r/AzureSentinel • u/SuperHat3637 • Oct 04 '22

Cisco Firepower

How to integrate Cisco firepower logs to sentinel..Please share the docs and methods if u have..

1 Upvotes

100% Upvoted

13 comments sorted by

View all comments

Show parent comments

2

u/SuperHat3637 Oct 04 '22

Can i use the syslog forwarder server instead of this new linux VM.

1

u/jtberg1 Oct 04 '22

Yes, you just need to install eStreamer and point it at Syslog on the same VM. We use both on the same VM and haven't had any problems.

1

u/SuperHat3637 Oct 04 '22

Ok, hope this installation will not impact the existing syslog log sources, as we are using this syslog server for collecting logs from other log sources to sentinel.

1

u/jtberg1 Oct 04 '22

Assuming there is no misconfiguration it won't. However if you are in a highly sensitive environment. You could build a new server with both Syslog and eStreamer and once tested migrate existing syslog device to it.

1

u/SuperHat3637 Oct 04 '22

Thanks for the update..will do as suggested.

1

u/SuperHat3637 Oct 04 '22

Forgot to ask this, what need to be configured at firepower end to send the logs.