Learn how Security Analytics and Logging captures Catalyst SD-WAN connection events in Security Cloud Control, enabling centralized event viewing, filtering, searching, threat hunting, and security rule analysis.
About Security Analytics and Logging (SaaS) in Security Cloud Control
Learn how Cisco Security Analytics and Logging (SAL) collects and centralizes firewall security events in the cloud, enabling unified visibility and filtering through Security Cloud Control.
Event types in Security Cloud Control
Secure Logging Analytics (SaaS) enables you to filter and analyze security events from ASA, FTD, and , Catalyst SD-WAN, devices by event types such as AAA, BotNet, Firewall Traffic, Intrusion, and AI Defense. These filters help monitor network activity, detect threats, and enforce security policies for comprehensive security visibility.
Deprovisioning Cisco Security Analytics and Logging (SaaS)
Cisco Security Analytics and Logging (SaaS) subscription management ensures ongoing access to security event data and analytics. Maintaining an active subscription prevents data loss and preserves your ability to monitor, analyze, and respond to security threats using stored firewall events and behavioral analytics.
Security Analytics and Logging licenses
Security Analytics and Logging subscriptions offer flexible options for managing firewall logs in Security Cloud Control, including per-device licenses and customizable log storage and retention. Choose between Essentials, Advantage, and Premier tiers to meet operational and compliance requirements, with retention periods up to five years and storage capacities up to 10 TB.
Overview of Security Analytics and Logging for Catalyst SD-WAN
Catalyst SD-WAN integrates advanced firewall and security features, enabling centralized policy enforcement and secure cloud access. Onboarding devices to Security Cloud Control lets you monitor, search, and analyze connection events in one location, supporting threat hunting and comprehensive security management across distributed networks.
How Catalyst SD-WAN router shares events with Security Cloud Control Firewall Management
Catalyst SD-WAN event flow enables automated sharing of security events with Security Cloud Control, allowing seamless data export, cloud storage, and enrichment. This integration streamlines event visibility and analysis, empowering SOC analysts to monitor network activity and enhance threat detection using Catalyst SD-WAN security data in real time.
Requirements and guidelines
Onboarding Catalyst SD-WAN Manager to Security Cloud Control enables centralized visibility of connection events. Estimate your daily ingest rate to select the right Security Analytics and Logging subscription, ensuring compliance and effective monitoring of SD-WAN security events in the Cisco cloud.
View Catalyst SD-WAN events in Security Cloud Control Firewall Management
Filter Catalyst SD-WAN connection events in the event logging page to quickly identify network activity and security events. Use this feature to streamline event analysis, enhance threat detection, and maintain compliance. Network administrators should perform this task regularly for effective security monitoring.