topic FMA and FTD logs need s to send in CEF Format in Network Security

FMA and FTD logs need s to send in CEF Format

Shine Sudheesh — Mon, 17 Apr 2023 06:30:20 GMT

Dear All ,

We have a requirement to send the FTD and FMC syslog in CEF format. Is it supported by FTD??

Please let me know how we can configure if its supported for FMC/FTD.

FMC and FTD Version:7.0.5

Br,

Shine Sudheesh

Re: FMA and FTD logs need s to send in CEF Format

Mark Elsen — Mon, 17 Apr 2023 06:38:48 GMT

- Check available command options when configuring a syslog server through the CLI :
logging host <syslog_server_IP_address> ?

Re: FMA and FTD logs need s to send in CEF Format

Shine Sudheesh — Mon, 17 Apr 2023 12:24:18 GMT

Dear Marce ,

Thanks for your reply.

But this is for FTD and FMC.

Cant get in to config mode on cli.

Br,

Shine Sudheesh

Re: FMA and FTD logs need s to send in CEF Format

Marvin Rhoads — Mon, 17 Apr 2023 13:37:43 GMT

Common Event Format (CEF) is not currently supported by Cisco FTD firewalls or FMC.

Re: FMA and FTD logs need s to send in CEF Format

MHM Cisco World — Mon, 17 Apr 2023 13:46:31 GMT

Cisco Firepower 6 Arc Sight CEF Integration Guide 2020 - Micro Focus Common Event Format Integration - Studocu

check this link

Re: FMA and FTD logs need s to send in CEF Format

Marvin Rhoads — Mon, 17 Apr 2023 15:03:05 GMT

That's interesting @MHM Cisco World . It appears that, under the covers, eStreamer uses CEF. At least that's how I read that guide.

Re: FMA and FTD logs need s to send in CEF Format

sean.torgerson@doj.state.or.us — Thu, 14 Dec 2023 22:14:34 GMT

Yes, you can get CEF formatted logs out of the FMC using the eStreamer integration, but you have to use an external third party python script (eStreamer encore) to PULL the logs from the FMC and the estreamer is what is doing the formatting. It would be much better if we could just natively send from the FMC or FTD in CEF format (PUSH).