Cisco Firepower Threat Defense (FTD)

• Event Types
• Rules
• Reports
• Configuration
• Settings for Access Credentials
• Comparison of Syslog and eStreamer for Security Eventing

Event Types

In ADMIN > Device Support > Event Types, search for "cisco-ftd" to see the event types associated with this device.

Rules

There are no specific rules available for Cisco Firepower Threat Defense. Matches device agnostic firewall rules.

Reports

There are no specific reports available for Cisco Firepower Threat Defense. Matches device agnostic firewall rules.

Configuration

Before configuring, you may want to see a comparison of Syslog and eStreamer for Security Eventing first.

FirePower Threat Defense SNMP Configuration through Firepower Management Center

Cisco Firepower Threat Defense (FTD) supports SNMPv1, v2c, and SNMPv3. Take the following steps to configure:

1. Login to the Firepower Management Center (FMC) GUI, and navigate to Devices > Platform Settings > (Policy) > SNMP.

2. Check the Enable SNMP Servers checkbox, and configure the SNMPv2 settings.

3. Click on the Hosts tab.

4. Click on Add, and specify your SNMP server settings in the Add SNMP Management Hosts window.

5. Deploy the policy.

For the latest configuration instructions and information, see Configuring SNMP for FTD at https://www.cisco.com/c/en/us/products/collateral/security/firepower-ngfw/white-paper-c11-741739.html.

FirePower Threat Defense Syslog Configuration through Firepower Management Center

To configure Syslog, take the following steps:

1. Login to the Firepower Management Center (FMC) GUI, and navigate to Device > Platform Setting > Threat Defense Policy > Syslog > Logging Destinations.

2. Click Add to add a Logging Filter for a specific logging destination.

3. From the Logging Destination drop-down list, choose the logging destination.

For the latest configuration instructions and information, see https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200479-Configure-Logging-on-FTD-via-FMC.html.

Settings for Access Credentials

• SNMP Access Credentials for All Devices

• Telnet Access Credentials for All Devices

• SSH Access Credentials for All Devices

SNMP Access Credentials for All Devices

Use these Access Method Definition settings to allow FortiSIEM to access your device over SNMP. Set the Name and Community String.

Setting	Value
Name	<set name>
Device Type	Generic
Access Protocol	SNMP
Community String	<your own>

Telnet Access Credentials for All Devices

These are the generic settings for providing Telnet access to your device from FortiSIEM.

Setting	Value
Name	Telnet-generic
Device Type	generic
Access Protocol	Telnet
Port	23
User Name	A user who has permission to access the device over Telnet
Password	The password associated with the user

SSH Access Credentials for All Devices

These are the generic settings for providing SSH access to your device from FortiSIEM.

Setting	Value
Name	ssh-generic
Device Type	Generic
Access Protocol	SSH
Port	22
User Name	A user who has access credentials for your device over SSH
Password	The password for the user

Comparison of Syslog and eStreamer for Security Eventing

The following content is taken from https://www.cisco.com/c/en/us/td/docs/security/firepower/670/configuration/guide/fpmc-config-guide-v67/analyze_events_using_external_tools.html#id_102110.

Generally, organizations that do not currently have significant existing investment in eStreamer should use syslog rather than eStreamer to manage security event data externally.

Syslog	eStreamer
No customization required	Significant customization and ongoing maintenance required to accommodate changes in each release
Standard	Propriety
Sends directly from devices	Sends from FMC, adding processing overhead
Support for file and malware events, connection events (including security intelligence events) and intrusion events.	Support for all event types listed in eStreamer Server Streaming.
Some event data can be sent only from FMC. See Data Sent Only via eStreamer, Not via Syslolog.	Includes data that cannot be sent via syslog directly from devices. See Data Send Only via eStreamer, Not via Syslog.