Integrate Cisco Firepower Threat Defense with the Security Data Lake

Before you start the syslog integration, please make sure the following requirements are met:

1. You have an active Red Canary Security Data Lake license.

2. You have appropriate admin permissions to make configuration changes in Cisco Firepower.

1. From your Red Canary homepage, navigate to Integrations and click Add Integration.
   

2. In the modal that appears, search for “Cisco Firepower”. When the tile appears, click Configure.
   

3. Enter a name for your integration.
   

4. Choose how Red Canary will receive this data:

   1. Under Ingest Format / Method, select Cisco Firepower via Syslog.
      

   2. Click the Next button.

5. Configure Red Canary to retrieve data from this integration:

   1. Click the Provision button.
      

   2. This will save and activate your integration. If successful, you should get a “Collector provisioned successfully” notification.
      

   3. Under Send data to Red Canary, there will be a URL and Port that you can use to set up log forwarding in your external data source. Copy and save these values. You will use them in a later step.
      

   4. Check I’ve configured this integration to send data to Red Canary.
      

   5. Under Configure transport encryption, leave the default selection for now.
      

   6. Click the Next button.

6. Customize how data from this integration is handled:

   1. For the Security Data Lake, this section is not applicable.

7. Customize how this data is retained:

   1. Check Store in the Security Data Lake.
      

   2. Specify the desired data retention period in days and click Save.

1. From Cisco Firepower, set up log forwarding using the URL and Port values noted in the previous section.

2. For detailed instructions on how to set up syslog forwarding for FTD devices, refer to the Cisco documentation.

   1. When configuring syslog message settings:

      1. Make sure that Enable timestamp on each syslog message is checked.

      2. The selected Timestamp Format is “RFC 5424 (yyyy-MM-ddTHH:mm:ssZ)”.

      3. Make sure Enable Syslog Device ID is checked and “Host Name” is selected under the type of ID.

   2. When configuring the syslog server settings:

      1. Make sure that Allow user traffic to pass when TCP syslog server is down (Recommended) is checked.

      2. The protocol for the syslog server is “TCP”.

      3. Make sure Enable Secure Syslog is checked.

      4. Under the Devices > Certificates page, the appropriate Certificate Authority (CA) root certificate is uploaded. If you did not configure a custom TLS certificate earlier, you will need to install the ISRG Root X1 certificate. You can download the ISRG Root X1 .pem certificate and upload it to Cisco manually.