|
Cisco Secure Firewall Threat
Defense
|
-
Security Cloud Control-managed standalone threat defense devices, Version, 7.2 and later.
-
To send events using syslog, you must have threat defense device version 6.4 or later.
-
To send events directly, you must have threat defense device version 7.2 or later.
-
To optionally exclude threat defense devices from sending events directly, you must have threat defense device version 7.4.1 or later.
-
Your firewall system must be deployed and successfully generating events.
|
|
Regional cloud
|
-
Determine the regional cloud that you want to send events to.
-
Events cannot be viewed from or moved between different regional clouds.
-
If you use a direct connection to send events to the Cisco Security Cloud for integration with Cisco SecureX, or Cisco SecureX threat response, or Cisco XDR, you must use the same cloud region for this integration.
-
If you send events directly, the regional cloud you specify
in Security Cloud Control must match the region of your Security Cloud Control tenant.
|
|
Data plan
|
-
You must buy a data plan that reflects the number of events the Cisco cloud receives from your threat defense devices daily. This is called your daily ingest rate.
-
Use the Logging Volume Estimator Tool to estimate your data storage requirements.
|
|
Accounts
|
When you purchase a license for this integration, you are provided
with a Security Cloud Control tenant account to support the integration.
|
|
Connectivity
|
The threat defense devices must be able to connect outbound on port 443 to the Cisco
Security Cloud at the following addresses:
-
US region:
-
api-sse.cisco.com
-
mx*.sse.itd.cisco.com
-
dex.sse.itd.cisco.com
-
eventing-ingest.sse.itd.cisco.com
-
registration.us.sse.itd.cisco.com
-
us.manage.security.cisco.com
-
edge.us.cdo.cisco.com
-
EU region:
-
api.eu.sse.itd.cisco.com
-
mx*.eu.sse.itd.cisco.com
-
dex.eu.sse.itd.cisco.com
-
eventing-ingest.eu.sse.itd.cisco.com
-
registration.eu.sse.itd.cisco.com
-
eu.manage.security.cisco.com
-
edge.eu.cdo.cisco.com
-
Asia (APJ) region:
-
api.apj.sse.itd.cisco.com
-
mx*.apj.sse.itd.cisco.com
-
dex.apj.sse.itd.cisco.com
-
eventing-ingest.apj.sse.itd.cisco.com
-
registration.apj.sse.itd.cisco.com
-
apj.cdo.cisco.com
-
edge.apj.cdo.cisco.com
-
Australia region:
-
api.aus.sse.itd.cisco.com
-
mx*.aus.sse.itd.cisco.com
-
dex.au.sse.itd.cisco.com
-
eventing-ingest.aus.sse.itd.cisco.com
-
registration.au.sse.itd.cisco.com
-
aus.cdo.cisco.com
-
India region:
|