Explains how to send FDM managed device events from access control, Security Intelligence, SSL decryption, file, malware, and intrusion rules to Security Cloud Control Event Logging.
FDM event logging to Security Cloud Control is a security monitoring capability that
sends FDM-managed events from access control rules, security intelligence rules, and SSL decryption rules to the Cisco cloud
enables viewing of these events in the Event Logging viewer
supports connection events from multiple rule types and policy configurations.
Event types and configuration requirements
This capability supports events from multiple rule types:
-
Access Control Rules: You can log connection events at the beginning or end of a network connection.
-
Security Intelligence Rules: You can log connection events generated by the Security Intelligence rules. If you enable logging, any matches to blocked list entries are logged. Matches to exception entries are not logged, although you get log messages if exempted connections match access control rules with logging enabled.
-
SSL Decryption Rules: You can log connection events generated by SSL decryption rules.