Cisco Firepower
Previously known as Sourcefire 3D, Cisco Firepower is an intrusion detection response system that produces security data and enhances the InsightIDR analysis. You can also send Web Proxy events from Cisco Firepower. InsightIDR automatically separates and parses your IDS and Web proxy logs from this application.
Configuration Instructions work for Cisco Firepower, Sourcefire 3D, and Cisco FireSIGHT
The configuration instructions in this document work for Cisco Firepower, Sourcefire 3D, and Cisco FireSIGHT. Even if you have Cisco Firepower or Cisco FireSIGHT, you still must select Sourcefire 3D in the Event Source dropdown list when configuring in InsightIDR.
Learn more about Cisco Firepower here: https://supportforums.cisco.com/t5/intrusion-prevention-systems-ids/firepower-vs-ngips-vs-firesight-vs-firepower-management-center/td-p/2975375.
Configure Sourcefire 3D, Cisco Firepower, or Cisco FireSIGHT to Send Alerts to InsightIDR
- Go to the SourceFire admin panel.
- Select Policies > Actions > Alerts. A pop-up window appears.
- From the Create Alert drop-down menu, select Create Syslog Alert. A dialog box appears.
- In the Name field, type the name you want to use to identify the saved response.
- In the Host field, type the hostname or IP address of your syslog server.
- Note that the system does not warn you if you enter an invalid IPv4 address in this field (such as 192.168.1.456). Instead, the invalid address is treated as a hostname.
- In the Port field, enter the port that you will configure your InsightIDR collector to use for this event source.
- By default, this value is 514.
- Select ALERT for facility.
- Select ALERT severity.
- In the Tag field, type the tag name that you want to appear with the syslog message. Use only alphanumeric characters in tag names. You cannot use spaces or underscores.
- Click Save.
When you create an alert response, it is automatically enabled. Only enabled alert responses can generate alerts. To stop alerts from being generated, you can temporarily disable alert responses rather than deleting your configurations.
Use these resources for detailed configuration instructions:
- https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118464-configure-firesight-00.html
- https://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401/Alerting.html
- https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Configuring_External_Alerting_for_Intrusion_Rules.html#ID-2212-000001bf
Syslog Example
How to Configure This Event Source in InsightIDR
- From your dashboard, select Data Collection on the left menu.
- When the Data Collection page appears, click Setup Event Source and select Add Event Source from the dropdown list.
- From the Security Data section, click the IDS icon. The Add Event Source panel appears.
- Choose your collector.
- In the Select Event Source Type field, choose the option that corresponds to your Cisco Security Solution as outlined in the following table:
| Cisco Security Solution | InsightIDR Event Source Type |
|---|---|
| ASA | Cisco ASA event-source |
| NGIPS | Cisco ASA event-source |
| NGFW | Cisco ASA event-source |
| Any other firepower service | Cisco ASA event-source |
| Cisco ASA with FirePower services | Cisco ASA event-source |
| Cisco FirePower Threat Defense (FTD) | Cisco FTD event-source |
| Sourcefire 3D | Cisco FirePower (Sourcefire 3D) event-source |
You can also name your event source if you want.
- Choose the timezone that matches the location of your event source logs.
- Optionally choose to send unparsed logs.
- Select an attribution source.
- Select Listen on Network Port and specify the port you used earlier along with a protocol.
- Optionally choose to Encrypt the event source if choosing TCP by downloading the Rapid7 Certificate.
- Click Save.
Attribution source options
Sourcefire 3D, Cisco Firepower, or Cisco FireSIGHT logs can contain information about hosts and accounts. When setting up Sourcefire 3D, Cisco Firepower, or Cisco FireSIGHT as an event source, you will have the ability to specify the following attribution options:
- Use IDR engine if possible; if not, use event log
By selecting this option, the InsightIDR attribution engine will perform attribution using the source address present in the log lines. If it's unable to resolve assets or accounts using the source address, it will use the assets or accounts present in the log lines, if any.
- Use event log if possible; if not, use IDR engine
By selecting this option, attribution will be done using the assets and accounts present in the log lines. If no assets or accounts are present in the log lines, the InsightIDR attribution engine will perform attribution using the source address present in the log lines.
- Use IDR engine only
By selecting this option, the InsightIDR attribution engine will perform the attribution using the source address present in the log lines, ignoring any assets and accounts present in the log lines.
- Use event log only
By selecting this option, attribution will be done using the assets and accounts present in the log lines, ignoring the source address.
Verify the Configuration
To see Cisco Firepower logs in InsightIDR: From the left menu, click Log Search to view your logs to ensure events are being forwarded to the Collector. Select the applicable Log Sets and the Log Names within them. The Log Name will be the event source name or “Cisco Firepower” if you did not name the event source. Cisco Firepower logs flow into these Log Sets:
- Web Proxy
- Intrusion Detection System (IDS)
Logs take a minimum of 7 minutes to appear in Log Search
Please note that logs take at least 7 minutes to appear in Log Search after you set up the event source.
Example Input Logs
Your Cisco Firepower logs will look similar to the following:
log
log
log
log
log
log