How to export logs from FMC.

[lanwei Li]

I have a small question about Firepower

My customer has some attack event last week. He wants us to export the Sourcefire logs that generate last week for them to analyze. They will import it to a new SIEM.

They don’t have any syslog server in their environment.

Do you know how to export all the intrusion events or connection events from FMC?

Brian Li

[Ryan Wolfe · Accepted solution]

I don't think there is a way to pull existing data out in any format for import into another tool.

You will have to just use FMC for analysis of the existing data, and start sending syslog data to the SIEM from this point forward.

Ryan

[Raghunath Kulkarni]

Hi Brian,

In addition to what Ryan mentioned since we cannot export the logs into external tool. FMC does have the option of context explorer which give consolidated time line of what events took place for specific IP address.

Raghu