:09:42 GMT https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4114139#M1071760 balaji.bandi 2020-07-06T19:09:42Z https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4114430#M1071776 <P>Already done that, as stated in the initial post, but no configuration details there, only Login/Logout, Page accessed...</P> Tue, 07 Jul 2020 08:03:51 GMT https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4114430#M1071776 borutlape 2020-07-07T08:03:51Z https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4114709#M1071793 <P>Can you post the screenshot which was configured.</P> Tue, 07 Jul 2020 16:41:27 GMT https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4114709#M1071793 balaji.bandi 2020-07-07T16:41:27Z https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4115268#M1071836 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Audit Log.PNG" style="width: 721px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/78559iC7701DFDC2E6BAA8/image-size/large?v=v2&amp;px=999" role="button" title="Audit Log.PNG" alt="Audit Log.PNG" /></span></P> Wed, 08 Jul 2020 12:03:12 GMT https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4115268#M1071836 borutlape 2020-07-08T12:03:12Z https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4664771#M1092467 <P>Hi,</P> <P>I have the same need and the same limitation but with Firepower 7.0 version.</P> <P>Do you have any update?</P> <P>Regards</P> <P>Marco</P> Sat, 06 Aug 2022 08:11:20 GMT https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4664771#M1092467 bergonzoni 2022-08-06T08:11:20Z https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4665595#M1092480 <P>Hi Marco,</P><P>Unfortunately, no progress ☹</P><P>The only way to find who did what changes is to manually correlate audit logs from FMC (policy save/apply) and configuration logs 111008 from user “config”.</P><P>Regards,</P><P>Borut</P> Mon, 08 Aug 2022 08:53:43 GMT https://community.cisco.com/t5/network-security/collection-of-ftd-configuration-changes-in-siem/m-p/4665595#M1092480 borutlape 2022-08-08T08:53:43Z