Integrate Cisco Firepower Threat Defense with the Security Data Lake

Cisco Firepower Threat Defense (FTD) is a popular firewall solution that combines a firewall, intrusion prevention system, and malware protection into a single platform. This integration can be used for Managed Detection and Response (MDR) and is stored, searchable, and and used as context in threat investigations when added to the Security Data Lake.

Ingest Details

These ingest methods allow Zscaler MDR to receive logs from your Cisco Firepower appliance either via syslog or email.

• Via Syslog: Zscaler MDR provides a managed syslog server. You will be provided the fully qualified hostname and port of the syslog server to which you will point your Cisco Firepower appliance. Authentication is handled via TLS.

• Via Email: Zscaler MDR also supports log ingestion via email. You can configure your appliance to send logs directly to a unique, Zscaler MDR-managed email address.

By integrating your security logs with the Zscaler MDR Security Data Lake, you can meet data retention requirements, export logs when needed for investigation or reporting, and ensure greater visibility into your security infrastructure for your team and Zscaler MDR. To integrate Cisco Firepower with Zscaler MDR, follow the procedure below for your chosen ingest method.

Prerequisites

Before you start the syslog integration, please make sure the following requirements are met:

• You have an active Zscaler MDR Security Data Lake license

• You have appropriate admin permissions to make configuration changes in Cisco Firepower

1 Zscaler MDR | Add the Integration

1. In the Zscaler MDR portal, go to the Integrations page, then click Add Integration.
   

2. On the Add integration dialog, search for Cisco Firepower, then click Configure.
   

3. Enter a name for your integration.
   

2 Zscaler MDR | Choose How Zscaler MDR Will Receive Data

1. Under Ingest Format / Method, select Cisco Firepower via Syslog (Recommended) or Cisco Firepower via Email.
   

2. Click the Next button.

3 Zscaler MDR | Configure Zscaler MDR to Retrieve Data

1. Click the Provision button.
   

   This will save and activate your integration. If successful, you should get a “Collector provisioned successfully” notification.

2. Under Send data to Zscaler MDR, there are URL and Port values to set up log forwarding in your external data source. Copy and save these values to use in a later step.
   

3. Check I’ve configured this integration to send data to Zscaler MDR.
   

4. Under Configure transport encryption, leave the default selection No for now.
   

5. Click the Next button.

4 Zscaler MDR | Customize How Data is Handled

For the Security Data Lake, this section is not applicable. Move onto the next step.

5 Zscaler MDR | Customize How This Data is Retained

1. Check Store in the Security Data Lake.

2. Specify the desired data retention period in days and click Save.

6 Cisco Firepower | Configure Log Forwarding

Via Syslog Ingest Method

If you selected Via Syslog as the ingest method, navigate to Cisco Firepower, set up log forwarding using the URL and Port values noted in Step 3. For detailed instructions on how to set up syslog forwarding for FTD devices, refer to the Cisco documentation.

When configuring syslog message settings, make sure:

• Enable timestamp on each syslog message is checked

• The selected Timestamp Format is “RFC 5424 (yyyy-MM-ddTHH:mm:ssZ)”

• Enable Syslog Device ID is checked and “Host Name” is selected under the type of ID

When configuring the syslog server settings:

• Allow user traffic to pass when TCP syslog server is down (Recommended) is checked

• The protocol for the syslog server is “TCP”

• Enable Secure Syslog is checked

• Under the Devices > Certificates page, the appropriate Certificate Authority (CA) root certificate is uploaded. If you did not configure a custom TLS certificate earlier, you will need to install the ISRG Root X1 certificate. You can download the ISRG Root X1 .pem certificate and upload it to Cisco manually.

Via Email Ingest Method

If you selected Via Email as the ingest method, you’ll need to forward the logs to the provisioned Zscaler MDR email address:

1. Log in to the Firepower Management Center (FMC).

2. Go to Device > Platform Setting > Threat Defense Policy > Syslog > Email Setup.

3. Click Add.

4. In the Destination Email Address field, enter the Zscaler MDR email address provisioned above.

5. In the Syslog Severity drop-down, choose warning.

6. Click OK to save the configuration.

7. Click Save to save the platform settings.

8. Go to Deploy, choose the FTD appliance where you want to apply the changes, then click Deploy.

For additional information, please see the Cisco FMC documentation.

Email Format

Zscaler MDR needs to ingest the log as originally formatted by Firepower. Make sure that any perimeter devices in line between Firepower and Zscaler MDR aren’t subsequently reformatting the email to HTML.

Querying Cisco Firepower Data

The tables below outline the fields available for querying Cisco Firepower data in the Security Data Lake.

Zscaler MDR Metadata

All Security Data Lake sources include a set of metadata columns generated by Zscaler MDR at the time of ingestion. These fields are always identified by the rc_ prefix.

Cisco Firepower Syslog Fields

Cisco Firepower sources also include fields parsed directly from the original syslog message.