Cisco FTD

About the Device

Cisco Firepower Threat Defense (FTD) is a unified software image, which includes the Cisco ASA features and FirePOWER Services. This unified software is capable of offering the function of ASA and FirePOWER in one platform, both in terms of hardware and software features.

Device Information

Collection Method

Port Requirements

Device Configuration

To send events to an external syslog server, edit each rule, default action, or policy that enables connection logging and select a syslog server object in the log settings.

To send Audit Log Messages to the Syslog

1. Choose Devices > Platform Settings

2. Click Audit Log.

3. Choose Enabled from the Send Audit Log to Syslog 

4. Designate the destination host for the audit information by using the IP address or the fully qualified name of the syslog server in the Host field.

5. From the Facility list, choose a facility described in below.

6. From the Severity list, choose a severity described in below.

7. Optionally, in the Tag field, enter the tag name that you want to appear with the syslog message. For example, if you want all audit log records sent to the syslog to be preceded with FROMMC, enter FROMMC in the field.

8. Click Save

To Configure Syslog Alerts

1. Choose Policies > Actions > Alerts, create a new syslog object for MSS.

2. In Name, Specify name for the syslog server object.

3. In Host, enter the CyberHub IP address.

4. In Port, enter 514

5. From the Facility list, choose a facility

6. From the Severity list, choose a severity

7. Optionally, in the Tag field, enter the tag name that you want to appear with the syslog message. For example, if you want all audit log records sent to the syslog to be preceded with FROMMC, enter FROMMC in the field.

8. Click Save

9. Apply the created object to the rest of the tabs.

Syslog settings for the FTD device

Step 1

• Choose Devices > Platform Settings > FTD Device > Syslog

 Step 2

In Logging Setup, select the following:

• Enable logging

• Enable logging on the failover standby unit

• Send debug messages as syslog

• Set the memory size of the internal buffer

Step 3

In logging destinations, select the events as listed below,

Step 4

• In Rate Limit, specify the Logging Level and Number of messages.

Step 5

• In Syslog Settings, set Facility as LOCAL4

• Select Enable timestamp for syslog messages.

• Select timestamp format as RFC 5424 ( yyyy-MM-ddTHH:mm:ssZ )

• Select Enable syslog ID as Host name.

• Enable the syslog ID's as need. 

Step 6

• In Syslog Server, specify the CyberHub IP address.

• Select the protocol TCP/UDP

• Specify the port number as 514/601

• Select Device management Interface.

• Click OK

To Configure Syslog Alerting for Access Control

1. After Creation of Access policy, enable logging to send the access policy log to Syslog or the SNMP trap.

 2. Following options are available:

• Log at Beginning of Connection

• Log at End of Connection

• File Events: Log Files

• Send Connection Events to: Event Viewer, Syslog Server and SNMP Trap

To Configure File Events:

1. Create a file policy from Policies > Malware & File

Select Log Files, if you want to enable logging of prohibited files or malware events. You must select a file policy in the rule to configure this option. The option is enabled by default if you select a file policy for the rule.

2. To Select a File Policy, click on Inspection and select a File Policy Previously created

3. After selecting the Log file, it will be automatically highlighted and selected. It can be enabled or disabled based on the needs.

To Configure Syslog Alerting for Intrusion Events

1. In the intrusion policy editor's navigation pane, click Advanced Settings.

2. Make sure Syslog Alerting is Enabled, then click Edit.

3. A message at the bottom of the page identifies the intrusion policy layer that contains the configuration. The Syslog Alerting page is added under Advanced Settings.

4. Enter the IP addresses of the Logging Hosts where you want to send syslog alerts.

5. If you leave the Logging Hosts field blank, the logging hosts details are taken from the Logging tab in the associated Access Control Policy.

6. Choose Facility and Severity levels as described above
   

Syslog Alert Facilities

Severity Levels Available

 7. To save changes you made in this policy since the last policy commit, choose Policy Information, then click Commit Changes.

Integration Parameters

Parameters required from customer for Integration.