topic Secure network analtics syslog in Security Analytics

Secure network analtics syslog

AAA184 — Fri, 23 Jan 2026 21:08:16 GMT

can cisco secure network analytics use firewall syslog ingested from telemetry broker for analysis. and how can i configure SNA to receive syslog?

Re: Secure network analtics syslog

Cristian Matei — Sun, 25 Jan 2026 19:43:56 GMT

Hi,

@AAA184 Check page 26 on following document:

https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/proxy/7_5_1_Proxy_Log_Configuration_Guide_DV_1_0.pdf

Thanks,

Cristian.

Re: Secure network analtics syslog

kegunner — Mon, 26 Jan 2026 08:34:06 GMT

Hi,
Yes SNA can ingest syslog from firewalls via CTB if using SNA with datastore. Create the rule in CTB to forward SAL using UDP/8514.
On your FlowCollector, access the appliance administration interface, head to Support, Advanced Settings and ensure that:
sal_syslog_port = 8514
sal_to_flow_cache = 1