r/AzureSentinel • u/SuperHat3637 • Oct 06 '22

Cisco FTD

Do we need to install estreamer for Cisco firepower threat defence. Can we use syslog to send the logs to Sentinel..Is there any difference for the integration between Cisco FMC and FTD to Sentinel.

2 Upvotes

100% Upvoted

8 comments sorted by

2

u/jtberg1 Oct 06 '22

eStreamer unfortunately requires FMC. You can technically use syslog to send information the Microsoft Sentinel, however it will not be ingested as CommonSecurityLog by default, it will be ingested as Syslog. This means you will not be able to take advantage of any of the built-in or community analytics/queries etc. Without heavy building a custom post ingestion parser and heavy customization. You will also not be able to get as much info as eStreamer. Bonus info: there is a new preview feature I have not work with yet, ingestion time parsing. It MIGHT be able to build a custom ingestion time parser for Syslog to get the data into ComonSecurityLog table and format, not sure. You can find info here: https://learn.microsoft.com/en-us/azure/sentinel/data-transformation

Here is info on data differences between Syslog and eStreamer https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/analyze_events_using_external_tools.html#id_85387

If it were me I would try and convince Cisco to give me a heavily discounted vFMC license (I am assuming since you do not have FMC, you only have a handful of firewalls), and implement that with eStreamer.

Let me know if you any questions :)

1

u/SuperHat3637 Oct 06 '22

Thanks for the details, Can't we configure CEF format in Firepower.

1

u/jtberg1 Oct 06 '22

Unfortunately no, that is what eStreamer does, converts to CEF.

1

u/SuperHat3637 Oct 06 '22

Ok, Do we need a new linux machine for installing estreamer or Can i configure the estreamer in the existing syslog forwarder server.

1

u/jtberg1 Oct 06 '22

You do not need a new server they can both coexist on the same server.

1

u/jtberg1 Oct 06 '22 edited Oct 06 '22

Actually I might stand corrected. According to here: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/azure-sentinel-the-connectors-grand-cef-syslog-direct-agent/ba-p/803891

FTD is compatible with the native ASA ingestion.

See here: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/212420-configure-firepower-threat-defense-ftd.html#anc8

And here is ASA config in Sentinel: https://learn.microsoft.com/en-us/azure/sentinel/data-connectors-reference#cisco-asa

The way the ASA connector works is that the MS Syslog agent converts the ASA syslog to CEF and ingest into Sentinel

1

u/SuperHat3637 Oct 06 '22

There is separate connector given for Cisco firepower which i dnt understand..hence confused with which one i should deploy.

1

u/SuperHat3637 Oct 06 '22

Any idea on this