Cisco Security Manager - worthwhile software?

[katenecon58]

Company has HA 5525 ASAs and a large wireless network with Prime. Monitoring is not so good; Solarwinds that is poorly licensed and configured. A number of times issues have gone unknown for a while because we do not have a good alerting system. Could CSM be a solution for the security side of things?

[balaji.bandi]

CSM will help you retain Logs for historical logs you want to view, ASA  itself going end of Life soon or later, is it worth investing on  CSM at this stage, this is business call.

https://www.cisco.com/c/en/us/td/docs/security/security_management/cisco_security_manager/security_manager/4-7/user/guide/CSMUserGuide/evntchap.html#152083

Personally - I setup an SYSLOG Server and offload all the logs from ASA to SYSLOG Server - there are many tools available for how you can view the logs ( you can use Graylog)  free and open source.  which can be used for any other logs to store not only ASA.

not sure is this make sense for your requirement? feedback if that not meet your requirements to consider other options.

[ToucanzooX]

In my opinion CSM has had its day and I rarely see any customers using it now.  The times I have seen it there were challenges with getting the software and licensing.

I agree with your comment that offload the logging.  I have configured a syslog server on CentOS so many times for this very purpose.

Maybe you should look at CDO.

[AlexTomatos34833]

Thanks for the link "https://www.cisco.com/c/en/us/td/docs/security/security_management/cisco_security_manager/security_manager/4-7/user/guide/CSMUserGuide/evntchap.html#152083", it is really interesting

[Marvin Rhoads]

Cisco Defense Orchestrator (CDO) with Cisco Security Analytics and Logging (SAL) is a good option. It can manage your ASAs as well as Firepower appliances with FTD. It doesn't do Firepower service modules and a few more advanced features, but otherwise it is very simple to use and adds a lot of utility.

[ameliascotts80938]

Cisco Security Manager helps to enable consistent policy enforcement and rapid troubleshooting of security events, offering summarized reports across the security deployment. Using its centralized interface, organizations can scale efficiently and manage a wide range of Cisco security devices with improved visibility.