topic Re: FMC and Sensor to External Syslog in Network Security

FMC and Sensor to External Syslog

fatalXerror — Fri, 21 Feb 2020 14:33:41 GMT

Hi Experts,

I want to know if it is possible to send intrusion and malware events to multiple syslog servers in firepower IPS?

How to do it if possible? If not, what are the workaround?

Thanks

Re: FMC and Sensor to External Syslog

Marvin Rhoads — Tue, 24 Oct 2017 16:19:37 GMT

Only a single syslog server is currently supported.

If your remote systems support it, you can use eStreamer and send to multiple subscribers.

https://www.cisco.com/c/en/us/td/docs/security/firepower/622/configuration/guide/fpmc-config-guide-v622/host_identity_sources.html#ID-2219-000004b0

Re: FMC and Sensor to External Syslog

fatalXerror — Wed, 25 Oct 2017 01:15:47 GMT

thanks Marvin for you feedack but may I know what is the difference between the logging configured in the following,

1. Intrusion Policy > Advanced Settings

2. Policies > Action > Alerts

3. Access Control Rule Logging option

Re: FMC and Sensor to External Syslog

Marvin Rhoads — Wed, 25 Oct 2017 09:37:34 GMT

Each of those sections of the FMC configuration has the option for enabling logging to system log (syslog) facilities (which is separately defined per the global definition of a single syslog server).

Depending on your requirements you may decide to configure none, some or all of them to send syslog messages.

The system works fine without them - using an external syslog is usually done to satisfy a need to have long term audit data, retain information for forensic analysis or to meet a regulatory, legal or other such requirement.

Re: FMC and Sensor to External Syslog

ciscokapajoeen — Thu, 30 Nov 2017 21:30:17 GMT

Hello Marvin,

What the recommended setup of the Syslog on the maanged FTD devices.

Patrice

Re: FMC and Sensor to External Syslog

Marvin Rhoads — Fri, 01 Dec 2017 02:03:04 GMT

I've never seen a Cisco recommendation on what SHOULD be setup - they leave it to the user discretion and simply specify HOW to set it up should the client need it.

As I mentioned earlier, it generally depends on the client's purpose for doing it in the first place. I'd say the most common use case is for integration with an enterprise logging/correlation tool like Splunk or a similar product. Enterprises using that sort of toolset typically have their own requirement set which would guide what messages are desired or required.

Re: FMC and Sensor to External Syslog

sathish.cco — Fri, 14 Sep 2018 07:12:08 GMT

Hi,
when the external logging is configured for event logs, does the NIPS/sensor sends the logs directly to the syslog server OR the logs can go only via FMC to the syslog ?

Thanks

Re: FMC and Sensor to External Syslog

Marvin Rhoads — Fri, 14 Sep 2018 08:24:47 GMT

The sensor will send the syslog messages from its eventing interface (normally the same as the management address unless you've changed it).

I just confirmed by setting it up on my lab and capturing the incoming packets on the destination syslog server.

Re: FMC and Sensor to External Syslog

mdkhanimran_ccna — Thu, 28 Mar 2019 12:05:55 GMT

Hi Marvin, I am facing some issues in logging to SIEM tool.

The logging levels which are available, are they similar to ASA, like if I choose Info (which is 6), will all the low level logs be forwarded to SIEM. (i.e. from 1 to 6)

I have enabled logging from all 3 options, under policies and alerts, from ACP logging option, Intrusion policy logging options as well. But still I have logs/ events missing, that are not getting forwarded to SIEM.

Regards,

Imran.

Re: FMC and Sensor to External Syslog

Marvin Rhoads — Thu, 28 Mar 2019 14:42:29 GMT

Are there some specific events you can cite that don't seem to be making it to your SIEM?

Note for FMC itself (vs the sensors) you setup its logging under System > Configuration > Audit Log

Re: FMC and Sensor to External Syslog

mdkhanimran_ccna — Sun, 31 Mar 2019 04:06:40 GMT

Hi Marvin, thank u for responding.

No, I am not looking for audit logs/ FMC system /Management user logs.

One of the example is, that on FMC Intrusion events are fired based on URL SI categories, which I am not getting over SIEM.

Although I have logging enabled for SI.

Regards,

Imran.

Re: FMC and Sensor to External Syslog

RF99TJ — Fri, 18 Aug 2023 15:29:55 GMT

Did this fall off the boat?