Cisco Security Cloud Control: Secure Firewall Device Management

PDF

Cisco Security Cloud Control: Secure Firewall Device Management

Secure event connector removal

Updated: August 31, 2026

Want to summarize with AI?

Log in

Describes how to remove the Secure Event Connector, including SEC destinations, ports, severity levels, custom event lists, and cloud event delivery.

Secure Event Connector removal is a process that

  • deletes the Secure Event Connector from the Secure Device Connector

  • prevents the use of Secure Logging Analytics (SaaS), and

  • is not reversible once completed.

Removal process

Warning

This procedure deletes the Secure Event Connector from the Secure Device Connector. Doing so will prevent you from using Secure Logging Analytics (SaaS). It is not reversible. If you have any questions or concerns, contact Security Cloud Control support before taking this action.

Removing the Secure Event Connector from your Secure Device Connector is a two-step process:

  1. Remove SEC from Security Cloud Control.

  2. Remove SEC files from the SDC.

What to do next: Continue to Remove SEC from Security Cloud Control

Remove an SEC from Security Cloud Control

This task removes an SEC (Secure Event Connector) from your Security Cloud Control management system when it is no longer needed or when troubleshooting connectivity issues.

Use this procedure when you need to disconnect and remove a Secure Event Connector from your Security Cloud Control environment. This is typically done during device decommissioning or when reconfiguring your security infrastructure.

Before you begin

See Secure event connector removal.

Procedure

1.

Log in to Security Cloud Control.
2.

From the Security Cloud Control Home page, click Firewall.
3.

From the left pane, choose Administration > Secure Connectors.
4.

Select the row with the device type, Secure Event Connector.

Warning

Be careful NOT to select your Secure Device Connector.
5.

In the Actions pane, click Remove.
6.

Click OK to confirm.

Continue to Remove a secure event connector from the secure device connector VM.

The Secure Event Connector is successfully removed from Security Cloud Control and no longer appears in the connector list.

Remove a secure event connector from the secure device connector VM

Remove the Secure Event Connector from your Secure Device Connector virtual machine to complete the SEC removal process.

This is the second part of a two part procedure to remove the Secure Event Connector from your SDC. See Secure event connector removal before you begin.

Procedure

1.

Open your virtual machine hypervisor and start a console session for your SDC.
2.

Switch to the SDC user using the command sudo su SDC .

Example:

[cdo@sdc]$ sudo su sdc
3.

Remove the SEC from the SDC virtual machine using one of the following commands:

  • If you want to use the tenant selector (or if there's only one tenant on the VM): 
    [sdc@tenant toolkit]$ sdc eventing delete
  • If you want to specify the tenant directly in the command arguments: 
    [sdc@tenant toolkit]$ sdc eventing delete CDO_{tenant-name}
4.

Confirm your intention to remove the SEC files.

The Secure Event Connector is successfully removed from the Secure Device Connector virtual machine.