Cisco Event Analysis Using External Tools User Guide

Cisco Event Analysis Using External Tools

Product Information

The product allows users to integrate with Cisco SecureX and access it using the ribbon feature in the FMC web interface.

Specifications

• Integration: Cisco SecureX
• Interface: FMC web interface
• Ribbon Feature: Bottom of every page

Product Usage Instructions

Accessing SecureX Using the Ribbon
To access SecureX using the ribbon feature, follow these steps:

1. In FMC, click the ribbon at the bottom of any FMC page.
2. Click “Get SecureX”.
3. Sign in to SecureX.
4. Click the link to authorize access.
5. Click the ribbon to expand and use it.

Event Analysis Using External Tools
To perform event analysis using external tools, follow these steps:

1. In FMC, click the ribbon at the bottom of any FMC page.
2. Click “Get SecureX”.
3. Sign in to SecureX.
4. Click the link to authorize access.
5. Click the ribbon to expand and use it.

Event Analysis with Cisco SecureX Threat Response
Cisco SecureX Threat Response (formerly known as Cisco Threat Response) allows users to rapidly detect, investigate, and respond to threats. To perform event analysis with Cisco SecureX Threat Response, follow these steps:

1. In FMC, click the ribbon at the bottom of any FMC page.
2. Click “Get SecureX”.
3. Sign in to SecureX.
4. Click the link to authorize access.
5. Click the ribbon to expand and use it.

View Event Data in Cisco SecureX Threat Response

To view event data in Cisco SecureX Threat Response, follow
these steps:

1. Sign in to Cisco SecureX Threat Response as prompted.

Event Investigation Using Web-Based Resources
To investigate events using web-based resources, follow these steps:

1. Sign in to Cisco SecureX Threat Response as prompted.
2. Use the contextual cross-launch feature to find more information about potential threats in web-based resources outside of the Firepower Management Center.
3. Click directly from an event in the event viewer or dashboard in the Firepower Management Center to the relevant information in the external resource.

About Managing Contextual Cross-Launch Resources
To manage external web-based resources, follow these steps:

1. Go to Analysis > Advanced > Contextual Cross-Launch.
2. Manage the pre-defined and third-party resources offered by Cisco.
3. You can disable, delete, or rename resources as needed.

FAQs

• Q: What is SecureX?
  A: SecureX is an integration platform in the Cisco Cloud that allows users to analyze incidents using data aggregated from multiple products, including Firepower.

• Q: How can I access SecureX using the ribbon feature?
  A: To access SecureX using the ribbon feature, click the ribbon at the bottom of any FMC page and follow the provided steps.

• Q: Can I view event data in Cisco SecureX Threat Response?
  A: Yes, you can view event data in Cisco SecureX Threat Response by signing in as prompted.

• Q: How can I investigate events using web-based resources?
  A: To investigate events using web-based resources, sign in to Cisco SecureX Threat Response and use the contextual cross-launch feature to find relevant information.

Integrate with Cisco SecureX

View and work with data from all of your Cisco security products and more through a single pane of glass, the SecureX cloud portal. Use the tools available via SecureX to enrich your threat hunts and investigations. SecureX can also provide useful appliance and device information such as whether each is running an optimal software version.

• For more information about SecureX, see http://www.cisco.com/c/en/us/products/security/securex.html.
• To integrate Firepower with SecureX, see the Firepower and SecureX Integration Guide at https://cisco.com/go/firepower-securex-documentation.

Access SecureX Using the Ribbon
The ribbon appears at the bottom of every page in the FMC web interface. You can use the ribbon to quickly pivot to other Cisco security products and work with threat data from multiple sources.

Before you begin

• If you do not see the SecureX ribbon at the bottom of FMC web interface pages, do not use this procedure. Instead, see the Firepower and SecureX Integration Guide at https://cisco.com/go/firepower-securex-documentation.
• If you don’t already have a SecureX account, obtain one from your IT department.

Procedure

• Step 1 In FMC, click the ribbon at the bottom of any FMC page.
• Step 2 Click Get SecureX.
• Step 3 Sign in to SecureX.
• Step 4 Click the link to authorize access.
• Step 5 Click the ribbon to expand and use it.

What to do next
For information about ribbon features and how to use them, see the online help in SecureX.

Event Analysis with Cisco SecureX threat response

Cisco SecureX threat response was formerly known as Cisco Threat Response (CTR.) Rapidly detect, investigate, and respond to threats using Cisco SecureX threat response, the integration platform in the Cisco Cloud that lets you analyze incidents using data aggregated from multiple products, including Firepower.

• For general information about Cisco SecureX threat response, see: https://www.cisco.com/c/en/us/products/security/threat-response.html.
• For detailed instructions for integrating Firepower with Cisco SecureX threat response, see:
• The Firepower and Cisco SecureX threat response Integration Guide at https://cisco.com/go/firepower-ctr-integration-docs.

View Event Data in Cisco SecureX threat response

Before you begin

• Set up the integration as described in the Firepower and Cisco SecureX threat response Integration Guide at https://www.cisco.com/c/en/us/support/security/defense-center/products-installation-and-configuration-guides-list.html.
• Review the online help in Cisco SecureX threat response to learn how to find, investigate, and take action on threats.
• You will need your credentials to access Cisco SecureX threat response.

Procedure

Step 1
In Firepower Management Center, do one of the following:

• To pivot to Cisco SecureX threat response from a specific event:
  • Navigate to a page under the Analysis > Intrusions menu that lists a supported event.
  • Right-click a source or destination IP address and select View in SecureX.
• To view event info generally:
  • Navigate to System > Integrations > Cloud Services.
  • Click the link to view events in Cisco SecureX threat response.

Step 2
Sign in to Cisco SecureX threat response as prompted.

Event Investigation Using Web-Based Resources
Use the contextual cross-launch feature to quickly find more information about potential threats in web-based resources outside of the Firepower Management Center. For example, you might:

• Look up a suspicious source IP address in a Cisco or third-party cloud-hosted service that publishes information about known and suspected threats, or
• Look for past instances of a particular threat in your organization’s historical logs, if your organization stores that data in a Security Information and Event Management (SIEM) application.
• Look for information about a particular file, including file trajectory information, if your organization has deployed Cisco AMP for Endpoints.

When investigating an event, you can click directly from an event in the event viewer or dashboard in the Firepower Management Center to the relevant information in the external resource. This lets you quickly gather context around a specific event based on its IP addresses, ports, protocol, domain, and/or SHA 256 hash. For example, suppose you are looking at the Top Attackers dashboard widget and you want to find out more information about one of the source IP addresses listed. You want to see what information Talos publishes about this IP address, so you choose the “Talos IP” resource. The Talos web site opens to a page with information about this specific IP address. You can choose from a set of pre-defined links to commonly used Cisco and third-party threat intelligence services, and add custom links to other web-based services, and to SIEMs or other products that have a web interface. Note that some resources may require an account or a product purchase.

About Managing Contextual Cross-Launch Resources

• Manage external web-based resources using the Analysis > Advanced > Contextual Cross-Launch page.

Exception:
Manage cross-launch links to a Secure Network Analytics appliance following the procedure in Configure Cross-Launch Links for Secure Network Analytics.

• Pre-defined resources offered by Cisco are marked with the Cisco logo. The remaining links are third-party resources.
• You can disable or delete any resources that you do not need, or you can rename them, for example by prefixing a name with a lower-case “z” so the resource sorts to the bottom of the list. Disabling a cross-launch resource disables it for all users. You cannot reinstate deleted resources, but you can re-create them.
• To add a resource, see Add Contextual Cross-Launch Resources.

Requirements for Custom Contextual Cross-Launch Resources

When adding custom contextual cross-launch resources:

• Resources must be accessible via web browser.
• Only http and https protocols are supported.
• Only GET requests are supported; POST requests are not.
• Encoding of variables in URLs is not supported. While IPv6 addresses may require colon separators to be encoded, most services do not require this encoding.
• Up to 100 resources can be configured, including pre-defined resources.
• You must be an Admin or Security Analyst user to create a cross launch, but you can also be a read-only Security Analyst to use them.

Add Contextual Cross-Launch Resources

• You can add contextual cross-launch resources such as threat intelligence services and Security Information and Event Management (SIEM) tools.
• In multidomain deployments, you can see and use resources in parent domains, but you can only create and edit resources in the current domain. The total number of resources across all domains is limited to 100.

Before you begin

• If you are adding links to a Secure Network Analytics appliance, check to see if the links you want already exist; most links are automatically created for you when you configure Cisco Security Analytics and Logging (On Premises).
• See Requirements for Custom Contextual Cross-Launch Resources.
• If needed for the resource you will link to, create or obtain an account and the credentials needed for access. Optionally, assign and distribute credentials for each user who needs access.
• Determine the syntax of the query link for the resource that you will link to:
  • Access the resource via browser and, using the documentation for that resource as needed, formulate the query link needed to search for a specific sample of the type of information you want your query link to find, such as an IP address.
  • Run the query, then copy the resulting URL from the browser’s location bar.
  • For example, you might have the query URL https://www.talosintelligence.com/reputation_center/lookup?search=10.10.10.10.

Procedure

• Step 1
  Choose Analysis > Advanced > Contextual Cross-Launch.

• Step 2 Click New Cross-Launch.
  In the form that appears, all fields marked with an asterisk require a value.

• Step 3 Enter a unique resource name.

• Step 4 Paste the working URL string from your resource into the URL Template field.

• Step 5 Replace the specific data (such as an IP address) in the query string with an appropriate variable: Position your cursor, then click a variable (for example, ip) once to insert the variable.

  • In the example from the “Before You Begin” section above, the resulting URL might be https://www.talosintelligence.com/reputation_center/lookup?search={ip}.
  • When the contextual cross-launch link is used, the {ip} variable in the URL will be replaced by the IP address that the user right-clicks on in the event viewer or dashboard.
  • For a description of each variable, hover over the variable.
  • You can create multiple contextual cross-launch links for a single tool or service, using different variables for each.

• Step 6 Click Test with example data ( ) to test your link with example data.

• Step 7 Fix any problems.

• Step 8 Click Save.

Investigate Events Using Contextual Cross-Launch

Before you begin
If the resource you will access requires credentials, make sure you have those credentials.

Procedure

• Step 1 Navigate to one of the following pages in the Firepower Management Center that shows events:
  • A dashboard (Overview > Dashboards), or
  • An event viewer page (any menu option under the Analysis menu that includes a table of events.)
• Step 2 Right-click the event of interest and choose the contextual cross-launch resource to use.
  • If necessary, scroll down in the context menu to see all available options.
  • The data type you right-click on determines the options you see; for example, if you right-click an IP address, you will only see contextual cross-launch options that are relevant to IP addresses.
  • So, for example, to get threat intelligence from Cisco Talos about a source IP address in the Top Attackers dashboard widget, choose Talos SrcIP or Talos IP.
  • If a resource includes multiple variables, the option to choose that resource is available only for events that have a single possible value for each included variable.
  • The contextual cross-launch resource opens in a separate browser window.
  • It may take some time for the query to be processed, depending on the amount of data to be queried, speed of and demand on the resource, and so on.
• Step 3 Sign in to the resource if necessary.

Configure Cross-Launch Links for Secure Network Analytics

• You can cross-launch from event data in Firepower to related data in your Secure Network Analytics appliance.
• For more information about the Secure Network Analytics product, see https://www.cisco.com/c/en/us/products/security/security-analytics-logging/index.html.
• For general information about contextual cross-launching, see Investigate Events Using Contextual Cross-Launch.
• Use this procedure to quickly configure a set of cross-launch links to your Secure Network Analytics appliance.

Note

• If you need to make changes to these links later, return to this procedure; you cannot make changes directly on the contextual cross-launch listing page.
• You can manually create additional links to cross-launch into your Secure Network Analytics appliance using the procedure in Add Contextual Cross-Launch Resources, but those links would be independent of the auto-created resources and would thus need to be manually managed (deleted, updated, etc.)

Before you begin

• You must have a deployed and running Secure Network Analytics appliance.
• If you want to send Firepower data to your Secure Network Analytics appliance using Cisco Security Analytics and Logging (On Premises), see Remote Data Storage on a Secure Network Analytics Appliance.

Procedure

• Step 1 Select System > Logging > Security Analytics & Logging.
• Step 2 Enable the feature.
• Step 3 Enter the hostname or IP address, and port, of your Secure Network Analytics appliance. The default port is 443.
• Step 4 Click Save.
• Step 5 Verify your new cross-launch links: Select Analysis > Advanced > Contextual Cross-launch. If you need to make changes, return to this procedure; you cannot make changes directly on the contextual cross-launch listing page.

What to do next

• To cross-launch from an event into the Secure Network Analytics event viewer, you will need your Secure Network Analytics credentials.
• To cross launch from an event in the FMC event viewer or dashboard, right-click a relevant event’s table cell and choose the appropriate option.
• It may take some time for the query to be processsed, depending on the amount of data to be queried, speed of and demand on the Stealthwatch Management Console, etc.

About Sending Syslog Messages for Security Events

• You can send data related to connection, security intelligence, intrusion, and file and malware events via syslog to a Security Information and Event Management (SIEM) tool or another external event storage and management solution.
• These events are also sometimes referred to as Snort® events.

About Configuring the System to Send Security Event Data to Syslog

In order to configure the system to send security event syslogs, you will need to know the following:

• Best Practices for Configuring Security Event Syslog Messaging
• Configuration Locations for Security Event Syslogs
• FTD Platform Settings That Apply to Security Event Syslog Messages
• If you make changes to syslog settings in any policy, you must redeploy for changes to take effect.

Best Practices for Configuring Security Event Syslog Messaging

characters in object names such as policy and rule names. Object names should not contain special characters, such as commas, that the receiving application may use as separators.
Firepower Threat Defense| 1. Configure FTD platform settings ( **Devices

Platform Settings > Threat Defense Settings > Syslog**.)

See also FTD Platform Settings That Apply to Security Event Syslog Messages.

2. In your access control policy Logging tab, opt to use the FTD platform settings.

3. (For intrusion events) Configure intrusion policies to use the settings in your access control policy Logging tab. (This is the default.)

Overriding any of these settings is not recommended.

For essential details, see Send Security Event Syslog Messages from FTD Devices.

---|---
All other devices| 1. Create an alert response.

2. Configure access control policy Logging to use the alert response.

3. (For intrusion events) Configure syslog settings in intrusion policies.

**** For complete details, see Send Security Event Syslog Messages from Classic Devices.

Send Security Event Syslog Messages from FTD Devices
This procedure documents the best practice configuration for sending syslog messages for security events (connection, Security-related connection, intrusion, file, and malware events) from Firepower Threat Defense devices.

Note
Many Firepower Threat Defense syslog settings are not applicable to security events. Configure only the options described in this procedure.

Before you begin

• In FMC, configure policies to generate security events and verify that the events you expect to see appear in the applicable tables under the Analysis menu.
• Gather the syslog server IP address, port, and protocol (UDP or TCP):
• Ensure that your devices can reach the syslog server(s).
• Confirm that the syslog server(s) can accept remote messages.
• For important information about connection logging, see the chapter on Connection Logging.

Procedure

• Step 1 Configure syslog settings for your Firepower Threat Defense device:

  • Click Devices > Platform Settings.
  • Edit the platform settings policy associated with your Firepower Threat Defense device.
  • In the left navigation pane, click Syslog.
  • Click Syslog Servers and click Add to enter server, protocol, interface, and related information. If you have questions about options on this page, see Configure a Syslog Server.
  • Click Syslog Settings and configure the following settings:
  • Enable Timestamp on Syslog Messages
  • Timestamp Format
  • Enable Syslog Device ID
  • Click Logging Setup.
  • Select whether or not to Send syslogs in EMBLEM format.
  • Save your settings.

• Step 2 Configure general logging settings for the access control policy (including file and malware logging):

  • Click Policies > Access Control.
  • Edit the applicable access control policy.
  • Click Logging.
  • Select FTD 6.3 and later: Use the syslog settings configured in the FTD Platform Settings policy deployed on the device.
  • (Optional) Select a Syslog Severity.
  • If you will send file and malware events, select Send Syslog messages for File and Malware events.
  • Click Save.

• Step 3 Enable logging for Security-related connection events for the access control policy:

  • In the same access control policy, click the Security Intelligence tab.
  • In each of the following locations, click Logging ( ) and enable beginning and end of connections and Syslog Server:
  • Beside DNS Policy.
  • In the Block List box, for Networks and for URLs.
  • Click Save.

• Step 4 Enable syslog logging for each rule in the access control policy:

  • In the same access control policy, click the Rules tab.

  • Click a rule to edit.

  • Click the Logging tab in the rule.

  • Choose whether to log the beginning or end of connections, or both.
    (Connection logging generates a lot of data; logging both beginning and end generates roughly double that much data. Not every connection can be logged both at beginning and end.)

  • If you will log file events, select Log Files.

  • Enable Syslog Server.

  • Verify that the rule is “Using default syslog configuration in Access Control Logging.”

  • Click Add.

  • Repeat for each rule in the policy.

• Step 5 If you will send intrusion events:

  • Navigate to the intrusion policy associated with your access control policy.
  • In your intrusion policy, click Advanced Settings > Syslog Alerting > Enabled.
  • If necessary, click Edit
  • Enter options:
    Option| Value
    ---|---
    Logging Host| Unless you will send intrusion event syslog messages to a different syslog server than you will send other syslog messages, leave this blank to use the settings you have configured above.
    Facility| This setting is applicable only if you specify a Logging Host on this page.

For descriptions, see Syslog Alert Facilities.

Severity| This setting is applicable only if you specify a Logging Host on this page.

For descriptions, see Syslog Severity Levels.

  * Click Back.
  * Click Policy Information in the left navigation pane.
  * Click Commit Changes.

What to do next

• (Optional) Configure different logging settings for individual policies and rules. See the applicable table rows in Configuration Locations for Syslogs for Connection and Security Intelligence Events (All Devices).
  • These settings will require syslog alert responses, which are configured as described in Creating a Syslog Alert Response. They do not use the platform settings you configured in this procedure.
• To configure security event syslog logging for Classic devices, see Send Security Event Syslog Messages from Classic Devices.
• If you are done making changes, deploy your changes to managed devices.

Send Security Event Syslog Messages from Classic Devices

Before you begin

• Configure policies to generate security events.
• Ensure that your devices can reach the syslog server(s).
• Confirm that the syslog server(s) can accept remote messages.
• For important information about connection logging, see the chapter on Connection Logging.

Procedure

• Step 1 Configure an alert response for your Classic devices: See Creating a Syslog Alert Response.
• Step 2 Configure syslog settings in the access control policy:
  • Click Policies > Access Control.
  • Edit the applicable access control policy.
  • Click Logging.
  • Select Send using specific syslog alert.
  • Select the Syslog Alert you created above.
  • Click Save.
• Step 3 If you will send file and malware events:
  • Select Send Syslog messages for File and Malware events.
  • Click Save.
• Step 4 If you will send intrusion events:
  • Navigate to the intrusion policy associated with your access control policy.
  • In your intrusion policy, click Advanced Settings > Syslog Alerting > Enabled.
  • If necessary, click Edit
  • Enter options:**
    Option| Value**
    ---|---
    Logging Host| Unless you will send intrusion event syslog messages to a different syslog server than you will send other syslog messages, leave this blank to use the settings you have configured above.
    Facility| This setting is applicable only if you specify a Logging Host on this page.

See Syslog Alert Facilities.

Severity| This setting is applicable only if you specify a Logging Host on this page.

See Syslog Severity Levels.

  * Click Back.
  * Click Policy Information in the left navigation pane.
  * Click Commit Changes.

What to do next

• (Optional) Configure different logging settings for individual access control rules. See the applicable table rows in Configuration Locations for Syslogs for Connection and Security Intelligence Events (All Devices). These settings will require syslog alert responses, which are configured as described in Creating a Syslog Alert Response. They do not use the settings you configured above.
• To configure security event syslog logging for FTD devices, see Send Security Event Syslog Messages from FTD Devices.

Configuration Locations for Security Event Syslogs

• Configuration Locations for Syslogs for Connection and Security Intelligence Events (All Devices)12
• Configuration Locations for Syslogs for Intrusion Events (FTD Devices)
• Configuration Locations for Syslogs for Intrusion Events (Devices Other than FTD)
• Configuration Locations for Syslogs for File and Malware Events

Configuration Locations for Syslogs for Connection and Security Intelligence Events (All Devices)
There are many places to configure logging settings. Use the table below to ensure that you set the options you need.

Important

• Pay careful attention when configuring syslog settings, especially when using inherited defaults from other configurations. Some options may NOT be available to all managed device models and software versions, as noted in the table below.
• For important information when configuring connection logging, see the chapter on Connection Logging.

Configuration Location| Description and More Information
---|---
Devices > Platform Settings, Threat Defense Settings policy, Syslog| This option applies only to Firepower Threat Defense devices.

Settings you configure here can be specified in the Logging settings for an Access Control policy and then used or overridden in the

remaining policies and rules in this table.

See FTD Platform Settings That Apply to Security Event Syslog Messages and About Syslog and subtopics.

Policies > Access Control, , Logging| Settings you configure here are the default settings for syslogs for all connection and security intelligence events, unless you override the defaults in descendant policies and rules at the locations specified in the remaining rows of this table.

Recommended setting for FTD devices: Use FTD Platform Settings. For information, see FTD Platform Settings That Apply to Security Event Syslog Messages and About Syslog and subtopics.

Required setting for all other devices: Use a syslog alert.

If you specify a syslog alert, see Creating a Syslog Alert Response.

For more information about the settings on the Logging tab, see Logging Settings for Access Control Policies.

Policies > Access Control, , Rules , Default Action row,

Logging ( )

| Logging settings for the default action associated with an access control policy.

See information about logging in the Access Control Rules chapter and Logging Connections with a Policy Default Action.

---|---
Policies > Access Control, , Rules , , Logging| Logging settings for a particular rule in an access control policy.

See information about logging in the Access Control Rules chapter.

Policies > Access Control, , Security Intelligence ,

Logging ( )

| Logging settings for Security Intelligence Block lists. Click these buttons to configure:

•  DNS Block List Logging Options

•  URL Block List Logging Options

•  Network Block List Logging Options (for IP addresses on the blocked list)

See Configure Security Intelligence, including the prerequisites section, and subtopics and links.

Policies > SSL, ,

Default Action row, Logging ( )

| Logging settings for the default action associated with an SSL policy.

See Logging Connections with a Policy Default Action.

Policies > SSL , , , Logging| Logging settings for SSL rules.

See TLS/SSL Rule Components.

Policies > Prefilter, ,

Default Action row, Logging ( )

| Logging settings for the default action associated with a prefilter policy.

See Logging Connections with a Policy Default Action.

Policies > Prefilter, ,