I just wanted to check what the best practises are with logging against access control policy rules, specifically logging at the beginning of a connection vs logging at the end of a connection? I know that its not recommend to log both beginning and the end to reduce the number of connection events.
I also understand that blocked rules should log at the beginning of a connection as there is no end connection, however, with trust and allowed rules that we use (and that we need to log for compliance reasons) is there a preference to use one over the other?
Logging at the end of connection will give more information about the connection. Don't know if there is a best practices except the one you wrote, not to log both. As the FMC event logging rotates fast I would try to log as little as possible in the connection event just for troubleshooting purposes and use external logging for archive. Read somewhere that maybe disable logging for DNS request if that is not important for you, as DNS pretty log heavy.
What is SecureX?
Cisco SecureX is included with all Secure Endpoint (formerly AMP for Endpoints) subscriptions. SecureX is a cloud-native platform that aggregates capabilities across your security environment. It’s designed to simplify your environment, ...
Cisco ISE Secure Wired Access Prescriptive Deployment Guide
Authors: Hariprasad Holla (until June 2018), Mahesh Nagireddy (until Dec 2018)
For an offline or printed copy of this document, simply choose ⋮ Options > Printer ...
Meet the Authors Slides- SecureX and the Evolution of Security Orchestration Automation and Response
(Live event – Wednesday, 20th, 2021 at 10:00 a.m. Pacific / 1:00 p.m. Eastern / 6:00 p.m. Paris)
This event had place on Wednesday 20th, January 202...
The following guide goes over the in and out of the Cisco Endpoints Security Analytics Dashboard as an overview and faq page
For more information on the product offering, licensing, support, and how to solution (TAC) guide links and more please visit the...
Join us live on Tuesday, January 19 at 10:00 am PT (and on demand after) as we discuss the latest version of ATT&CK and the expansion of TTPs in v8.
As a security expert, you are tasked with protecting your environment. You see the value of...