FirePower Threat Defense Real time log viewer

[jackk.rayen]

Hi,

In cisco ASDM tool we have a section for real time monitoring the traffic which flow on our device ( monitoring > logging > real time log viewer) in this tab we can monitor all network activity and flow creation and teardown  but when we installed FirePower Threat Defense software and add it on Cisco FMC , actually we lost this real time monitoring ,  How we can monitor real time log int FMC ? Is there any option on FMC for real time Log viewer just ASA ASDM?

thanks

[James_1]

When your in the Events window. Click on "Edit search". Then in General Information Type "Block" in the Action field.
Then Click "Search". That'll show you all the Blocks that are being logged.

 

 

[AViftrup]

You bumped an old topic.

However since the creation of this topic, things has changed. In recent releases (7.0+ or 7.1+) Unified Events was introduced with the function "Live View" which essentially is a real-time logging (there is a minor delay, but its a few seconds in worst case)
This still requires logging at start of end of connection to be present and forwarded for the FMC events of course.

[James_1]

I responded to a question from CiscoPurpleBelt  from earlier today.....

However since you brought it up, could you kindly point us in the right direction with some links?

I found some links about the Live View.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/710/management-center-admin-71/analysis-unified-events.html