Cisco FirePower Threat Defense (FTD)

Cisco Firepower Threat Defense (FTD) combines the power of Cisco’s ASA firewall with its own IDS, previously called SourceFire IDS.

For versions v6.3 and higher, you forward syslog from your Cisco FTD device in order for events to appear in InsightIDR.

Configure Syslog Forwarding from Cisco FTD

To configure syslog forwarding, you must complete these steps:

• Configure Syslog Forwarding from Cisco FTD
  • Enable Logging
  • Configure Logging Level
  • Configure Syslog Settings
  • Configure Syslog Alerting for Intrusion Events
• Configure InsightIDR to collect data from the event source
• Verify the Configuration
  • Example Input Log

Enable Logging

Logging must be enabled to configure syslog forwarding from Cisco FTD.

To enable logging, follow Cisco’s documentation at: https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200479-Configure-Logging-on-FTD-via-FMC.html#toc-hId-1970026004

Configure Logging Level

You must configure logging levels to define the number of messages to be sent to InsightIDR.

To configure logging levels, follow Cisco's documentation at: https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200479-Configure-Logging-on-FTD-via-FMC.html#toc-hId--41694258

Configure Syslog Settings

You must configure syslog settings to configure the facility values included in the syslog messages.

To configure syslog settings, follow Cisco's documentation at: https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200479-Configure-Logging-on-FTD-via-FMC.html#toc-hId--614483066

Configure Syslog Alerting for Intrusion Events

You must configure syslog alerting for intrusion events.

To do so, follow Cisco's documentation at: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Configuring_External_Alerting_for_Intrusion_Rules.html#ID-2212-000001bf

This configuration shows the event ids 430001, 430002, and 430003 in your syslog settings, and sends them to InsightIDR for parsing.

Configure InsightIDR to collect data from the event source

After you complete the prerequisite steps and configure the event source to send data, you must add the event source in InsightIDR.

To configure the new event source in InsightIDR:

1. From the left menu, go to Data Collection and click Setup Event Source > Add Event Source.
2. Do one of the following:
   • Search for Cisco FTD in the event sources search bar.
   • In the Product Type filter, select Firewall.
3. Select the Cisco FTD event source tile.
4. Choose your collector.
5. In the Select Event Source Type field, choose the option that corresponds to your Cisco Security Solution as outlined in the following table:

You can also name your event source if you want.

6. Choose the timezone that matches the location of your event source logs.
7. Optionally choose to send unparsed logs.
8. Select an attribution source.
9. Configure your default domain and any advanced settings.
10. Select syslog and specify a port and a protocol.

• Optionally choose to encrypt the event source if choosing TCP by downloading the Rapid7 Certificate.

11. Click the Save button.

Verify the Configuration

To see Cisco FTD logs in InsightIDR: From the left menu, click Log Search to view your logs to ensure events are being forwarded to the Collector. Select the applicable Log Sets and the Log Names within them. The Log Name will be the event source name or “Cisco FTD” if you did not name the event source. Cisco FTD logs flow into these Log Sets:

• Unified Asset Authentication
• Ingress Authentication
• Firewall
• VPN Session
• Web Proxy
• Intrusion Detection System (IDS)

Example Input Log

The following logs are examples of parsed syslog events from Cisco FTD.

To learn about what these codes mean, see the Cisco documentation here: https://www.cisco.com/c/en/us/td/docs/security/firepower/Syslogs/b_fptd_syslog_guide.html

Cisco FTD can also produce logs in the same format as some Sourcefire 3D log entries. These log entries do not contain an Event ID. Here is an example of these logs:

<113>Mar 18 11:38:39 Sourcefire3D sfdc1500avc: [Primary Detection Engine (11727814-7b90-11e2-b768-a8d573eb9cc3)][MHPSA] Connection Type: Start, User: Unknown, Client: SSL client, Application Protocol: HTTPS, Web App: Unknown, Access Control Rule Name: CatchAll-Scan_for_Malware, Access Control Rule Action: Allow, Access Control Rule Reasons: Unknown, URL Category: Parked Domains, URL Reputation: Well known, URL: https://rapid7.com, Interface Ingress: s1p1, Interface Egress: s1p2, Security Zone Ingress: Internal, Security Zone Egress: External, Security Intelligence Matching IP: None, Security Intelligence Category: None, Client Version: (null), Number of File Events: 0, Number of IPS Events: 0, TCP Flags: 0x0, NetBIOS Domain: (null), Initiator Packets: 4, Responder Packets: 4, Initiator Bytes: 608, Responder Bytes: 4368, Context: Unknown, SSL Rule Name: N/A, SSL Flow Status: N/A, SSL Cipher Suite: N/A, SSL Certificate: 0000000000000000000000000000000000000000, SSL Subject CN: N/A, SSL Subject Country: N/A, SSL Subject OU: N/A, SSL Subject Org: N/A, SSL Issuer CN: N/A, SSL Issuer Country: N/A, SSL Issuer OU: N/A, SSL Issuer Org: N/A, SSL Valid Start Date: N/A, SSL Valid End Date: N/A, SSL Version: N/A, SSL Server Certificate Status: N/A, SSL Actual Action: N/A, SSL Expected Action: N/A, SSL Server Name: (null), SSL URL Category: N/A, SSL Session ID: 0000000000000000000000000000000000000000000000000000000000000000, SSL Ticket Id: 0000000000000000000000000000000000000000, {TCP} 10.7.30.21:53431 -> 66.55.15.70:443