Review where logs generated by Secure Access are stored, what creates logs, and how to log to an S3 bucket, such as the Amazon S3 bucket.
When you create a policy, activity logs are by default saved to the North America – California, US location of the Secure Access data warehouse. You can change the location of the data warehouse to Europe at any time. For more information, see Change the Location of Event Data Logs.
You can also optionally configure logging so that logs are also stored to an Amazon S3 bucket—either your own or one managed by Cisco.
Logging to the Secure Access Data Warehouse
The Secure Access data warehouse is the virtual location where your instance of Secure Access stores its event data logs. By default, Secure Access saves your event data logs to Cisco's California location; however, you can change the location of the data warehouse from North America to Europe at any time. For more information, see Change the Location of Event Data Logs.
Logging to Amazon S3
As well as storing logs to one of its data warehouses, Secure Access can store logs to an Amazon S3 bucket.
By having your logs uploaded to an S3 bucket, you can then automatically download logs so that you can keep them in perpetuity in backup storage outside of the Secure Access data warehouse storage system. Saving to an S3 bucket also gives you the ability to ingest logs through your SIEM or another security tool. This can help you determine if any security events in your Secure Access logs coincide with events in other security tools.
Secure Access Amazon S3 options:
-
A self-managed bucket - You own the Amazon S3 bucket, including its configuration and management.
-
A Cisco-managed bucket - Cisco Secure Access owns the bucket and sets the configuration and management of it.
Advantages and Disadvantages of Configuring a Cisco-Managed Bucket
Review the following list of advantaged and disadvantages to consider if you opt to use a Cisco-managed bucket for logging:
-
Secure Access supports the rotation of the S3 bucket key every 90 days.
-
Included with your Secure Access license.
-
You cannot add anything to your S3 bucket besides log files from Secure Access. You cannot use your Cisco-managed S3 bucket for any other application.
-
Some SIEM integration types may require advanced privileges for the user accessing the S3 bucket (beyond the basic Read permissions) and as such, may not work with this feature.
-
You cannot get support from Amazon directly for advanced configuration assistance, such as automation or help with the command line.
-
Data can only be stored offline for a maximum of 30 days.
Additional Resources
If you discover that you need more information on logging and how Secure Access handles data in logging environments, review the following sources: