Firepower Management Center Configuration Guide, Version 6.0

Book Contents

Getting Started With Firepower
- Logging into the Firepower System
- Specifying User Preferences
- Firepower System User Management
- Licensing the Firepower System
- System Software Updates
- Backup and Restore
- Configuration Import and Export
- Task Scheduling
- Management Center Database Purge
- Dashboards
- Health Monitoring
- Monitoring the System
- Domain Management
- Policy Management
- Rule Management: Common Characteristics
- Reusable Objects
- Firepower Management Center Basics
- Device Management Basics
- Classic Device Management Basics
- IPS Device Deployments and Configuration
- 7000 and 8000 Series Device High Availability
- 8000 Series Device Stacking
- System Configuration
- Platform Settings Policies for Managed Devices
- Platform Settings for Classic Devices
- NAT Policy Management
- NAT for 7000 and 8000 Series Devices
- Setting Up Virtual Switches
- Setting Up Virtual Routers
- Aggregate Interfaces and LACP
- Hybrid Interfaces
- Gateway VPNs
- Getting Started with Access Control Policies
- Access Control Rules
- Access Control Using Intrusion and File Policies
- HTTP Response Pages and Interactive Blocking
- Security Intelligence Blacklisting
- DNS Policies
- Intelligent Application Bypass
- Understanding Traffic Decryption
- Start Creating SSL Policies
- Getting Started with SSL Rules
- Decryption Tuning Using SSL Rules
- File Policies and Advanced Malware Protection
- File and Malware Inspection Performance and Storage Tuning
- An Overview of Network Analysis and Intrusion Policies
- Layers in Intrusion and Network Analysis Policies
- Getting Started with Intrusion Policies
- Tuning Intrusion Policies Using Rules
- Tailoring Intrusion Protection to Your Network Assets
- Sensitive Data Detection
- Globally Limiting Intrusion Event Logging
- The Intrusion Rules Editor
- Intrusion Prevention Performance Tuning
- Advanced Access Control Settings for Network Analysis and Intrusion Policies
- Getting Started with Network Analysis Policies
- Application Layer Preprocessors
- SCADA Preprocessors
- Transport & Network Layer Preprocessors
- Detecting Specific Threats
- Adaptive Profiles
- Introduction to Network Discovery and Identity
- Host Identity Sources
- Application Detection
- User Identity Sources
- Network Discovery Policies
- Realms and Identity Policies
- Compliance White Lists
- Correlation Policies
- Traffic Profiling
- Remediations
- Working with Reports
- External Alerting with Alert Responses
- External Alerting for Intrusion Events
- Using the Context Explorer
- Using the Network Map
- Incidents
- Workflows
- Searching for Events
- Custom Workflows
- Custom Tables
- Connection Logging
- Connection and Security Intelligence Events
- Working with Intrusion Events
- File/Malware Events and Network File Trajectory
- Using Host Profiles
- Working with Discovery Events
- Correlation and Compliance Events
- Auditing the System
Security, Internet Access, and Communication Ports
Command Line Reference

Find Matches in This Book

Available Languages

Download Options

Book Title

Firepower Management Center Configuration Guide, Version 6.0

Chapter Title

Auditing the System

PDF - Complete Book (34.95 MB) PDF - This Chapter (1.41 MB)
View with Adobe Reader on a variety of devices

Results

Updated:: April 30, 2018

Chapter: Auditing the System

About System Auditing
Audit Records
- Viewing Audit Records
- Suppressing Audit Records
  - Audit Block Types
  - Audited Subsystems
The System Log
- Viewing the System Log
  - Filtering System Log Messages
  - Syntax for System Log Filters

Auditing the System

The following topics describe how to audit activity on your system:

About System Auditing
Audit Records
The System Log

About System Auditing

You can audit activity on your system in two ways. The appliances that are part of the Firepower System generate an audit record for each user interaction with the web interface, and also record system status messages in the system log.

Related Concepts

Introduction to Reports

Audit Records

Firepower Management Centers and 7000 and 8000 Series devices log read-only auditing information for user activity. Audit logs are presented in a standard event view that allows you to view, sort, and filter audit log messages based on any item in the audit view. You can easily delete and report on audit information and can view detailed reports of the changes that users make.

The audit log stores a maximum of 100,000 entries. When the number of audit log entries exceeds 100,000, the appliance prunes the oldest records from the database to reduce the number to 100,000.

Note

If you reboot a 7000 or 8000 Series device, then log into the auxiliary CLI as soon as you are able, any commands you execute are not recorded in the audit log until the local web interface is available.

Viewing Audit Records
Suppressing Audit Records

Viewing Audit Records

Smart License	Classic License	Supported Devices	Supported Domains	Access
Any	Any	Any	Any	Admin

On a Firepower Management Center or 7000 and 8000 Series devices, you can view a table of audit records. The predefined audit workflow includes a single table view of events. You can manipulate the table view depending on the information you are looking for. You can also create a custom workflow that displays only the information that matches your specific needs.

In a multidomain deployment, you can view data for the current domain and for any descendant domains. You cannot view data from higher level or sibling domains.

Procedure

Step 1

Access the audit log workflow using System > Monitoring > Audit.

Step 2

If no events appear, you may need to adjust the time range. For more information, see Event Time Constraints.

Note

Events that were generated outside the appliance's configured time window (whether global or event-specific) may appear in an event view if you constrain the event view by time. This may occur even if you configured a sliding time window for the appliance.

Step 3

You have the following choices:

To learn more about the contents of the columns in the table, see The System Log.
To sort and constrain events on the current workflow page, see Using Table View Pages.
To navigate within the current workflow page, see Time Window Progression.
To navigate between pages in the current workflow, keeping the current constraints, click the appropriate page link at the top left of the workflow page. For more information, see Using Workflows.
To drill down to the next page in the workflow, see Using Drill-Down Pages.
To constrain on a specific value, click a value within a row. If you click a value on a drill-down page, you move to the next page and constrain on the value. Note that clicking a value within a row in a table view constrains the table view and does not drill down to the next page. See Event View Constraints for more information.
Tip
Table views always include “Table View” in the page name.
To delete audit records, check the check boxes next to events you want to delete, then click Delete, or click Delete All to delete all events in the current constrained view.
To bookmark the current page so you can quickly return to it, click Bookmark This Page. For more information, see Bookmarks.
To navigate to the bookmark management page, click View Bookmarks. For more information, see Bookmarks.
To generate a report based on the data in the current view, click Report Designer. For more information, see Creating a Report Template from an Event View.
To view a summary of a change recorded in the audit log, click the compare icon () next to applicable events in the Message column. For more information, see Using the Audit Log to Examine Changes.

Related Concepts

Event View Constraints

Audit Log Workflow Fields

The following table describes the audit log fields that can be viewed and searched.

Table 1 Audit Log Fields
Field	Description
Time	Time and date that the appliance generated the audit record.
User	User name of the user that triggered the audit event.
Subsystem	The full menu path the user followed to generate the audit record. For example, System > Monitoring > Audit is the menu path to view the audit log. In a few cases where a menu path is not relevant, the Subsystem field displays only the event type. For example, Login classifies user login attempts.
Message	The action the user performed or the button the user clicked on the page. For example, `Page View` signifies that the user simply viewed the page indicated in the Subsystem, while `Save` means that the user clicked the Save button on the page. Changes made to the Firepower System appear with a compare icon ( ) that you can click to see a summary of the changes.
Source IP	IP address associated with the host used by the user. Note: When searching this field you must type a specific IP address; you cannot use IP ranges when searching audit logs.
Domain	The current domain of the user when the audit event was triggered. This field is only present if you have ever configured the Firepower Management Center for multitenancy.
Configuration Change (search only)	Specifies whether to view audit records of configuration changes in the search results. (`yes` or `no`)
Count	The number of events that match the information that appears in each row. Note that the Count field appears only after you apply a constraint that creates two or more identical rows. This field is not searchable.

Related Concepts

Event Searches

The Audit Events Table View

You can change the layout of the event view or constrain the events in the view by a field value. When disabling columns, after you click the close icon () in the column heading that you want to hide, in the pop-up window that appears, click Apply. When you disable a column, it is disabled for the duration of your session (unless you add it back later). Note that when you disable the first column, the Count column is added.

To hide or show other columns, or to add a disabled column back to the view, select or clear the appropriate check boxes before you click Apply.

Clicking a value within a row in a table view constrains the table view and does not drill down to the next page in the workflow.

Tip

Table views always include “Table View” in the page name.

Related Tasks

Using Workflows

Using the Audit Log to Examine Changes

Smart License	Classic License	Supported Devices	Supported Domains	Access
Any	Any	Any	Any	Admin

You can use the audit log to view detailed reports of changes to your system. These reports compare the current configuration of your system to its most recent configuration before a particular change.

The Compare Configurations page displays the differences between the system configuration before changes and the running configuration in a side-by-side format. The audit event type, time of last modification, and name of the user who made the change are displayed in the title bar above each configuration.

Differences between the two configurations are highlighted:

Blue indicates that the highlighted setting is different in the two configurations, and the difference is noted in red text.
Green indicates that the highlighted setting appears in one configuration but not the other.

In a multidomain deployment, you can view data for the current domain and for any descendant domains. You cannot view data from higher level or sibling domains.

Procedure

Step 1

Choose System > Monitoring > Audit.

Step 2

Click the compare icon (

) next to an applicable audit log event in the Message column.

Tip

You can navigate through changes individually by clicking Previous or Next above the title bar. If the change summary is more than one page long, you can also use the scroll bar on the right to view additional changes.

Suppressing Audit Records

Smart License	Classic License	Supported Devices	Supported Domains	Access
Any	Any	Any	Any	Admin

If your auditing policy does not require that you audit specific types of user interactions with the Firepower System, you can prevent those interactions from generating audit records on a Firepower Management Center or 7000 and 8000 Series devices. For example, by default, each time a user views the online help, the Firepower System generates an audit record. If you do not need to keep a record of these interactions, you can automatically suppress them.

To configure audit event suppression, you must have access to an appliance’s admin user account, and you must be able to either access the appliance’s console or open a secure shell.

Caution

Make sure that only authorized personnel have access to the appliance and to its admin account.

Procedure

In the /etc/sf directory, create one or more AuditBlock files in the following form, where type is one of the types described in Audit Block Types: AuditBlock.type

Note

If you create anAuditBlock.type file for a specific type of audit message, but later decide that you no longer want to suppress them, you must delete the contents of the AuditBlock.type file but leave the file itself on the Firepower System.

Audit Block Types

The contents for each audit block type must be in a specific format, as described in the following table. Make sure you use the correct capitalization for the file names. Note also that the contents of the files are case sensitive.

Note that when you add an AuditBlock file, an audit record with a subsystem of Audit and a message of Audit FiltertypeChanged is added to the audit events. For security reasons, this audit record cannot be suppressed.

Table 2 Audit Block Types
Type	Description
Address	Create a file named `AuditBlock.address` and include, one per line, each IP address that you want to suppress from the audit log. You can use partial IP addresses provided that they map from the beginning of the address. For example, the partial address `10.1.1` matches addresses from `10.1.1.0` through `10.1.1.255`.
Message	Create a file named `AuditBlock.message` and include, one per line, the message substrings that you want to suppress. Note that substrings are matched so that if you include `backup` in your file, all messages that include the word `backup` are suppressed.
Subsystem	Create a file named `AuditBlock.subsystem` and include, one per line, each subsystem that you want to suppress. Note that substrings are not matched. You must use exact strings. See Audited Subsystems for a list of subsystems that are audited.
User	Create a file named `AuditBlock.user` and include, one per line, each user account that you want to suppress. You can use partial string matching provided that they map from the beginning of the username. For example, the partial username `IPSAnalyst` matches the user names `IPSAnalyst1` and `IPSAnalyst2`.

Audited Subsystems

The following table lists audited subsystems.

Table 3 Subsystem Names
Name	Includes user interactions with...
Admin	Administrative features such as system and access configuration, time synchronization, backup and restore, device management, user account management, and scheduling
Alerting	Alerting functions such as email, SNMP, and syslog alerting
Audit Log	Audit event views
Audit Log Search	Audit event searches
Command Line	Command line interface
Configuration	Email alerting
COOP	Continuity of operations feature
Date	Date and time range for event views
Default Subsystem	Options that do not have assigned subsystems
Detection & Prevention Policy	Menu options for intrusion policies
Error	System-level errors
eStreamer	eStreamer configuration
EULA	Reviewing the end user license agreement
Events	Intrusion and discovery event views
Events Clipboard	Intrusion event clipboard
Events Reviewed	Reviewed intrusion events
Events Search	Any event search
Failed to install rule update `rule_update_id`	Installing rule updates
Header	Initial presentation of the user interface after a user logs in
Health	Health monitoring
Health Events	Health monitoring event views
Help	Online help
High Availability	Establishing and managing Firepower Management Centers in high availability pairs
IDS Impact Flag	Impact flag configuration
IDS Policy	Intrusion policies
IDSRule sid:`sig_id` rev:`rev_num`	Intrusion rules by SID
Incidents	Intrusion incidents
Install	Installing updates
Intrusion Events	Intrusion events
Login	Web interface login and logout functions
Menu	Any menu option
Configuration export > `config_type` > `config_name`	Importing configurations of a specific type and name
Permission Escalation	User role escalation
Preferences	User preferences, such as the time zone for a user account and individual event preferences
Policy	Any policy, including intrusion policies
Register	Registering devices on a Management Center
RemoteStorageDevice	Configuring remote storage devices
Reports	Report listing and report designer features
Rules	Intrusion rules, including the intrusion rules editor and the rule importation process
Rule Update Import Log	Viewing the rule update import log
Rule Update Install	Installing rule updates
Status	Syslog, as well as host and performance statistics
System	Various system-wide settings
Task Queue	Viewing background process status
Users	Creating and modifying user accounts and roles

The System Log

The System Log (syslog) page provides you with system log information for the appliance. The system log displays each message generated by the system. The following items are listed in order:

the date that the message was generated
the time that the message was generated
the host that generated the message
the message itself

Viewing the System Log

Viewing the System Log

Smart License	Classic License	Supported Devices	Supported Domains	Access
Any	Any	Any	Global only	Admin/Maint

System log information is local. For example, you cannot use the Firepower Management Center to view system status messages in the system logs on your managed devices.

On a Firepower Management Center or 7000 & 8000 Series devices, you can modify your view of system log messages by filtering for specific components.

Procedure

Step 1	Choose System > Monitoring > Syslog.
Step 2	If you want to search for specific message content in the system log, see Filtering System Log Messages.

Filtering System Log Messages

Smart License	Classic License	Supported Devices	Supported Domains	Access
Any	Any	Any	Global only	Admin/Maint

On a Firepower Management Center or 7000 and 8000 Series devices, you can modify your view of system log messages by filtering for specific components. Filtering allows you to search for specific messages based on content.

The filter functionality uses the UNIX file search utility Grep, and as such, you can use most syntax accepted by Grep. This includes using Grep-compatible regular expressions for pattern matching. You can use a single word as a filter, or you can use Grep-supported regular expressions to search for content.

Procedure

Step 1

Choose System > Monitoring > Syslog.

Step 2

Enter a word or query in the filter field as described in Syntax for System Log Filters.

Note

Only Grep-compatible search syntax is supported. For example, you could search for all NTP-related system log messages by using ntp as a filter, or search for all messages generated in November by using Nov as a filter. You could view messages from November 27th by using Nov[[:space:]]*27 or Nov.*27, but you could not, however, use Nov 27 or Nov*27to view these messages.

Step 3

If you want to make your search case-sensitive, check Case-sensitive. (By default, filters are not case-sensitive.)

Step 4

Optionally, check Exclusion to search for all system log messages that do not meet the criteria you entered.

Step 5

Click Go.

Example

To search for all log entries that are generated on November 5, use Nov[[:space:]]*5.

To search for all log entries that contain the user name “Admin,” use Admin.

To search for all log entries that contain authorization debugging information on November 5, use Nov[[:space:]]*5.*AUTH.*DEBUG.

Syntax for System Log Filters

The following table shows the regular expression syntax you can use in System Log filters:

Table 4 System Log Filter Syntax
Syntax Component	Description	Example
`.`	Matches any character or white space	`Admi.` matches `Admin`, `AdmiN`, `Admi1`, and `Admi&`
`[[:alpha:]]`	Matches any alphabetic character	`[[:alpha:]]dmin` matches `Admin`, `bdmin`, and `Cdmin`
`[[:upper:]]`	Matches any uppercase alphabetic character	`[[:upper:]]dmin` matches `Admin`, `Bdmin`, and `Cdmin`
`[[:lower:]]`	Matches any lowercase alphabetic character	`[[:lower:]]dmin` matches `admin`, `bdmin`, and `cdmin`
`[[:digit:]]`	Matches any numeric character	`[[:digit:]]dmin` matches `0dmin`, `1dmin`, and `2dmin`
`[[:alnum:]]`	Matches any alphanumeric character	`[[:alnum:]]dmin` matches `1dmin`, `admin`, `2dmin`, and `bdmin`
`[[:space:]]`	Matches any white space, including tabs	`Feb[[:space:]]29` matches logs from February 29th
`*`	Matches zero or more instances of the character or expression it follows	`ab` matches `a`, `ab`, `abb`, `ca`, `cab`, and `cabb` `[ab]` matches anything
`?`	Matches zero or one instances	`ab?` matches `a` or `ab`
\	Allows you to search for a character typically interpreted as regular expression syntax	`alert\?` matches `alert?`

Was this Document Helpful?

Feedback

Contact Cisco

Open a Support Case
(Requires a Cisco Service Contract)

Firepower Management Center Configuration Guide, Version 6.0

Results

Chapter: Auditing the System

Auditing the System

About System Auditing

Audit Records

Viewing Audit Records

Audit Log Workflow Fields

The Audit Events Table View

Using the Audit Log to Examine Changes

Suppressing Audit Records

Audit Block Types

Audited Subsystems

The System Log

Viewing the System Log

Filtering System Log Messages

Example

Syntax for System Log Filters

Was this Document Helpful?

Contact Cisco

Related Support Community Discussions

Share