--- title: "Integrate Cisco Adaptive Security Appliance with the Security Data Lake" slug: "integrate-cisco-adaptive-security-appliance-with-the-security-data-lake" updated: 2026-10-07T17:15:14Z published: 2026-10-07T17:15:14Z canonical: "docs.redcanary.com/integrate-cisco-adaptive-security-appliance-with-the-security-data-lake" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # Integrate Cisco Adaptive Security Appliance with the Security Data Lake Cisco Adaptive Security Appliance (ASA) is a popular legacy firewall solution from Cisco. Data from your Cisco ASA integrations is [stored](/doc/docs/search-and-export-data-from-the-security-data-lake), [searchable](/doc/docs/searching-your-data), and [used as context](/doc/docs/view-investigations#related-data-by-query-tab) in threat investigations. ## How does it work? This ingest method works by creating a Zscaler MDR-managed syslog server that you can use to receive logs from Cisco ASA. You will be provided the fully qualified hostname and port of the syslog server to which you will point your Cisco appliance. Authentication is handled via TLS. By integrating your security logs with the Zscaler Security Data Lake, you can meet data retention requirements, export logs when needed for investigation or reporting, and ensure greater visibility into your security infrastructure for your team and Zscaler MDR. To integrate Cisco ASA with Zscaler MDR, follow the procedure below from beginning to end. ## Prerequisites Before you start the syslog integration, please make sure the following requirements are met: 1. You have an active Zscaler Security Data Lake license. 2. You have appropriate admin permissions to make configuration changes in Cisco ASA. ## 1 | Zscaler MDR | Add a new data lake integration 1. In the Zscaler MDR portal, navigate to **Integrations** and click **Add Integration**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(484).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 2. In the modal that appears, search for “Cisco Adaptive Security Appliance”. When the tile appears, click **Configure**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(492).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 3. Enter a name for your integration. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(493).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 4. Choose how Zscaler MDR will receive this data: 1. Under **Ingest Format / Method**, select **Cisco Adaptive Security Appliance via Syslog**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(495).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 2. Click the **Next** button. 5. Configure Zscaler MDR to retrieve data from this integration: 1. Click the **Provision** button. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(401).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 2. This will save and activate your integration. If successful, you should get a “Collector provisioned successfully” notification. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(425).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 3. Under **Send data to Zscaler MDR**, there will be a **URL** and **Port** that you can use to set up log forwarding in your external data source. Copy and save these values. You will use them in a later step. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(497).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 4. Check **I’ve configured this integration to send data to Zscaler MDR**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(498).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 5. Under **Configure transport encryption**, leave the default selection for now. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(429).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 6. Click the **Next** button. 6. Customize how this data is retained: 1. Specify the desired data retention period in days. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(496).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 7. Click **Save**. ## 2 | Cisco ASA | Configure log forwarding 1. From Cisco ASA, set up log forwarding using the **URL** and **Port** values noted in the previous section. 2. For detailed instructions on how to set up syslog forwarding for ASA devices using the Adaptive Security Device Manager (ASDM), refer to the [Cisco documentation](https://www.cisco.com/c/en/us/td/docs/security/asa/asa914/asdm714/general/asdm-714-general-config/monitor-syslog.html#ID-2121-00000169). 1. When configuring syslog message settings: 1. Make sure that **Include timestamp in syslogs** is checked. 2. The selected **Timestamp Format** is “RFC 5424 (yyyy-MM-ddTHH:mm:ssZ)”. 3. Make sure **Enable Syslog Device ID** is checked and “Host Name” is selected under the type of ID. 2. When configuring the syslog server settings: 1. Make sure that ASA is configured to send logs via TCP (not UDP), and that **Enable secure syslog with SSL/TLS** is selected. 2. Make sure that **Allow user traffic to pass when TCP syslog server is down** is selected. 1. Make sure the appropriate Certificate Authority (CA) root certificate is uploaded. If you did not configure a custom TLS certificate earlier, you will need to install the ISRG Root X1 certificate. You can [download](https://letsencrypt.org/certificates/) the ISRG Root X1 `.pem` certificate and upload it to Cisco manually. ## What fields are available when querying Cisco ASA? All Security Data Lake sources include a set of metadata columns — data generated by Zscaler MDR at time of ingest. These always begin with `rc_`: | Column Name | Data Type | Description | | --- | --- | --- | | `rc_id` | String | Internal row identifier. | | `rc_customer_id` | String | Zscaler MDR subdomain name. | | `rc_source_id` | String | Internal source identifier. | | `rc_format` | String | Internal source type. | | `rc_source_file` | String | Internal file name. | | `rc_source_file_line_number` | Numeric | Internal file line number. | | `rc_ingested_at` | Timestamp | Zscaler MDR ingestion date (UTC). | | `rc_created_at` | Timestamp | Zscaler MDR creation date (UTC). | | `rc_timestamp` | Timestamp | Zscaler MDR ingestion date (UTC). | Cisco ASA sources will also include a set of columns parsed from the original syslog message. | Column Name | Data Type | Description | | --- | --- | --- | | `timestamp` | Timestamp | Timestamp from the syslog record (if available). If a time zone is not provided as part of the timestamp, this will default to UTC. | | `pri` | Numeric | Priority/severity. | | `host` | String | Source hostname/IP address. | | `ident` | String | Source application. | | `pid` | String | Process ID. | | `message` | String | Message body. | | `msgid` | String | Type of message (if specified by source application). | | `extradata` | String | “Structured Data” elements. |