Hi All
I am hoping someone can help me.
I need to ensure I have logs from my FTD firewalls in my cloud delivered firewall management centre (Cisco SCC)
I am told we need the security analytics and logging licence, SAL.
When I go to event logging, I can see logged connection events.
My question is, how are we getting these if we dont have the SAL licence? are these logs as standard or ? ive blocked out our IPs in red.
In the top right corner below the black bar (just outside of your screenshot), there should be 3 buttons.
If you hover of the the middle button, it should say Event Logging insights and storage usage.
If you click it, it should tell you how much storage you have, and how much you're using.
Based on the data storage doc, you could be just using the default 90-day storage:
https://docs.defenseorchestrator.com/c_security-analytics-and-logging-event-storage.html
"By default, you receive 90 days of rolling data storage. This policy ensures that the most recent 90 days of events are stored in the Cisco cloud, and data older than 90 days is deleted."
