Ive been attempting to register the CSSP v1.0 with cisco threat reponse. I follow the documentation and it sits and registering constantly. I generated the token like the doc says and followed all the directions.    level=debug msg="[cssp-771fe1][manage.go:745 context:(*contextImpl).handleFailed] registration - CE2102: Registration failed - Failed to connect to a cloud service. Check network connectivity and retry. - Failed" administrator@cssp-771fe1 : /opt/cssp/logs $ /opt/cssp/cli/healthcheck.sh Running CSSP health check -------------------------------------------------- Installed cssp package version: 1.0 -------------------------------------------------- Checking the health of service rsyslog: Active Checking the health of CSSP plugin: Active Checking the health of service connector: Active -------------------------------------------------- CSSP Events Plugin is: Running -------------------------------------------------- CSSP cloud URL https://api-sse.cisco.com is: Reachable -------------------------------------------------- CSSP Connector registration status: Failed Connector event status : Init -------------------------------------------------- CSSP Events Plugin status: Disabled --------------------------------------------------   ... View more

So i have been playing around with a basic scenario of a linux ec2 vm on the inside subnet of the ASAv. A vpn to the VPC and a static route to my remote subnet (opposite side of the vpn). I have tried custom route tables, routes on the ec2 vm, and route tables directly to an interface. Nothing works! It appears that the initial packet goes around the ASA to the ec2 vm then the return syn ack comes through the inside interface from the vm and is dropped because it was never initiated through the outside beings it went around it. What is the trick in order to force it through the outside and not around the firewall. My test was not from within the VPC but from the remote side of the vpn. ... View more

Can you please help? Cannot generate a cspc entitlement. ... View more

I was reading there is support of connector style umbrella web filtering. So the steps mention utilizing an api based on the company and network device. umbrella on ASA With that being said i imagine this takes care of dynamic ip address issues when assigning an dynamic IP site to your MSP dashboard. Meaning if the ip changes they still will be processed by policy? ... View more

Today's logstash conf file is for AMP for endpoints. You will need an api created inside of the amp cloud dashboard. Inside of the two .sh files place the api key in place of yourkeyhere. You will also need the two .sh files i am providing inside of your /etc directory on linux. The amp.sh needs an entry in /etc/crontab like so */5 * * * * root /etc/amp.sh so it runs every 5 mins. It will produce the file /etc/run-amp.sh which i am also providing. It creates the curl line with the proper previous 5 mins command. Make sure you make the owner of these files logstash. Last but not least is the amp.conf file for logstash. This takes the ingested json and creates parsed data for you. I was able to create some nice charts and graphs in kibana of the data. Make sure you remove the .txt part of the files before using. If you get stuck anywhere let me know.  https://api-docs.amp.cisco.com/api_resources?api_host=api.amp.cisco.com&api_version=v1   ... View more

Today's logstash conf file is for Cognitive threat analytics. You will need an api created inside of CTA cloud dashboard. You will also need taxii log adapter setup. If you need help here is the wiki taxii log adapter wiki  If you really get stuck feel free to send me a message. In the upcoming days I will be posting conf files for FirePower snort, Security Intelligence alerts, Threat intelligence director via Firepower manager API, Cisco AMP for endpoints, and Meraki Security Alerts (AMP and SNORT).        In order to use the attached conf file please remove the .txt from the filename.  ... View more