topic How to check Snort events/logs in FTD/FMC? in Network Security

How to check Snort events/logs in FTD/FMC?

PacketSpartan — Wed, 01 Feb 2023 11:16:03 GMT

Hi All

Is there a way to check the Snort events/logs on the SFR or on the FMC?

We need to rule out our Firepower module for a recent outage

Thank you in advance

Re: How to check Snort events/logs in FTD/FMC?

MHM Cisco World — Wed, 01 Feb 2023 12:13:47 GMT

https://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/200328-Configure-Logging-in-Firepower-Module-fo.html

Re: How to check Snort events/logs in FTD/FMC?

PacketSpartan — Wed, 01 Feb 2023 12:02:10 GMT

This is not a valid link, it just takes me back to my own post

Could you give me the link again please

Re: How to check Snort events/logs in FTD/FMC?

MHM Cisco World — Wed, 01 Feb 2023 12:14:16 GMT

sorry typo, I correct it

Re: How to check Snort events/logs in FTD/FMC?

Marvin Rhoads — Wed, 01 Feb 2023 15:14:42 GMT

If you are using FMC and have enabled the policy rules to "send connection events to FMC", then you can check the Analysis > Connection Events or Security Intelligence Events views.

Note that connection events often fill up the allocated space in the database and older events age out - often in less than a day depending on your environment.

Using an external log server can alleviate this - the link shared by @MHM Cisco World provides more detail on that. (But obviously it won't help you for anything that's past already.)