--- title: "Integrate Cisco Firepower Threat Defense with the Security Data Lake" slug: "integrate-cisco-firepower-threat-defense-with-the-security-data-lake" updated: 2026-10-07T17:15:14Z published: 2026-10-07T17:15:14Z canonical: "docs.redcanary.com/integrate-cisco-firepower-threat-defense-with-the-security-data-lake" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # Integrate Cisco Firepower Threat Defense with the Security Data Lake Cisco Firepower Threat Defense (FTD) is a popular firewall solution that combines a firewall, intrusion prevention system, and malware protection into a single platform. This integration can be used for Managed Detection and Response (MDR) and is stored, searchable, and and used as context in threat investigations when added to the Security Data Lake. ## Ingest Details These ingest methods allow Zscaler MDR to receive logs from your Cisco Firepower appliance either via syslog or email. - Via Syslog: Zscaler MDR provides a managed syslog server. You will be provided the fully qualified hostname and port of the syslog server to which you will point your Cisco Firepower appliance. Authentication is handled via TLS. - Via Email: Zscaler MDR also supports log ingestion via email. You can configure your appliance to send logs directly to a unique, Zscaler MDR-managed email address. By integrating your security logs with the Zscaler Security Data Lake, you can meet data retention requirements, export logs when needed for investigation or reporting, and ensure greater visibility into your security infrastructure for your team and Zscaler MDR. To integrate Cisco Firepower with Zscaler MDR, follow the procedure below for your chosen ingest method. ## Prerequisites Before you start the syslog integration, please make sure the following requirements are met: - You have an active Zscaler Security Data Lake license - You have appropriate admin permissions to make configuration changes in Cisco Firepower ## 1 Zscaler MDR | Add the Integration 1. In the Zscaler MDR portal, go to the **Integrations** page, then click **Add Integration**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/ciscofirepower-2_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A16Z&se=2026-11-04T16%3A12%3A16Z&sr=c&sp=r&sig=%2Bf5d1rJwWY3BS%2FEAZj5k1Tv6xAW87VYHFFcHO4Hf1vg%3D) 2. On the **Add integration** dialog, search for Cisco Firepower, then click **Configure**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/ciscofirepower-2_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A16Z&se=2026-11-04T16%3A12%3A16Z&sr=c&sp=r&sig=%2Bf5d1rJwWY3BS%2FEAZj5k1Tv6xAW87VYHFFcHO4Hf1vg%3D) 3. Enter a name for your integration. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/ciscofirepower-2_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A16Z&se=2026-11-04T16%3A12%3A16Z&sr=c&sp=r&sig=%2Bf5d1rJwWY3BS%2FEAZj5k1Tv6xAW87VYHFFcHO4Hf1vg%3D) ## 2 Zscaler MDR | Choose How Zscaler MDR Will Receive Data 1. Under **Ingest Format / Method**, select **Cisco Firepower via Syslog** (Recommended) or **Cisco Firepower via Email**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/ciscofirepower-2_04.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A16Z&se=2026-11-04T16%3A12%3A16Z&sr=c&sp=r&sig=%2Bf5d1rJwWY3BS%2FEAZj5k1Tv6xAW87VYHFFcHO4Hf1vg%3D) 2. Click the **Next** button. ## 3 Zscaler MDR | Configure Zscaler MDR to Retrieve Data 1. Click the **Provision** button. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/ciscofirepower-2_05.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A16Z&se=2026-11-04T16%3A12%3A16Z&sr=c&sp=r&sig=%2Bf5d1rJwWY3BS%2FEAZj5k1Tv6xAW87VYHFFcHO4Hf1vg%3D) This will save and activate your integration. If successful, you should get a “Collector provisioned successfully” notification. 2. Under **Send data to Zscaler MDR**, there are **URL** and **Port** values to set up log forwarding in your external data source. Copy and save these values to use in a later step. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/ciscofirepower-2_06.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A16Z&se=2026-11-04T16%3A12%3A16Z&sr=c&sp=r&sig=%2Bf5d1rJwWY3BS%2FEAZj5k1Tv6xAW87VYHFFcHO4Hf1vg%3D) 3. Check **I’ve configured this integration to send data to Zscaler MDR**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/ciscofirepower-2_07.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A16Z&se=2026-11-04T16%3A12%3A16Z&sr=c&sp=r&sig=%2Bf5d1rJwWY3BS%2FEAZj5k1Tv6xAW87VYHFFcHO4Hf1vg%3D) 4. Under **Configure transport encryption**, leave the default selection **No** for now. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/ciscofirepower-2_08.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A16Z&se=2026-11-04T16%3A12%3A16Z&sr=c&sp=r&sig=%2Bf5d1rJwWY3BS%2FEAZj5k1Tv6xAW87VYHFFcHO4Hf1vg%3D) 5. Click the **Next** button. ## 4 Zscaler MDR | Customize How Data is Handled For the Security Data Lake, this section is not applicable. Move onto the next step. ## 5 Zscaler MDR | Customize How This Data is Retained 1. Check **Store in the Security Data Lake**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/ciscofirepower-2_09.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A16Z&se=2026-11-04T16%3A12%3A16Z&sr=c&sp=r&sig=%2Bf5d1rJwWY3BS%2FEAZj5k1Tv6xAW87VYHFFcHO4Hf1vg%3D) 2. Specify the desired data retention period in days and click **Save**. ## 6 Cisco Firepower | Configure Log Forwarding ### Via Syslog Ingest Method If you selected **Via Syslog** as the ingest method, navigate to Cisco Firepower, set up log forwarding using the **URL** and **Port** values noted in [Step 3](/doc/docs/integrate-cisco-firepower-threat-defense-with-the-security-data-lake#3-red-canary-configure-red-canary-to-retrieve-data). For detailed instructions on how to set up syslog forwarding for FTD devices, refer to the [Cisco documentation](https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/platform_settings_for_firepower_threat_defense.html#task_6E62E90F7D67496EBC46AA99A3FE5B61). When configuring syslog message settings, make sure: - **Enable timestamp on each syslog message** is checked - The selected **Timestamp Format** is “RFC 5424 (yyyy-MM-ddTHH:mm:ssZ)” - **Enable Syslog Device ID** is checked and “Host Name” is selected under the type of ID When configuring the syslog server settings: - **Allow user traffic to pass when TCP syslog server is down (Recommended)** is checked - The protocol for the syslog server is “TCP” - **Enable Secure Syslog** is checked - Under the **Devices > Certificates** page, the appropriate Certificate Authority (CA) root certificate is uploaded. If you did not configure a custom TLS certificate earlier, you will need to install the ISRG Root X1 certificate. You can [download](https://letsencrypt.org/certificates/) the ISRG Root X1 `.pem` certificate and upload it to Cisco manually. ### Via Email Ingest Method If you selected **Via Email** as the ingest method, you’ll need to forward the logs to the provisioned Zscaler MDR email address: 1. Log in to the **Firepower** **Management Center (FMC)**. 2. Go to **Device > Platform Setting > Threat Defense Policy > Syslog > Email Setup**. 3. Click **Add**. 4. In the **Destination Email Address** field, enter the Zscaler MDR email address provisioned above. 5. In the **Syslog Severity** drop-down, choose **warning**. 6. Click **OK** to save the configuration. 7. Click **Save** to save the platform settings. 8. Go to **Deploy**, choose the FTD appliance where you want to apply the changes, then click **Deploy**. For additional information, please see the [Cisco FMC documentation](https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200479-Configure-Logging-on-FTD-via-FMC.html#toc-hId-2061790978). > [!WARNING] > Email Format > > Zscaler MDR needs to ingest the log as originally formatted by Firepower. Make sure that any perimeter devices in line between Firepower and Zscaler MDR aren’t subsequently reformatting the email to HTML. ## Querying Cisco Firepower Data The tables below outline the fields available for querying Cisco Firepower data in the Security Data Lake. ### Zscaler MDR Metadata All Security Data Lake sources include a set of metadata columns generated by Zscaler MDR at the time of ingestion. These fields are always identified by the `rc_` prefix. | Column Name | Data Type | Description | | --- | --- | --- | | `rc_id` | String | Internal row identifier. | | `rc_customer_id` | String | Zscaler MDR subdomain name. | | `rc_source_id` | String | Internal source identifier. | | `rc_format` | String | Internal source type. | | `rc_source_file` | String | Internal file name. | | `rc_source_file_line_number` | Numeric | Internal file line number. | | `rc_ingested_at` | Timestamp | Zscaler MDR ingestion date (UTC). | | `rc_created_at` | Timestamp | Zscaler MDR creation date (UTC). | | `rc_timestamp` | Timestamp | Zscaler MDR ingestion date (UTC). | ### Cisco Firepower Syslog Fields Cisco Firepower sources also include fields parsed directly from the original syslog message. | Column Name | Data Type | Description | | --- | --- | --- | | `timestamp` | Timestamp | Timestamp from the syslog record (if available). If a time zone is not provided as part of the timestamp, this will default to UTC. | | `pri` | Numeric | Priority/severity. | | `host` | String | Source hostname/IP address. | | `ident` | String | Source application. | | `pid` | String | Process ID. | | `message` | String | Message body. | | `msgid` | String | Type of message (if specified by source application). | | `extradata` | String | “Structured Data” elements. |