About the Device
Cisco® Email Security enables users to communicate securely and helps organizations combat Business Email Compromise (BEC), ransomware, advanced malware, phishing, spam, and data loss with a multi-layered approach to security.
Device Information
Entity | Particulars |
|---|---|
Vendor Name | Cisco |
Product Name | Secure Email Gateway |
Type of Device | Hosted |
Collection Method
Log Type | Ingestion label | Preferred Logging Protocol - Format | Log collection method |
|---|---|---|---|
Cisco Email Security | CISCO_EMAIL_SECURITY | Syslog | CyberHub |
To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.
While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.
In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.
Port Requirements
Source | Destination | Port |
|---|---|---|
Cisco Secure Email Gateway | CyberHub | 601 (TCP) |
Device Configuration
Navigate to System Administration > Log Subscriptions
Add Log Subscription
Select the log type as Consolidated Event Logs
Select and Add all the fields available in Available Log Fields.
Select a log Retrieval Method for the log subscription, select Syslog Push
a. Hostname: Provide CyberHub IP Address
b. Protocol: Select TCP
c. Facility: default
Submit and Commit your configuration changes.
Integration Parameters
Parameters required from customer for Integration.
Property | Default Value | Description |
|---|---|---|
IP Address | Cisco Secure Email Gateway interface IP address | Hostname or IP address of the device which forwards logs to the CyberHub |