cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

7255
Views
12
Helpful
2
Replies
Highlighted
Beginner

How to export logs from FMC.

I have a small question about Firepower

My customer has some attack event last week. He wants us to export the Sourcefire logs that generate last week for them to analyze. They will import it to a new SIEM.

They don’t have any syslog server in their environment.

Do you know how to export all the intrusion events or connection events from FMC?

Brian Li

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Contributor

I don't think there is a way to pull existing data out in any format for import into another tool.

You will have to just use FMC for analysis of the existing data, and start sending syslog data to the SIEM from this point forward.

Ryan

View solution in original post

2 REPLIES 2
Highlighted
Contributor

I don't think there is a way to pull existing data out in any format for import into another tool.

You will have to just use FMC for analysis of the existing data, and start sending syslog data to the SIEM from this point forward.

Ryan

View solution in original post

Highlighted
Cisco Employee

Hi Brian,

In addition to what Ryan mentioned since we cannot export the logs into external tool. FMC does have the option of context explorer which give consolidated time line of what events took place for specific IP address.

Raghu

Content for Community-Ad