Cisco FTD Integration for Elastic

The Cisco Firepower Threat Defense (FTD) integration for Elastic collects logs from Cisco FTD devices, enabling comprehensive monitoring, threat detection, and security analysis within the Elastic Stack. This integration parses syslog messages from Cisco FTD, providing real-time visibility into network traffic, security events, and system activity. By centralizing these logs, you can enhance your security posture, streamline incident response, and gain deep insights into your network's operations.

This integration is compatible with Cisco FTD devices that support syslog export. It requires Elastic Stack version 8.11.0 or newer.

The integration works by receiving syslog data sent from a Cisco FTD device. Elastic Agent can be configured to listen for these logs on a specific TCP or UDP port, or to read them directly from a log file. Once received, the agent processes and parses the logs before sending them to Elasticsearch.

The Cisco FTD integration collects logs containing detailed information about:

• Connection Events: Firewall traffic, network address translation (NAT), and connection summaries.
• Security Events: Intrusion detection and prevention (IPS/IDS) alerts, file and malware protection events, and security intelligence data.
• System Events: Device health, system status, and configuration changes.

• Real-time Threat Detection: Use Elastic SIEM to identify and respond to threats like malware, intrusions, and policy violations.
• Network Traffic Analysis: Visualize and analyze network traffic patterns to identify anomalies, troubleshoot connectivity issues, and optimize performance.
• Security Auditing and Compliance: Maintain a searchable archive of all firewall activity to support compliance requirements and forensic investigations.
• Operational Monitoring: Track the health and status of your FTD devices to ensure they are functioning correctly.

Elastic Agent must be installed on a host that is reachable by your Cisco FTD device over the network. For more details, check the Elastic Agent installation instructions. You can install only one Elastic Agent per host.

Elastic Agent is required to stream data from the syslog or log file receiver and ship the data to Elastic, where the events will then be processed through the integration's ingest pipelines.

You must configure your Cisco FTD device to forward syslog messages to the Elastic Agent. The specific steps may vary depending on whether you are using Firepower Device Manager (FDM) or Firepower Management Center (FMC).

1. Define the Elastic Agent as a Syslog Server:

   • In your FDM or FMC interface, navigate to the syslog configuration section (for example, Objects > Syslog Servers or Device > System Settings > Logging).
   • Add a new syslog server, providing the IP address and port of the machine where the Elastic Agent is running.
   • Ensure the protocol (TCP or UDP) matches the input you configure in the integration.

2. Configure Logging Rules:

   • Create or edit a logging rule to send specific event classes to the newly configured syslog server.
   • It is recommended to send all relevant message IDs to ensure comprehensive data collection.

3. Deploy Changes:

   • Save and deploy your configuration changes to the FTD device.

Refer to the Cisco instructions on how to configure Logging on FTD via FMC.

1. In Kibana, navigate to Management > Integrations.
2. In the search bar, enter Cisco FTD.
3. Click the integration to see more details and then click Add integration.
4. Configure the integration settings. You must select the input method that matches your Cisco FTD configuration (TCP, UDP, or log file).
   • For TCP/UDP: Specify the host and port where the Elastic Agent should listen for syslog messages. This must match the destination you configured on your FTD device.
   • For Log File: Provide the file paths that the agent should monitor. Use Exclude files to skip files that match a regular expression. The default pattern, \.gz$, skips compressed files. Ignore older and Custom configurations are available in the advanced options.
5. Click Save and continue to add the integration policy to an Elastic Agent.

Navigate to the Discover tab in Kibana. Filter for the cisco_ftd.log dataset (data_stream.dataset : "cisco_ftd.log") and verify that logs from your FTD device are being ingested. You can also check the pre-built dashboards for this integration by searching for "Cisco FTD" in the Dashboards section.

1. Verify Agent Status:

   • In Kibana, navigate to Management > Fleet > Agents
   • Confirm the Elastic Agent shows as "Healthy" and has the Cisco FTD integration assigned
   • Check the agent logs for any connection errors

2. Trigger Test Events:

   • Generate test network traffic through the FTD device (for example, web browsing, file download)
   • Or trigger a security event by accessing a known malicious URL or downloading a test file
   • Verify the FTD device is sending syslog messages (check FTD logs or management interface)

3. Verify Data Ingestion:

   • In Kibana, navigate to Discover
   • Select the logs-cisco_ftd.log-* data stream
   • Verify events are appearing with recent timestamps
   • Check that events contain expected fields such as cisco.ftd.*, source.ip, destination.ip, etc.

4. Validate Event Fields:

   • Open a sample event and verify:
     • @timestamp is correctly parsed
     • cisco.ftd.message_id is present
     • Network fields (source.ip, destination.ip, source.port, destination.port) are populated
     • Security event fields are present for security-related events
     • event.original contains the raw syslog message (if preserve_original_event is enabled)

5. Check for Parsing Errors:

   • Filter for event.outcome: failure or check for error.message fields
   • Review any events with parsing issues
   • Verify timezone configuration if timestamps appear incorrect

For help with Elastic ingest tools, check Common problems.

A field named cisco.ftd.security contains a variable number of sub-fields, which is mapped as a flattened datatype. This mapping limits certain operations, such as aggregations, on its sub-fields.

To enable aggregations on common security-related fields, the integration automatically moves a known set of fields from cisco.ftd.security to a new field, cisco.ftd.security_event. If you need to perform aggregations on additional fields within cisco.ftd.security, you can create a custom ingest pipeline to move them.

To create this custom pipeline:

1. In Kibana, navigate to Stack Management > Ingest Pipelines.
2. Click Create Pipeline > New Pipeline.
3. Set the Name to logs-cisco_ftd.log@custom.
4. Add a Rename processor:
   • Set Field to the source field, for example, cisco.ftd.security.threat_name.
   • Set Target field to the destination, for example, cisco.ftd.security_event.threat_name.
5. Add more processors as needed and save the pipeline. This @custom pipeline will be automatically applied to all incoming Cisco FTD logs.

For more information on architectures that can be used for scaling this integration, check the Ingest Architectures documentation.

The log data stream collects logs from Cisco Firepower Threat Defense (FTD) devices.

{
    "@timestamp": "2019-08-16T09:39:02.000Z",
    "agent": {
        "ephemeral_id": "477973c4-b380-4791-ad68-919bc71782eb",
        "id": "dc57df32-adfa-4d1e-9386-d4519fc2d1e9",
        "name": "elastic-agent-79310",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "cisco": {
        "ftd": {
            "rule_name": "malware-and-file-policy",
            "security": {
                "file_storage_status": "Not Stored (Disposition Was Pending)",
                "threat_name": "Win.Ransomware.Eicar::95.sbx.tg"
            },
            "security_event": {
                "application_protocol": "HTTP",
                "client": "cURL",
                "dst_ip": "81.2.69.144",
                "dst_port": 80,
                "file_action": "Malware Cloud Lookup",
                "file_direction": "Download",
                "file_name": "eicar_com.zip",
                "file_policy": "malware-and-file-policy",
                "file_sandbox_status": "File Size Is Too Small",
                "file_sha256": "2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad",
                "file_size": 184,
                "file_type": "ZIP",
                "first_packet_second": "2019-08-16T09:39:02Z",
                "protocol": "tcp",
                "sha_disposition": "Unavailable",
                "spero_disposition": "Spero detection not performed on file",
                "src_ip": "10.0.1.20",
                "src_port": 46004,
                "uri": "http://www.eicar.org/download/eicar_com.zip",
                "user": "No Authentication Required"
            },
            "threat_category": "Win.Ransomware.Eicar::95.sbx.tg"
        }
    },
    "data_stream": {
        "dataset": "cisco_ftd.log",
        "namespace": "84072",
        "type": "logs"
    },
    "destination": {
        "address": "81.2.69.144",
        "geo": {
            "city_name": "London",
            "continent_name": "Europe",
            "country_iso_code": "GB",
            "country_name": "United Kingdom",
            "location": {
                "lat": 51.5142,
                "lon": -0.0931
            },
            "region_iso_code": "GB-ENG",
            "region_name": "England"
        },
        "ip": "81.2.69.144",
        "port": 80
    },
    "ecs": {
        "version": "8.17.0"
    },
    "elastic_agent": {
        "id": "dc57df32-adfa-4d1e-9386-d4519fc2d1e9",
        "snapshot": false,
        "version": "8.18.0"
    },
    "event": {
        "action": "malware-detected",
        "agent_id_status": "verified",
        "category": [
            "malware",
            "file"
        ],
        "code": "430005",
        "dataset": "cisco_ftd.log",
        "ingested": "2025-05-20T10:32:02Z",
        "kind": "event",
        "original": "2019-08-16T09:39:03Z firepower  %FTD-1-430005: SrcIP: 10.0.1.20, DstIP: 81.2.69.144, SrcPort: 46004, DstPort: 80, Protocol: tcp, FileDirection: Download, FileAction: Malware Cloud Lookup, FileSHA256: 2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad, SHA_Disposition: Unavailable, SperoDisposition: Spero detection not performed on file, ThreatName: Win.Ransomware.Eicar::95.sbx.tg, FileName: eicar_com.zip, FileType: ZIP, FileSize: 184, ApplicationProtocol: HTTP, Client: cURL, User: No Authentication Required, FirstPacketSecond: 2019-08-16T09:39:02Z, FilePolicy: malware-and-file-policy, FileStorageStatus: Not Stored (Disposition Was Pending), FileSandboxStatus: File Size Is Too Small, URI: http://www.eicar.org/download/eicar_com.zip",
        "severity": 1,
        "start": "2019-08-16T09:39:02Z",
        "timezone": "UTC",
        "type": [
            "info"
        ]
    },
    "file": {
        "hash": {
            "sha256": "2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad"
        },
        "name": "eicar_com.zip",
        "size": 184
    },
    "host": {
        "hostname": "firepower"
    },
    "input": {
        "type": "udp"
    },
    "log": {
        "level": "alert",
        "source": {
            "address": "192.168.249.3:51934"
        }
    },
    "network": {
        "application": "curl",
        "community_id": "1:jk2uwniJ2oCG0t73HeZ9w8gtA8E=",
        "direction": "outbound",
        "iana_number": "6",
        "protocol": "http",
        "transport": "tcp"
    },
    "observer": {
        "hostname": "firepower",
        "product": "ftd",
        "type": "idps",
        "vendor": "Cisco"
    },
    "related": {
        "hash": [
            "2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad"
        ],
        "hosts": [
            "firepower"
        ],
        "ip": [
            "10.0.1.20",
            "81.2.69.144"
        ]
    },
    "rule": {
        "ruleset": "malware-and-file-policy"
    },
    "source": {
        "address": "10.0.1.20",
        "ip": "10.0.1.20",
        "port": 46004
    },
    "tags": [
        "preserve_original_event",
        "private_is_internal",
        "cisco-ftd",
        "forwarded"
    ],
    "url": {
        "domain": "www.eicar.org",
        "extension": "zip",
        "original": "http://www.eicar.org/download/eicar_com.zip",
        "path": "/download/eicar_com.zip",
        "scheme": "http"
    }
}

These inputs can be used with this integration:

ssl.enabled: true
ssl.certificate: "/path/to/server.crt"
ssl.key: "/path/to/server.key"
ssl.certificate_authorities: ["/path/to/ca.crt"]
ssl.client_authentication: "optional"