Cisco Secure Firewall Threat Defense and Cisco SecureX Threat Response Integration Guide

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco Secure Firewall Threat Defense and Cisco SecureX Threat Response Integration Guide

Chapter Title

Important Information About Integrating Secure Firewall Threat Defense and Cisco SecureX Threat Response

Results

Updated:
November 20, 2022

Chapter: Important Information About Integrating Secure Firewall Threat Defense and Cisco SecureX Threat Response

Important Information About Integrating Secure Firewall Threat Defense and Cisco SecureX Threat Response

About Cisco SecureX Threat Response and This Integration

Cisco SecureX threat response (formerly Cisco Threat Response or CTR) is the platform in the Cisco cloud that helps you detect, investigate, analyze, and respond to threats using data aggregated from multiple products and sources.

This integration sends supported events from devices to Cisco SecureX threat response for analysis alongside data from your other products and other sources.

For more information about Cisco SecureX threat response, see https://www.cisco.com/c/en/us/products/security/threat-response.html. For videos about the use and benefits of the application on YouTube, see http://cs.co/CTRvideos.

For more information about this integration, see the FAQs at http://cs.co/ctr_firepower_faq and the online help in Cisco SecureX threat response, including the release notes.

Cisco SecureX Threat Response Regional Clouds

Region

Link to Cloud

Supported Integration Methods

North America

https://visibility.amp.cisco.com

  • Direct integration:

    Release 6.4 and later

  • Integration via syslog:

    Release 6.3 and later

Europe

https://visibility.eu.amp.cisco.com

  • Direct integration:

    Release 6.5 and later

  • Integration via syslog:

    Release 6.3 and later

Asia (APJC)

https://visibility.apjc.amp.cisco.com

  • Direct integration:

    Release 6.5 and later

  • Integration via syslog:

    Release 6.3 and later

Guidelines and Limitations for Choosing a Regional Cloud

Before choosing a regional cloud, consider these important points:

  • Selecting regional cloud depends on your version and integration method (syslog or direct).

    See Cisco SecureX Threat Response Regional Clouds for specifics.

  • When possible, use the regional cloud nearest to your deployment.

  • You cannot merge or aggregate data in different regional clouds.

  • If you need to aggregate data from multiple regions, devices in all regions must send data to the same regional cloud.

  • You can create an account on each regional cloud and the data on each cloud remains separate.

  • The region you select in your product is also used for the Cisco Support Diagnostics and Cisco Support Network features, if applicable and enabled. For more information about these features, see the online help for your product.

Supported Event Types

The threat defense and Cisco SecureX threat response integration supports the following event types:

Table 1. Version Support for Sending Events to the Cisco Cloud

Feature

Devices Managed by Secure Firewall Management Center Version

(Direct integrations)

Devices Managed by Secure Firewall Device Manager Version

(Direct integrations)

Syslog

Intrusion (IPS) events

6.3 and later (via syslog)

6.4 and later (via direct connection)

6.3 and later (via syslog)

6.4 and later (via direct connection)

Supported

Security Intelligence connection events

6.5 and later

6.5 and later

Not supported

File and malware events

6.5 and later

6.5 and later

Not supported

Comparison of Methods for Sending Events to the Cloud

Devices make events available to Cisco SecureX threat response through the Security Services Exchange portal, either using syslog or directly.

Sending Events Directly

Sending Events Using Syslog Through a Proxy Server

Supports only threat defense (NGFW) devices running supported versions of software.

Supports all devices running supported versions of software.

Supports version 6.4 and later.

Supports version 6.3 and later.

Supports all event types listed in Supported Event Types.

Supports only intrusion events.

Supports SecureX tiles that show system status information such as whether your appliances and devices are running the optimal software versions.

System status features are not supported with syslog-based integrations.

Threat defense devices must be connected to the internet.

Devices do not need to be connected to the internet.

Your deployment cannot be using a Smart Software Manager on-premises server (formerly known as a Smart Software Satellite Server).

Your deployment can be using a Smart Software Manager on-premises server.

No need to set up and maintain an on-premises proxy server.

Requires an on-premises virtual Cisco Security Services Proxy (CSSP) server.

More information about this proxy server is available from the online help in Security Services Exchange (SSE).

To access SSE, see Access Security Services Exchange.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco