This section lists generic use cases along with the tools that are used to perform the integration.

Use Case	Solution	Minimum supported Firepower release	More Information
You want to unify visibility, enable automation, and strengthen your security across network, endpoints, cloud, and applications--all without replacing your current security infrastructure or layering on new technology.	Cisco SecureX	6.3	Integrate with Cisco SecureX
You want to combine investigation and response capabilities into one efficient workbench, speed up cyber investigations significantly, and take corrective action immediately.	Cisco SecureX threat response	6.3	Integrate with Cisco SecureX threat response
You want to stream host, discovery, correlation, compliance white list, intrusion, user activity, file, malware, and connection data from a Management Center.	Cisco Event Streamer (eStreamer)	6.0	Integrate with Cisco Event Streamer
You want to use Splunk to store threat and traffic data received from the FMC and use this data to discover and investigate threats.	Cisco Secure Firewall (formerly known as Firepower) App for Splunk	6.0	Integrate with Splunk
You want to analyze and contain threats to your network by providing insight from multiple security products in QRadar.	Cisco Firepower App for IBM QRadar	6.0	Integrate with IBM QRadar
You want to increase your on premises Firewall event data storage capacity, retain this data for a longer period of time, and export your event data to a Secure Network Analytics appliance.	Cisco Security Analytics and Logging (On Premises)	6.4	Integrate with Cisco Security Analytics and Logging (On Premises)
You want to send Firepower events to the Cisco Secure Cloud Analytics (formerly known as Stealthwatch Cloud) for storage as you need more storage than what an on premises storage can provide, and optionally make your Firepower event data available for security analytics using Cisco Secure Cloud Analytics.	Cisco Security Analytics and Logging (SaaS)	6.4	Integrate with Cisco Security Analytics and Logging (SaaS)

SecureX is a simplified platform experience, connecting Cisco's integrated security portfolio with your existing infrastructure. It helps you unify visibility, enable automation, and strengthen security across your network, endpoints, cloud, and applications. SecureX is included with your Cisco security product purchase, and you can view data from all of your FTD devices in SecureX.

This integration sends supported events from Firepower devices to Cisco SecureX for analysis.

Type of Integrations

You can integrate FTD devices with SecureX using two different methods of integration:

• Direct integration – supported on FMC

• Syslog integration – supported on FMC and FDM

Direct Integration

You can configure your managed FTD devices to send supported events directly to the Security Services Exchange (SSE) in the Cisco cloud.

Supported Firepower user role to perform the integration: Administrator

Minimum supported Firepower release: 6.4 for the North America cloud and 6.5 for the Europe and Asia cloud

The following diagram shows how the direct integration works.

	The FTD devices generate events.
	The FTD devices send supported events to SSE.
	SecureX queries SSE for sightings related to the IP address being investigated and provides the SOC analyst with the additional context. The events are automatically or manually promoted to incidents that appear in SecureX.

Syslog Integration

You can use syslog to send supported events to the Cisco cloud from Firepower devices.

Supported Firepower user role to perform the integration: Administrator

Minimum supported Firepower release: 6.3 for all cloud regions

The following diagram shows how the syslog integration works.

	The FMC or FDM-managed FTD device generates events.
	The FTD device sends the supported syslog events to the Cisco Security Services Proxy (CSSP) server.
	Every 10 minutes, the CSSP forwards the collected events to the Security Services Exchange (SSE),
	SecureX queries SSE for sightings related to the IP address being investigated and provides the SOC analyst with the additional context. The events are automatically or manually promoted to incidents that appear in SecureX.

Cisco SecureX threat response (formerly Cisco Threat Response or CTR) is the platform in the Cisco cloud that helps you detect, investigate, analyze, and respond to threats using data aggregated from multiple products and sources.

This integration sends supported events from Firepower devices to Cisco SecureX threat response for analysis alongside data from your other products and other sources.

Type of Integrations

You can integrate FTD devices with Cisco SecureX threat response using two different methods of integration:

• Direct integration – supported on FMC

• Syslog integration – supported on FMC and FDM

Direct Integration

You can configure your Firepower system to send supported events directly to the Cisco cloud from Firepower Threat Defense (FTD) devices.

Specifically, your Firepower devices send events to Security Services Exchange (SSE), from where they can be automatically or manually promoted to incidents that appear in Cisco SecureX threat response.

Supported Firepower user role to perform the integration: Administrator

Minimum supported Firepower release: 6.4 for the North America cloud and 6.5 for the Europe and Asia cloud

	The FTD device generate events.
	The FTD device sends supported events to SSE.
	SecureX threat response queries SSE for sightings related to the IP address being investigated and provides the SOC analyst with the additional context. The events are automatically or manually promoted to incidents that appear in SecureX threat response.

Syslog Integration

You can use syslog to send supported events to the Cisco cloud from Firepower devices. You must set up an on-premises Cisco Security Services Proxy (CSSP) server and configure your devices to send syslog messages to this proxy.

Every 10 minutes, the proxy forwards collected events to Security Services Exchange (SSE), from where they can be automatically or manually promoted to incidents that appear in Cisco SecureX threat response.

Supported Firepower user role to perform the integration: Administrator

Minimum supported Firepower release: 6.3 for all cloud regions

	The FMC or FDM-managed FTD device generates events.
	The FTD device sends the supported syslog events to the Cisco Security Services Proxy (CSSP) server.
	Every 10 minutes, the CSSP forwards the collected events to the Security Services Exchange (SSE).
	SecureX threat response queries SSE for sightings related to the IP address being investigated and provides the SOC analyst with the additional context. The events are automatically or manually promoted to incidents that appear in SecureX threat response.

The Cisco Event Streamer (also known as eStreamer) allows you to stream Firepower System events to external client applications.

At the highest level, the eStreamer service is a mechanism for streaming data from the Firepower System to a requesting client. The service can stream the following categories of data:

• Intrusion event data and event extra data

• Correlation (compliance) event data

• Discovery event data

• User event data

• Metadata for events

• Host information

• Malware event data

Note that eStreamer is not supported on NGIPSv, Firepower Services, Firepower Threat Defense Virtual, and Firepower Threat Defense. To stream events from these devices, you can configure eStreamer on the Management Center that the device reports to.

There are three major steps to creating and integrating an eStreamer client with a Firepower system:

1. Write a client application that exchanges messages with the Management Center or managed device using the eStreamer application protocol. The eStreamer SDK includes a reference client application.

2. Configure a Management Center or device to send the required type of events to your client application.

3. Connect your client application to the Management Center or device and begin exchanging data.

Supported Firepower user role to perform the integration: Administrator

Minimum supported Firepower release: 6.0

For more information on integrating Firepower with the Cisco Event Streamer, refer the Firepower System Event Streamer Integration Guide.

Cisco Secure Firewall (f.k.a. Firepower) App for Splunk presents security and network event information sent to Splunk from Firepower Management Center running version 6.0 or later. You can discover and investigate threats using threat and traffic data from the Firepower Management Center (FMC). Splunk can store far more data than FMC can, so you have greater visibility into activity on your network.

This app is a successor to the Cisco Firepower eNcore App for Splunk ( https://splunkbase.splunk.com/app/3663/). You can run both apps in parallel if you choose to do so.

Supported Firepower user role to perform the integration: Administrator

Minimum supported Firepower release: 6.0

Supported Splunk versions and other compatibility information is here: https://splunkbase.splunk.com/app/4388/.

Before you can use this app, your Firepower event data must be in Splunk. To bring your Firepower data into Splunk, use the Cisco Secure eStreamer Client Add-On for Splunk (formerly known as the Cisco eStreamer eNcore Add-on for Splunk.) This technical add-on (TA) is available from https://splunkbase.splunk.com/app/3662/.

Documentation for this TA is available from https://www.cisco.com/c/en/us/support/security/defense-center/products-programming- reference-guides-list.html.

For more information on the Cisco Secure Firewall (f.k.a. Firepower) App for Splunk, see the User Guide for Cisco Secure Firewall (f.k.a. Firepower) App for Splunk.

The Cisco Firepower App for IBM QRadar helps you analyze and contain threats to your network by providing insight from multiple security products in QRadar.

The QRadar Security Information and Event Management (SIEM) tool provides anomaly detection, incident forensics, and vulnerability management.

After you set up the app, you can view event data from your Firepower system in graphical form in the QRadar console.

Supported Firepower user role to perform the integration: Administrator

Minimum supported Firepower release: 6.0

For more information on the Cisco Firepower app for IBM QRadar, see the Integration Guide for the Cisco Firepower App for IBM QRadar.

Cisco Security Analytics and Logging (CSAL) streamlines decision making by aggregating logs from various Cisco devices and providing an intuitive view of network activity. Security Analytics and Logging can be expanded at the user’s discretion, allowing for longer retention and analysis, and even alerts on potential threats found in your firewall and other networking devices.

The Firepower devices can be integrated with CSAL using two methods– On Premises and Security as a Service (SaaS).

Comparison of Cisco Security Analytics and Logging Remote Event Storage Options

On Premises	SaaS
You purchase, license, and set up the storage system behind your firewall.	You purchase licenses and a data storage plan and send your data to the Cisco cloud.
Supported event types: Connection Security Intelligence Intrusion File and Malware LINA	Supported event types: Connection Security Intelligence Intrusion File and Malware
Supports both syslog and direct integration.	Supports both syslog and direct integration.
View all events on the Stealthwatch Management Console. Cross-launch from FMC event viewer to view events on the Stealthwatch Management Console. View remotely stored connection and Security Intelligence events in FMC	View events in CDO or Stealthwatch, depending on your license. Cross-launch from FMC event viewer.

For more information, see links in the Data Storage chapter in the Firepower Management Center Configuration Guide or online help.