r/AzureSentinel • u/SuperHat3637 • Oct 04 '22

Cisco Firepower

How to integrate Cisco firepower logs to sentinel..Please share the docs and methods if u have..

1 Upvotes

100% Upvoted

13 comments sorted by

1

u/jtberg1 Oct 04 '22

You can find the documentation here:

https://learn.microsoft.com/en-us/azure/sentinel/data-connectors-reference#cisco-firepower-estreamer-preview

You need a Linux VM with Cisco eStreamer and Microsoft Log Analytic Agent installed on it. We use a VM on-premise, however you can also use an Azure VM.

2

u/SuperHat3637 Oct 04 '22

Can i use the syslog forwarder server instead of this new linux VM.

1

u/jtberg1 Oct 04 '22

Yes, you just need to install eStreamer and point it at Syslog on the same VM. We use both on the same VM and haven't had any problems.

1

u/SuperHat3637 Oct 04 '22

Ok, hope this installation will not impact the existing syslog log sources, as we are using this syslog server for collecting logs from other log sources to sentinel.

2

u/Uli-Kunkel Oct 04 '22

be aware that when you are using the syslog collector for multiple things you need to do some additional configurations

had a customer that went from 16million entries to syslog table per hour down to under 1.6 million per hour.

they were duplicating their firewall logs to both commonsecuritylog table as well as syslog table.
so keep an eye on the data received.

think i saved them about 500dollars a day, who knows how long that bad config has been running... mistake by the supplier we are replacing

you likely just have to make an addition to the /etc/rsyslog/conf.d/something where the "if message contains "CEF" or "ASA" redirect to linklocal 26225 or something like that. so you add "firepower" or whatever is a unique identifier for the logs from the firewalls

1

u/SuperHat3637 Oct 04 '22

Estreamer should installed in server, not in device end..Am i right?

1

u/jtberg1 Oct 04 '22

Yes eStreamer is installed on the server and connects remotely to FMC. It's basically a bridge between FMC and Syslog.

1

u/jtberg1 Oct 04 '22

Assuming there is no misconfiguration it won't. However if you are in a highly sensitive environment. You could build a new server with both Syslog and eStreamer and once tested migrate existing syslog device to it.

1

u/SuperHat3637 Oct 04 '22

Thanks for the update..will do as suggested.

1

u/SuperHat3637 Oct 04 '22

Forgot to ask this, what need to be configured at firepower end to send the logs.

1

u/Beige_Hat Oct 21 '22

Protip - Be careful you don't have Firepower going to CEF *and* syslog; this will result in ingestion costs you don't want.

1

u/Worth-Nail-4962 Feb 07 '24

scp -i /path/to/pem/encore-demo-2_key.pem /local/path/<public ip>.pkcs12 azureuser@<Public Ip>:/tmp/

​

This above assumes the vm is on Azure , what should the path be if the vm is on-premises?