--- title: "Integrate Cisco Firepower with Red Canary" slug: "integrate-cisco-firepower-with-red-canary" updated: 2026-09-09T16:09:35Z published: 2026-09-09T16:09:35Z canonical: "docs.redcanary.com/integrate-cisco-firepower-with-red-canary" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # Integrate Cisco Firepower with Zscaler MDR Integrating Cisco Firepower with Zscaler MDR enhances threat detection and response capabilities by centralizing security data and automating incident response workflows. To integrate Cisco Firepower with Zscaler MDR, follow the procedure below. ## Prerequisites Before you start the Firepower integration, please make sure the following requirements are met: - You have a Firepower Management Center (FMC) login account with sufficient administrator permissions to configure the Syslog settings. ## 1 Zscaler MDR | Add the Integration The first step is to add the new integration in Zscaler MDR. 1. In the Zscaler MDR portal, go to the **Integrations** page then click **Add Integration**. ![Add a new Red Canary integration](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations-main.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A11%3A33Z&se=2026-10-30T07%3A11%3A33Z&sr=c&sp=r&sig=6OwgHAOTsP1hOdTP91YNTOGmdnEHHqfQmhq4FERkNFE%3D) 2. On the **Add integration** dialog, search for the **Cisco Firepower** integration then click **Configure**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/firepower-1_01.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A11%3A33Z&se=2026-10-30T07%3A11%3A33Z&sr=c&sp=r&sig=6OwgHAOTsP1hOdTP91YNTOGmdnEHHqfQmhq4FERkNFE%3D) 3. On the **Add Integration page**, enter a name for the integration. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/firepower-1_02.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A11%3A33Z&se=2026-10-30T07%3A11%3A33Z&sr=c&sp=r&sig=6OwgHAOTsP1hOdTP91YNTOGmdnEHHqfQmhq4FERkNFE%3D) ## 2 Zscaler MDR | Choose How Zscaler MDR Receives the Data Setting the ingest method determines how Zscaler MDR will receive data from Firepower. 1. In the **Choose how Zscaler MDR will receive this data** section, select **Cisco Firepower via Syslog** (recommended) or **Cisco Firepower via Email**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/ciscofirepower-2_04.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A11%3A33Z&se=2026-10-30T07%3A11%3A33Z&sr=c&sp=r&sig=6OwgHAOTsP1hOdTP91YNTOGmdnEHHqfQmhq4FERkNFE%3D) 2. Click **Next**. ## 3 Zscaler MDR | Configure Zscaler MDR to Retrieve the Data The integration will automatically provision a Zscaler MDR email address to which Firepower can send its logs. 1. In the **Configure Zscaler MDR to retrieve data from this integration** section, make sure the **Use TLS to deliver alerts** box is checked. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/firepower-3_01.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A11%3A33Z&se=2026-10-30T07%3A11%3A33Z&sr=c&sp=r&sig=6OwgHAOTsP1hOdTP91YNTOGmdnEHHqfQmhq4FERkNFE%3D) > [!NOTE] > Note > > You should only uncheck **Use TLS to deliver alerts** if you’re testing the integration and don’t need Transport Layer Security (TLS) certificates enabled. Production integrations should alway use TLS certificates to protect the integrity of the email data in transit to Zscaler MDR. 2. Click **Provision** to generate an email address to receive the log data sent from Firepower. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/firepower-3_02.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A11%3A33Z&se=2026-10-30T07%3A11%3A33Z&sr=c&sp=r&sig=6OwgHAOTsP1hOdTP91YNTOGmdnEHHqfQmhq4FERkNFE%3D) 3. After a few seconds, Zscaler MDR will display the provisioned email. Copy the address so you can enter it into the **Firepower Management Center (FMC)** in the next step.![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/firepower-3_03.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A11%3A33Z&se=2026-10-30T07%3A11%3A33Z&sr=c&sp=r&sig=6OwgHAOTsP1hOdTP91YNTOGmdnEHHqfQmhq4FERkNFE%3D) ## 4 Firepower | Configure Email Forwarding In order for Firepower to pass alerts to Zscaler MDR, you need to forward the logs to the email address provisioned in the previous section. 1. Log in to the **Firepower** **Management Center (FMC)**. 2. Go to **Device > Platform Setting > Threat Defense Policy > Syslog > Email Setup**. 3. Click **Add**. 4. In the **Destination Email Address** field, enter the Zscaler MDR email address provisioned above. 5. In the **Syslog Severity** drop-down, choose **warning**. 6. Click **OK** to save the configuration. 7. Click **Save** to save the platform settings. 8. Go to **Deploy**, choose the FTD appliance where you want to apply the changes, then click **Deploy**. For additional information, please see the [Cisco FMC documentation](https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200479-Configure-Logging-on-FTD-via-FMC.html#toc-hId-2061790978). > [!WARNING] > Email Format > > Zscaler MDR needs to ingest the log as originally formatted by Firepower. Make sure that any perimeter devices in line between Firepower and Zscaler MDR aren’t subsequently reformatting the email to HTML. ## 5 Zscaler MDR | Confirm the Configuration 1. In the **Configure Zscaler MDR to retrieve data from this integration** section, go to **Section 2b (Send data to Zscaler MDR)** and check the **I’ve configured this integration to send data to Zscaler MDR** box. (This confirms that you’ve completed the [Configure Email Forwarding](/doc/docs/integrate-cisco-firepower-with-red-canary#4-firepower-configure-email-forwarding) steps above.) ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/firepower-4_01.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A11%3A33Z&se=2026-10-30T07%3A11%3A33Z&sr=c&sp=r&sig=6OwgHAOTsP1hOdTP91YNTOGmdnEHHqfQmhq4FERkNFE%3D) 2. Click **Next**. ## 6 Zscaler MDR | Customize Data Handling **[OPTIONAL]** In the **Customize how data from this integration is handled** section, enable **Process Correlation** if appropriate. > [!NOTE] > What is Process Correlation? > > If a third-party alert platform lets you create your own rules to trigger alerts, Zscaler MDR can correlate with the rule metadata when it displays the alerts in the timeline. To conserve API bandwidth and compute cycles, process correlation for user-defined alerts is disabled by default. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/fortigateanalyzer-8_01.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A11%3A33Z&se=2026-10-30T07%3A11%3A33Z&sr=c&sp=r&sig=6OwgHAOTsP1hOdTP91YNTOGmdnEHHqfQmhq4FERkNFE%3D) ## 7 Zscaler MDR | Activate the Integration After you’ve finished the configuration, click **Save** to activate the integration. > [!TIP] > The Firepower integration is now live! > > You should see alerts start appearing in Zscaler MDR within 24 hours. ## 8 Zscaler MDR | Modifying the Integration Once the integration is active, there are no routine maintenance tasks to perform. However, you’ll need to modify the configuration if you want to deactivate or remove the integration. To modify the configuration: 1. In the Zscaler MDR portal, go to the **Integrations** page then click on the name of the integration you want to modify. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/firepower-8_01.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A11%3A33Z&se=2026-10-30T07%3A11%3A33Z&sr=c&sp=r&sig=6OwgHAOTsP1hOdTP91YNTOGmdnEHHqfQmhq4FERkNFE%3D) #### Deactivating the Integration To suspend alerts for this integration, click the ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integration-deactivate-button.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A11%3A33Z&se=2026-10-30T07%3A11%3A33Z&sr=c&sp=r&sig=6OwgHAOTsP1hOdTP91YNTOGmdnEHHqfQmhq4FERkNFE%3D) button. The status displayed on the **Integrations** page changes to “Inactive” and no alerts will be passed to Zscaler MDR. If necessary, you can reactivate it later by clicking ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integration-activate-button.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A11%3A33Z&se=2026-10-30T07%3A11%3A33Z&sr=c&sp=r&sig=6OwgHAOTsP1hOdTP91YNTOGmdnEHHqfQmhq4FERkNFE%3D). > [!NOTE] > Note > > Deactivating or reactivating the integration takes effect immediately. You don’t need to click **Save** to confirm the action. #### Decommissioning the Integration To remove the integration from Zscaler MDR, click the ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integration-delete-button.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A11%3A33Z&se=2026-10-30T07%3A11%3A33Z&sr=c&sp=r&sig=6OwgHAOTsP1hOdTP91YNTOGmdnEHHqfQmhq4FERkNFE%3D) button then click **OK** to confirm. > [!WARNING] > Important > > If you decommission the integration, no new alerts will be sent to Zscaler MDR and all processed alerts will be deleted. This action cannot be undone.