Secure network analtics syslog

[ahmedFawzy]

can cisco secure network analytics use firewall syslog ingested from telemetry broker for analysis. and how can i configure SNA to receive syslog?

[Cristian Matei]

Hi,

 @ahmedFawzy Check page 26 on following document:

https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/proxy/7_5_1_Proxy_Log_Configuration_Guide_DV_1_0.pdf

Thanks,

Cristian.

[kegunner]

Hi,
Yes SNA can ingest syslog from firewalls via CTB if using SNA with datastore. Create the rule in CTB to forward SAL using UDP/8514.
On your FlowCollector, access the appliance administration interface, head to Support, Advanced Settings and ensure that:
sal_syslog_port = 8514
sal_to_flow_cache = 1