Cisco Security Cloud Control: Secure Firewall Management

PDF

Cisco Security Cloud Control: Secure Firewall Management

Send Cloud-Delivered Firewall Management Center-Managed Event Logs to SAL (SaaS) Using a Direct Connection

Updated: September 24, 2026

Want to summarize with AI?

Log in

Learn how to send Cloud-Delivered Firewall Management Center-Managed -managed event logs directly to Security Analytics and Logging (SaaS), including enabling Cisco Cloud Events and choosing which event types to send.

Configure the Cloud-Delivered Firewall Management Center to send events directly to SAL (SaaS). Follow this procedure to enable the Cisco cloud event global setting in the Cloud-Delivered Firewall Management Center. When needed, you can exclude individual Firewall Threat Defense devices from sending event logs to SAL (SaaS). For more information, see Enable or Disable Threat Defense Devices to Send Event logs to SAL (SaaS) Using a Direct Connection.

Before you begin

  • Onboard devices to the Cloud-Delivered Firewall Management Center, assign licenses to these devices, and configure these devices to send events directly to SAL (SaaS).

  • Enable connection logging on a per-rule basis by editing a rule and choosing the Log at Beginning of Connection and Log at End of Connection options.

Procedure

  1. Log in to Security Cloud Control.

  2. From the Security Cloud Control Home page, click Firewall.

  3. In the left pane, click Administration > Firewall Management Center.

  4. Click Cloud-Delivered FMC, and in the System pane that is located at the right-side, click Cisco Cloud Events.

  5. In the Configure Cisco Cloud Events widget, do the following:

    1. Click the Send Events to the Cisco Cloud toggle button to enable the overall configuration.

    2. Check the Send Intrusion Events to the cloud check box to send the intrusion events to the cloud.

      Note

      When you enable sending intrusion events, the Firewall Threat Defense device sends the captured packet data to the cloud along with the intrusion events. Cisco Talos uses this packet data to analyze and eliminate false threats. This ensures focus on actual threats, enhancing the accuracy and efficiency of Talos' threat recommendations.

    3. Check the Send File and Malware Events to the cloud check box to send the file and malware events to the cloud.

    4. Choose an option to send the connection events to the cloud:

      • Click the None radio button to not send connection events to the cloud.

      • Click the Security Events radio button to send only security intelligence events to the cloud.

      • Click the All radio button to send all the connection events to the cloud.

    5. Click Save.