Cisco Multicloud Defense User Guide

Log Forwarding Overview

Updated: July 8, 2026

Explains how logs are forwarded to various systems for analysis, monitoring, and storage.

Security Events and Traffic Logs

Learn about security events and traffic logs in Multicloud Defense and how they support investigation and monitoring. Find the available event categories, forwarding destinations, and profile requirements for sending log data to a SIEM.

Discovery Logs

Learn about discovery logs in Multicloud Defense and how they help you review cloud security activity. Find the supported log categories, forwarding destinations, and profile requirements for sending discovery data to a SIEM.

Gateway Metrics Forwarding Profile

Explains the purpose and capabilities of the Gateway Metrics Forwarding Profile.

Add an Event, Traffic Log Forwarding Profile, or Metrics Forward Profile to a Gateway

Associate an event, traffic log forwarding, or metrics forward profile with a Multicloud Defense gateway so the gateway sends its data to the selected destination.

Remove an Event, Traffic Log Forwarding Profile, or Metrics Forward Profile from a Gateway

Remove an event, traffic log forwarding, or metrics forward profile from a gateway when you no longer want the gateway to send data through that profile.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.