I have a small question about Firepower
My customer has some attack event last week. He wants us to export the Sourcefire logs that generate last week for them to analyze. They will import it to a new SIEM.
They don’t have any syslog server in their environment.
Do you know how to export all the intrusion events or connection events from FMC?
Go to Solution.
I don't think there is a way to pull existing data out in any format for import into another tool.
You will have to just use FMC for analysis of the existing data, and start sending syslog data to the SIEM from this point forward.
View solution in original post
In addition to what Ryan mentioned since we cannot export the logs into external tool. FMC does have the option of context explorer which give consolidated time line of what events took place for specific IP address.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: