Cisco Secure Firewall (Firepower Threat Defense)

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai Help Center and we shall get it updated.

This guide describes the steps required to configure Cisco Secure Firewall Threat Defense (FTD) (previously entitled Firepower Threat Defense) to send syslog to a Samurai Local Collector. 

Cisco Secure Firewall Management Center (FMC) is required.

1) Ensure Connectivity Requirements are in place

• Connectivity Requirements

2) From Cisco Secure Firewall Management Center console:

• Send Security Event Syslog Messages from FTD Devices
• Enabling External Access to the Database
• Database User Creation

3) From the Samurai application

• Complete the Cisco Firepower Threat Defense Integration

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Table 1: Connectivity requirements

Send Security Event Syslog Messages from FTD Devices

Follow the steps outlined within the Cisco documentation:

• Send Security Event Syslog Messages from FTD Devices

Default settings should be used unless otherwise specified in the listed parameters

Cisco Documentation Step 1:

Use the following parameters:

You can also refer to Configure a Syslog Server if you have queries based on options available

Table 2: Syslog settings

Cisco Documentation Step 2:

Use the following parameters:

Table 3: General logging settings

Cisco Documentation Step 3:

Complete the steps outlined.

Cisco Documentation Step 4:

Use the following parameters:

Cisco Documentation Step 5:

Complete the steps outlined.

This step if only applicable if using Snort 2

Enabling External Access to the Database

Follow the steps outlined within the Cisco documentation:

• Enabling External Access to the Database

Use the following parameters when completing the steps:

Table 6: Enable external access to database

Database User Creation

Follow the steps outlined within the Cisco documentation:

• Add an Internal User

Use the following parameters when completing the steps:

Table 7: User for Database Access

Complete the Cisco Secure Firewall (Firepower Threat Defense) Integration

1. Login to the Samurai MDR application
2. Click Integrations from the main menu
3. Click Create
4. Find and select Cisco Secure Firewall (Firepower Threat Defense)
5. Select the relevant Local Collector and click Next
6. You will be presented with the Local Collector IP Address 
7. Click Next
8. Complete the fields required including the Database Username and Password you created in Add an Internal User
9. Click on Finish

For general information on Integrations refer to the Integrations article.