collecting ASA firewall configuration change logs through ASDM

[cyberops123]

Hi

I work in Security team and our network team is responsible with Company Firewalls .they dont really use CLI at all for configuration changes on the ASAs and I was wondering if there is a way we can receive any syslog messages or alertswhen they make changes through with ASDM .(NAT configuration changes , removing or adding ACLs , etc ... )does anyone have any idea or experience with this before ?

currently we use SIEM to collect events from ASA via syslog but it doesnt really give details about configuration changes 

Thanks 

[Mohammed al Baqari · Accepted solution]

You need to look for the flowing syslog messages.

111008

Error Message %ASA-5-111008: User *user* executed the command *string*

Explanation" The user entered any command, with the exception of a *show*
command.

Recommended Action" None required.

111010

Error Message %ASA-5-111010: User *username*, running *application-name* from
IP *ip addr*, executed*cmd*

Explanation: A user made a configuration change.

- *username* —The user making the configuration change
- *application-name* —The application that the user is running
- *ip addr* —The IP address of the management station
- *cmd* —The command that the user has executed

Recommended Action: None required.