Learn how Security Analytics and Logging captures FDM managed device events in Security Cloud Control, including event forwarding methods, required components, licensing, ingest planning, and storage considerations.
Cisco Security Analytics and Logging (SaaS) allows you to capture connection, intrusion, file, malware, and Security Intelligence events from all of your FDM-managed devices and view them in one place in Security Cloud Control .
The events are stored in the Cisco cloud and viewable from the Event Logging page in Security Cloud Control where you can filter and review them to gain a clear understanding of what security rules are triggering in your network.
How FDM Events are Displayed in the Security Cloud Control Events Viewer
Connection, intrusion, file, malware, and Security Intelligence events are generated when an individual rule is configured to log events and network traffic matches the rule criteria. After the events are stored in the Cisco cloud, you can view them in Security Cloud Control . There are two methods of configuring your FDM-managed device to send events to the Cisco cloud:
-
You can install multiple Secure Event Connectors (SECs) and send events generated by a rule, on any device, to any of the SECs as if it were a syslog server. The SEC then forwards the event to the Cisco cloud.
-
If your FDM-managed device was onboarded to Security Cloud Control using a registration key, you can send events directly to the Cisco cloud using a control in the Secure Firewall Device Manager .
How an Event is Sent to the Cisco Cloud Using the Secure Event Connector
With the basic Logging and Troubleshooting license, this is how a Secure Firewall Device Manager event reaches the Cisco cloud:
-
You onboard your FDM-managed device to Security Cloud Control using username and password or by using a registration key.
-
You configure individual rules, such as access control rules, Security Intelligence rules, and SSL decryption rules, to forward events to any one of your SECs as if it were a syslog server. In access control rules, you can also enable file and malware policies, and intrusion policies, and forward events generated by those polices to the SEC.
-
You configure File/Malware logging in for file events.
-
You configure Intrusion Logging in for intrusion events.
-
The SEC forwards the events to the Cisco cloud where the events are stored.
-
Security Cloud Control displays events from the Cisco cloud in its Events Logging page based on the filters you set.
How Events are Sent Directly from an Secure Firewall Device Manager to the Cisco Cloud
With the basic Logging and Troubleshooting license , this is how Secure Firewall Device Manager events reach the Cisco cloud:
-
You onboard your FDM-managed device to Security Cloud Control using a registration token.
-
You configure individual rules, such as access control rules, Security Intelligence rules, and SSL decryption rules, to log events but you don't specify a syslog server for them to be sent to. In access control rules, you can also enable file and malware policies and intrusion policies, and forward events generated by those polices to the Cisco cloud.
-
File events and Intrusion events are sent to the Cisco cloud if file and malware policies and intrusion policies are configured in the access control rules to log connection events.
-
You activate Cloud Logging on the Secure Firewall Device Manager and the events logged in the various rules are sent to the Cisco cloud.
-
Security Cloud Control pulls events from the Cisco cloud based on the filters you set and displays them in its Events viewer.
Configuration Comparison
Here is a summary of the Security Cloud Control configuration differences between sending events to the Cisco cloud through an SEC and sending events directly to the Cisco cloud.
| FDM-Managed Device Configuration |
When Sending Events through a Secure Event Connector (SEC) |
When Sending Events Directly to Cisco Cloud |
|---|---|---|
| Security Cloud Control onboarding method for FDM-Managed Device |
Credentials (Username and password) Registration token |
Registration token Serial Number |
| Version Support |
Version 6.4+ |
Registration Token - Version 6.5+ Serial Number - Version 6.7+ |
| Cisco Security Analytics and Logging (SaaS) Licenses |
Logging and Troubleshooting Logging Analytics and Detection (optional) Total Network Analytics and Monitoring (optional) |
Logging and Troubleshooting Logging Analytics and Detection (optional) Total Network Analytics and Monitoring (optional) |
| Licenses |
license -If you want to collect connection events from intrusion rules, file control rules, or security intelligence filtering. Malware -If you want to collect connection events from file control rules. |
license -If you want to collect connection events from intrusion rules, file control rules, or security intelligence filtering. Malware -If you want to collect connection events from file control rules. |
| Secure Event Connector |
Required |
N/A |
| Data Compression* |
Events are compressed* |
Events are not compressed* |
| Data Plan |
Required |
Required |
Data subscriptions and your Historical Monthly Usage are based on the amount uncompressed data you use.
Components in the Solution
Cisco Security Analytics and Logging (SaaS) uses these components to deliver events to Security Cloud Control :
Secure Device Connector (SDC) -The SDC connects Security Cloud Control to your FDM-managed devices. The login credentials for the FDM-managed devices are stored on the SDC.
Secure Event Connector (SEC) -The SEC is an application that receives events from your FDM-managed devices and forwards them to the Cisco cloud. Once in the Cisco cloud, you can view the events on Security Cloud Control 's Event Logging page . You may have one or more SECs associated with your tenant. Depending on your environment, you install the Secure Event Connector on a Secure Device Connector or a Security Cloud Control Connector VM.
Secure Firewall Device Manager -The FDM-managed device is Cisco's next generation firewall. Beyond stateful inspection of network traffic and access control, the FDM-managed device provides capabilities such as protection from malware and application-layer attacks, integrated intrusion prevention, and cloud-delivered threat intelligence.
Licensing
To configure this solution you need the following accounts and licenses:
-
Security Cloud Control : You must have a Security Cloud Control tenant.
-
Secure Device Connector: There is no separate license for a SDC.
-
Secure Event Connector: There is no separate license for a SEC.
-
Security Analytics and Logging (SaaS): You need a valid Security Analytics and Logging (SaaS) subscription plan to store real-time and historical events derived from their on-boarded FDM-managed devices and make it available for the purposes of troubleshooting and analyzing traffic in their network using Security Cloud Control . For more information about Security Analytics and Logging (SaaS) subscription plans, see Security Analytics and Logging licenses .
FDM-Managed Device. You need to have the following licenses to run the FDM-managed device and create rules that generate security events:
| License |
Duration |
Granted Capabilities |
|---|---|---|
| Essentials (automatically included) |
Perpetual |
All features not covered by the optional term licenses. You must also specify whether to Allow export-controlled functionality on the products registered with this token . You can select this option only if your country meets export-control standards. This option controls your use of advanced encryption and the features that require advanced encryption. |
| Term-based |
Intrusion detection and prevention -Intrusion policies analyze network traffic for intrusions and exploits and, optionally, drop offending packets. File control -File policies detect and, optionally, block users from uploading (sending) or downloading (receiving) files of specific types. AMP for Firepower, which requires a Malware license, allows you to inspect and block files that contain malware. You must have the Threat license to use any type of File policy. Security Intelligence filtering -Drop selected traffic before the traffic is subjected to analysis by access control rules. Dynamic feeds allow you to immediately drop connections based on the latest intelligence. |
|
| Malware |
Term-based |
File policies that check for malware, which use Cisco Advanced Malware Protection (AMP) with AMP for Firepower (network-based Advanced Malware Protection) and Cisco Threat Grid. File policies can detect and block malware in files transmitted over your network. |
Estimate Your Daily Ingest Rate
Purchase a subscription plan that matches the number of events the Cisco cloud receives from your onboarded firewall devices on a daily basis. This is called your daily ingest rate . You can use the Logging Volume Estimator tool to estimate your daily ingest rate and as that rate changes you can update your subscription plan.
It is possible to configure your FDM-managed device to send events to the Cisco cloud directly and by way of the SEC simultaneously. If you do this, the same event will be "ingested" twice and counted against your subscription plan twice, though it will only be stored in the Cisco cloud once. Ensure that you send events to the Cisco cloud using one method or the other to avoid duplicating event data and to avoid additioanl usage of storage.
For more information about the subscription plans, refer to the Security Cloud Control Firewall Management Ordering Guide .
90-day Free Trial
To accurately estimate your daily ingest rate, log in to Security Cloud Control and navigate to the tab to request a 90-day trial. You can purchase the desired subscription plan to continue the service by reviewing the instructions in the Security Cloud Control Firewall Management Ordering Guide .