Learn how to send Cloud-Delivered Firewall Management Center-Managed -managed event logs directly to Security Analytics and Logging (SaaS), including enabling Cisco Cloud Events and choosing which event types to send.

Configure the Cloud-Delivered Firewall Management Center to send events directly to SAL (SaaS). Follow this procedure to enable the Cisco cloud event global setting in the Cloud-Delivered Firewall Management Center. When needed, you can exclude individual Firewall Threat Defense devices from sending event logs to SAL (SaaS). For more information, see Enable or Disable Threat Defense Devices to Send Event logs to SAL (SaaS) Using a Direct Connection.

Before you begin

Onboard devices to the Cloud-Delivered Firewall Management Center, assign licenses to these devices, and configure these devices to send events directly to SAL (SaaS).
Enable connection logging on a per-rule basis by editing a rule and choosing the Log at Beginning of Connection and Log at End of Connection options.

Procedure

	1.	Log in to Security Cloud Control.
	2.	From the Security Cloud Control Home page, click Firewall.
	3.	In the left pane, click Administration > Firewall Management Center.
	4.	Click Cloud-Delivered FMC, and in the System pane that is located at the right-side, click Cisco Cloud Events.
	5.	In the Configure Cisco Cloud Events widget, do the following: Click the Send Events to the Cisco Cloud toggle button to enable the overall configuration. Check the Send Intrusion Events to the cloud check box to send the intrusion events to the cloud. Note When you enable sending intrusion events, the Firewall Threat Defense device sends the captured packet data to the cloud along with the intrusion events. Cisco Talos uses this packet data to analyze and eliminate false threats. This ensures focus on actual threats, enhancing the accuracy and efficiency of Talos' threat recommendations. Check the Send File and Malware Events to the cloud check box to send the file and malware events to the cloud. Choose an option to send the connection events to the cloud: Click the None radio button to not send connection events to the cloud. Click the Security Events radio button to send only security intelligence events to the cloud. Click the All radio button to send all the connection events to the cloud. Click Save.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.