The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
From release 6.3 onwards, you can use syslog to send supported events to the Cisco cloud from devices. You must set up an on-premises Cisco Security Services Proxy (CSSP) server and configure your devices to send syslog messages to this proxy.
Every 10 minutes, the proxy forwards collected events to Security Services Exchange (SSE), from where they can be automatically or manually promoted to incidents that appear in SecureX.
|
Requirement Type |
Requirement |
|---|---|
|
Device |
Any device running a supported version of software. |
|
Version |
6.3 or later. |
|
Account on the SecureX cloud that you will use |
|
|
Licensing |
No special license is required for this integration. However:
|
|
General |
Your system is generating events as expected. |
 Note |
If your devices are already sending events to the cloud, you do not need to configure sending them again. SecureX and Cisco SecureX threat response (formerly Cisco Threat Response) use the same set of event data. |
|
Do This |
More Information |
|||
|---|---|---|---|---|
| Step | Decide which events you want to send to the cloud, the method of sending events and the regional cloud to use. | See the topics under Introduction to Integrating Secure Firewall Management Center and SecureX. | ||
|
Step |
Meet the requirements. |
|||
|
Step |
Access Security Services Exchange (SSE), the portal for SecureX that you use for managing devices and filtering events. |
|||
| Step |
Install and configure a Cisco Security Services Proxy (CSSP) server. |
Download the free installer and instructions from Security Services Exchange: In Security Services Exchange, from the Tools icon near the top-right of the browser window, select Downloads. |
||
|
Step |
In Security Services Exchange, enable features. |
Click Cloud Services and enable the following options:
|
||
|
Step |
Configure your devices to send syslog messages for supported events to the proxy server. |
Look in the management center online help for information about syslog in the "Event Analysis Using External Tools" chapter. |
||
|
Step |
In your product, ensure that the messages identify the device that generated each event. |
In your management center, under the Platform Settings Syslog Settings tab, Enable Syslog Device ID, and specify an identifier. |
||
|
Step |
Allow time for your system to generate supported events. |
-- |
||
|
Step |
Verify that your events appear as expected in Security Services Exchange and troubleshoot if necessary. |
See: |
||
|
Step |
In Security Services Exchange, configure the system to automatically promote significant events. |
See information in the online help in Security Services Exchange about promoting events. To access SSE, see Access Security Services Exchange. |
||
|
Step |
(Optional) In Security Services Exchange, configure automatic deletion of certain nonsignificant events. |
For more information on filtering events, see Security Services Exchange online help. To access SSE, see Access Security Services Exchange. |
||
|
Step |
In SecureX, add a module. |
In SecureX, navigate to Integration Modules > Integration and add a module. For more information about this module, see the online help in SecureX. |
In your browser, disable pop-up blocking.
|
Step 1 |
In a browser window, go to your SecureX cloud:
|
|
Step 2 |
Sign in using the credentials for your SecureX, Secure Endpoint, Secure Malware Analytics, or Cisco Security account. Your account credentials are specific to the regional cloud. |
|
Step 3 |
Navigate to Security Services Exchange: Select and click Launch. Security Services Exchange opens in a new browser window. |
Verify that the events appear in the device as you expected.
|
Step 1 |
Wait for about 15 minutes after your device has detected a supported event to allow messages to be forwarded from the proxy to Security Services Exchange. |
|
Step 2 |
Access Security Services Exchange. For more information, see Access Security Services Exchange. |
|
Step 3 |
In Security Services Exchange, click Events. |
|
Step 4 |
Look for events from your device. If you do not see the expected events, see tips in Troubleshoot a Syslog Integration and look again at How to Send Events to the Cisco Cloud Using Syslog. |
Make sure your devices can reach CSSP on the network.
If you activate your cloud account immediately before attempting to configure this integration and you encounter problems implementing this integration, try waiting an hour or two and then log in to your cloud account.
Make sure you are accessing the correct URL for the regional cloud associated with your account.
Check the following:
Click the Refresh button on the Events page to refresh the list.
Verify that the expected events appear on the device.
Check your configurations for automatic deletion (filtering out events) in the Eventing settings on the Cloud Services page in SSE.
Make sure you are viewing the regional cloud to which you are sending your events.
For syslog fields and descriptions, see the Threat Defense Syslog Messages.
If you are using custom Security Intelligence objects in the management center, including global block or allow lists, you must configure SSE to auto-promote events that are processed using those objects. See information in the SSE online help about promoting events to incidents.
Feedback