topic Re: firepower log collect in Network Security

firepower log collect

ssrinidhi — Mon, 01 Aug 2022 06:26:21 GMT

I there option to collect firepower logs in a readable format(json/xml) rather than using estreamer. Or can we do it using proxy

Re: firepower log collect

Marius Gunnerud — Mon, 01 Aug 2022 09:05:54 GMT

Estreamer is the way to go here, and have a client that fetches the logs from the estreamer server and parse it into JSON.

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/215631-understand-estreamer-and-troubleshoot-en.html

Re: firepower log collect

ssrinidhi — Mon, 01 Aug 2022 09:14:12 GMT

thank you @Marius Gunnerud , also what is the format does the estreamer return the logs, is there a role that proxy server could play to get the data in readable format

Re: firepower log collect

Marius Gunnerud — Tue, 02 Aug 2022 06:54:36 GMT

I have not dived that deep into estreamer, but according to the documentation it uses UTF-8

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/api/eStreamer/EventStreamerIntegrationGuide_660.pdf