Logs Endpoint is available?

[vamsi-mutyala]

is there any endpoint available to fetch the security events those starts with 4..series and 3 series 

sample:

Dec 9 12:54:40 NS-C200-01 : %FTD-1-430004: DeviceUUID: 04398cda-7a-11f0-8e6a-ff11d6d055ee, InstanceID: 2, FirstPacketSecond: 2025-12-09T12:54:39Z, ConnectionID: 36995, SrcIP: 192.168.50.61, DstIP: 199.23.214.12, SrcPort: 63149, DstPort: 80, Protocol: tcp, FileDirection: Download, FileAction: Invalid ID, FileName: am_delta_patch_1.441.22.0_7ce4d40c58f4be02114ecdb36027ef2481224d7.exe, FileType: MSEXE, ApplicationProtocol: HTTP, Client: Web browser, WebApplication: Microsoft Update, FilePolicy: NS-File-Policy, FileSandboxStatus: File Size Is Too Small, URI: /d/msdownload/update/software/defu/2025/12/am_delta_patch_1.441.822.0_7ce4d40c581f4be02114ecdb36027ef2481224d7.exe, IngressVRF: Global, EgressVRF: Global
Dec 9 12:55:20 ec2-44-28-88-222.us-west-2.compute.amazonaws.com : Dec 09 12:55:20 UTC: %FTD-session-6-302021: Teardown ICMP connection for faddr ff2::1/0 gaddr fe8::f4:3fff:e23:e17d/0 laddr fe8::f4:3ff:fe23:e1d/0 type 134 code 0

[bigevilbeard]

@vamsi-mutyala what platform is this for and do you mean an API call?

[vamsi-mutyala]

@bigevilbeard We're building an application where we will show the logs in UI by connecting to cisco ftd. Yes, is there any API available to pull the logs?

[bigevilbeard]

Maybe this one? https://developer.cisco.com/docs/ftd-api-reference-v6-ftd-v7-0/getcustomlogginglist/ 

[vamsi-mutyala]

No, we need an API that will pull the syslogs from cisco FTD. is it possible?

sample:

Dec 9 12:54:40 NS-C200-01 : %FTD-1-430004: DeviceUUID: 04398cda-7a-11f0-8e6a-ff11d6d055ee, InstanceID: 2, FirstPacketSecond: 2025-12-09T12:54:39Z, ConnectionID: 36995, SrcIP: 192.168.50.61, DstIP: 199.23.214.12, SrcPort: 63149, DstPort: 80, Protocol: tcp, FileDirection: Download, FileAction: Invalid ID, FileName: am_delta_patch_1.441.22.0_7ce4d40c58f4be02114ecdb36027ef2481224d7.exe, FileType: MSEXE, ApplicationProtocol: HTTP, Client: Web browser, WebApplication: Microsoft Update, FilePolicy: NS-File-Policy, FileSandboxStatus: File Size Is Too Small, URI: /d/msdownload/update/software/defu/2025/12/am_delta_patch_1.441.822.0_7ce4d40c581f4be02114ecdb36027ef2481224d7.exe, IngressVRF: Global, EgressVRF: Global
Dec 9 12:55:20 ec2-44-28-88-222.us-west-2.compute.amazonaws.com : Dec 09 12:55:20 UTC: %FTD-session-6-302021: Teardown ICMP connection for faddr ff2::1/0 gaddr fe8::f4:3fff:e23:e17d/0 laddr fe8::f4:3ff:fe23:e1d/0 type 134 code 0

[bigevilbeard]

There is not many for syslog so i see, https://developer.cisco.com/docs/ftd-api-reference-v4-ftd-v6-5-/datasyslogserverlogging/ the others appear to be to create a syslog

[vamsi-mutyala]

that means no API available to fetch the logs?

[bigevilbeard]

@vamsi-mutyala If I’m reading the docs right yeah.. might be worth contacting tac or your Cisco AM to see your options, if this is on the road map or an unpublished api.