Security Analytics and Logging

What it is

Security Analytics and Logging (SAL) stores firewall events outside the Secure Firewall Management Center (FMC) so you can keep and search more of them.

The FMC has limited local storage for events. A busy firewall can produce more events than the FMC can hold for long. SAL gives you a place to keep a larger history and to analyse it.

There are two main styles. One keeps the data on premises and the other keeps it in the Cisco cloud.

How it works

The devices send events to a remote store, and the FMC or a portal lets you search them.

Why remote logging

Local storage is limited, and old events are removed to make room. Some organisations need to keep events for longer for investigations, audits or rules that set a minimum retention.

Remote storage also gives you a second copy. If a device or the FMC has a problem, the history is still available.

Which events

The main event type is the connection event. Firewalls produce many of them, so they are the type that most often outgrows local storage. Security related events can also be sent.

You decide in the access control policy which connections are logged and which log destinations are used. Logging more than you need uses up storage, so choose with care.

The two styles

In the on premises style, the firewalls send events by syslog to the data store. The FMC can then pivot to the stored events for a connection, so you do not leave the FMC to find the detail.

In the cloud style, events reach the cloud through the Cisco cloud connection, or through a small collector called the Secure Event Connector. The connector receives syslog from the devices and forwards it to the cloud. You search the events in a cloud portal, and you can also pivot from the FMC.

Levels of service

The cloud service is offered in tiers. At a basic level you get storage and search of logs. At a higher level you also get analytics that look for suspicious behaviour in the data and in network flows.

The exact names and contents of the tiers change from time to time, so check the current offer. For the exam, the key idea is that more storage and more analysis are available than the FMC provides by itself.

Pivoting from the FMC

When SAL is set up, the FMC lets you move from an event in its own viewer to the matching stored event. The pivot passes the context, such as the addresses and the time range, so you land on the right records.

Configuring in outline

• Decide which events to send and for how long they must be kept.
• Set up the storage, which is a data store or a cloud account.
• Configure the devices to send syslog, or connect them directly where that is supported.
• Install the collector if you use the cloud style with syslog.
• Check that events arrive, and set the FMC integration for pivoting.

Sizing

Estimate event volume before you choose. Connection logging on a busy firewall is large. Retention that is longer than you need costs more in either style.