Implementing Secure Logging Analytics (SaaS) for ASA devices

Before you Begin

• Review Secure Logging Analytics (SaaS) for ASA devices to learn about:

  • How events are sent to the Cisco cloud

  • Applications in the solution

  • Licenses you need

  • Data plan you need

• You have contacted your managed service provider or Security Cloud Control Sales representative to create a Security Cloud Control tenant.

• Review About Secure Device Connector. Connecting Security Cloud Control to your ASA using an SDC is considered a "best practice" but it is not required.

• If you choose to deploy an SDC in your network, you can use this method to install it:

  • Use Deploy a VM for Running the Secure Device Connector and Secure Event Connector.

• You have installed one or more SECs for your tenant and you can send events from any ASA to any SEC onboarded to your tenant.

Workflow to Implement Cisco Security Analytics and Logging (SaaS) and Send Events through the Secure Event Connector to the Cisco Cloud

1. Be sure to review "Before you Begin" above to make sure your environment is properly configured.

2. Onboard ASA device to Security Cloud Control Firewall Management using username and password.

3. Send ASA Syslog Events to the Cisco Cloud.

4. Configuring NSEL for ASA Devices Using a Security Cloud Control Macro.

5. Confirm events are visible in Security Cloud Control. From the navigation bar, select Events & Logs > Events > Event Logging. Click the Live tab to view live events.

Troubleshooting Secure Event Connector Issues

Use these troubleshooting topics to gather status and logging information about

• Troubleshooting Secure Event Connector Onboarding Failures

• Event Logging Troubleshooting Log Files

• Use Health Check to Learn the State of your Secure Event Connector

Workflows

Troubleshooting Using Security and Analytics Logging Events describes using the events generated from Cisco Security Analytics and Logging to determine why a user can't access a network resource.