Accenture MDR Quick Start Guide for Cisco Firepower® (Sourcefire eStreamer® IPv6) Logging Configuration

This quick start guide will help Accenture MDR customers configure Cisco Firepower® to allow log collection from the Log Collection Platform (LCP). 

The guide details the GUI configuration process of  Cisco Firepower® Management Center (FMC). Please refer to the vendor document for more information on CLI and 3D Sensor configuration.

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for eStreamer communication.

Configuring Cisco Firepower®

To configure Cisco Firepower® Device Version 5.3 and 5.4:

Sourcefire Event Streamer (also known as eStreamer) allows you to stream event data from the FMC or 3D Sensor to the LCP. All communication with eStreamer is initiated by the LCP, occurs over a TCP SSL connection on port 8302,  and requires a password-protected certificate (.pkcs12).

To configure Cisco Firepower®, follow the steps below.

1. Login to the FMC web interface as Administrator.

2. Based on the DC version, do one of the following:

• For DC versions 4.9 and 4.10, from the main screen, click Operations > Configuration > eStreamer. 

• For DC versions 5.x, from the main screen, click System > Local > Registration > eStreamer. 

3. On the eStreamer Event Configuration page, check the specified check boxes to send events to the LCP.

Open

4. Click Save.

5. At the top-right corner, click Create Client to create a new eStreamer client for the LCP.            

Open

6. In the Hostname text box, enter the IP address or DNS-resolvable hostname of the LCP.           

7. In the Password text box, enter your preferred password and click Save.

8. After successful client creation, the Success message appears and the newly added client appears under the eStreamer tab.           

9. Click the Download icon corresponding to the newly created client, save the certificate file on your local computer, and then send the file to Accenture MDR.

To configure Sourcefire eStreamer IPv6 Device Version 6.1 and above version:

1. Log on to the Defense Center Web interface as a user with administrator privileges.

2. Go to System > Integration > eStreamer and select Registration.

3. On the eStreamer Event Configuration page, select the types of events for eStreamer to send. Make sure that all types of events are selected.

 Note : IPv6 source and IPv6 destination addresses for Intrusion events are stored in a new Intrusion Event Extra Data Record. In order for the collector to retrieve this information, you must select Intrusion Event Extra Data in Sourcefire eStreamer Event Configuration page. 

4. Click Save.

5. Click Create Client to create an eStreamer client for the collector computer.

6. In the Hostname text box, enter the IP address or DNS-resolvable hostname of the LCP.

7. In the Password text box, enter your preferred password and click Save.

To log blacklisted connections:

1. Login to the Sourcefire DC web interface as Administrator.

2. Select Policies > Access Control and the Access Control Policy window appears.

3. At the right corner, click the Pencil icon to edit the first policy.

4. Go to the Security Intelligence tab and at the right corner on the Blacklist Networks section, click Logging. 

5. Check the Log Connections check box. This will generate a log at the beginning of each connection event when the traffic meets Security Intelligence conditions.

6. In the Send Connection Events to section, check the Event Viewer check box. This will display the blacklisted logs as connection events on Sourcefire DC.

7. Click OK.

8. Follow the above steps for all the configured policies.

9. Once logging is enabled for all the configured policies, click Save.

Note: Accenture MDR recommends additional logging configuration for this device and please follow Accenture MDR recommended logging configuration for Sourcefire eStreamer guide for details.

Creating New Request for Monitoring

Once the device is configured as outlined in the steps above and all network pre-requisites have been made, you are now ready to onboard it for MDR monitoring. To complete this process, submit a New Request via the MDR Portal. This new request should contain the following information:

1. Reporting LCP Hostname/IPAddress:

2. Defense Center IP: 

3. Individual Sensor IP: 

4. Attach eStreamer Client Certificate

5. eStreamer Client Certificate Password: 

6. Product Version (include minor version): 

Note: If you have any questions about this process, please contact the Accenture MDR onboarding team.

LCP Configuration Parameters

Table 1-2: The Sourcefire eStreamer IPv6 event collector (API – 3622) sensor properties to be configured by MDR are shown in the table.