04-02-2020 01:09 AM
In the event of a network breach, for example someones device is hacked while on the network, I have been asked to identify what logging we have in place to trace whats happened.
What is required is logging that shows all traffic that passes through the ASA to and from a device on the network so anything malicious can be traced.
Currently we log level4 to syslog.
Can this be done with Syslogs or as I suspect we would need something like netflow.
04-02-2020 01:57 AM
I guess it depends on how the ASA is configured for threat detection -
04-02-2020 03:00 PM
@sprocket10 wrote:
Currently we log level4 to syslog.
A lot of the "big hitters" APT (and their scripts) look for syslog server(s) and delete the files found inside.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide