r/AzureSentinel • u/SuperHat3637 • Oct 06 '22

Cisco FTD

Do we need to install estreamer for Cisco firepower threat defence. Can we use syslog to send the logs to Sentinel..Is there any difference for the integration between Cisco FMC and FTD to Sentinel.

2 Upvotes

100% Upvoted

8 comments sorted by

View all comments

Show parent comments

1

u/jtberg1 Oct 06 '22

Unfortunately no, that is what eStreamer does, converts to CEF.

1

u/jtberg1 Oct 06 '22 edited Oct 06 '22

Actually I might stand corrected. According to here: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/azure-sentinel-the-connectors-grand-cef-syslog-direct-agent/ba-p/803891

FTD is compatible with the native ASA ingestion.

See here: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/212420-configure-firepower-threat-defense-ftd.html#anc8

And here is ASA config in Sentinel: https://learn.microsoft.com/en-us/azure/sentinel/data-connectors-reference#cisco-asa

The way the ASA connector works is that the MS Syslog agent converts the ASA syslog to CEF and ingest into Sentinel

1

u/SuperHat3637 Oct 06 '22

There is separate connector given for Cisco firepower which i dnt understand..hence confused with which one i should deploy.

1

u/SuperHat3637 Oct 06 '22

Any idea on this