Cisco FireSIGHT and FirePower Threat Defense | External Systems Configuration Guide (2024)

Cisco Firepower Management Center (FMC) - Formerly FireSIGHT and FirePower Threat Defense

Cisco Firepower Management Center (FMC) provides complete and unified management over firewalls, application control, intrusion prevention, URL filtering, and advanced malware protection. It can easily go from managing a firewall to controlling applications to investigating and remediating malware outbreaks.

This section describes how FortiSIEM collects logs from Cisco FireSIGHT console and FirePower Threat Defense via the eStreamer API integration. FortiSIEM provides two integrations options, either through the FortiSIEM built-in eStreamer integration or via the Cisco FirePower eStreamer eNcore client.

The Cisco eNcore client Collects System intrusion, discovery, and connection data from the Firepower Management Center or managed device (also referred to as the eStreamer server) to external client applications, in this case via Syslog to FortiSIEM.

What is Discovered and Monitored
Event Types
Rules
Reports
Configuration
Using Cisco eStreamer Client

What is Discovered and Monitored

Protocol	Information Discovered	Logs Collected	Used For
eStreamer API		Intrusion Events, Malware Events. File Events. Discovery Events, User Activity Events, Impact Flag Events	Security Monitoring

Event Types

FortiSIEM obtains events from Cisco FireSIGHT via eStreamer protocol. Event types follow.

Intrusion events: PH_DEV_MON_FIREAMP_INTRUSION

[PH_DEV_MON_FIREAMP_INTRUSION]:[eventSeverity]=PHL_CRITICAL,[fileName]=phFireAMPAgent.cpp,[lineNumber]=381,[reptDevIpAddr]=10.1.23.177,[envSensorId]=6,[snortEventId]=393258,[deviceTime]=1430501705,[eventType]=Snort-1,[compEventType]=PH_DEV_MON_FIREAMP_INTRUSION,[ipsGeneratorId]=137,[ipsSignatureId]=2,[ipsClassificationId]=32,[srcIpAddr]=10.131.10.1,[destIpAddr]=10.131.10.120,[srcIpPort]=34730,[destIpPort]=443,[ipProto]=6,[iocNum]=0,[fireAmpImpactFlag]=7,[fireAmpImpact]=2,[eventAction]=1,[mplsLabel]=0,[hostVLAN]=0,[userId]=3013,[webAppId]=0,[clientAppId]=1296,[appProtoId]=1122,[fwRule]=133,[ipsPolicyId]=63098,[srcIntfName]=b16c69fc-cd95-11e4-a8b0-b61685955f02,[destIntfName]=b1a1f900-cd95-11e4-a8b0-b61685955f02,[srcFwZone]=9e34052a-9b4f-11e4-9b83-efa88d47586f,[destFwZone]=a7bd89cc-9b4f-11e4-8260-63a98d47586f,[connEventTime]=1430501705,[connCounter]=371,[srcGeoCountryCode]=0,[destGeoCountryCode]=0,[phLogDetail]=

Malware events: PH_DEV_MON_FIREAMP_MALWARE

[PH_DEV_MON_FIREAMP_MALWARE]:[eventSeverity]=PHL_INFO,[fileName]=phFireAMPAgent.cpp,[lineNumber]=487,[reptDevIpAddr]=10.1.23.177,[envSensorId]=6,[deviceTime]=1430502934,[srcIpAddr]=10.110.10.73,[destIpAddr]=10.0.112.132,[srcIpPort]=21496,[destIpPort]=80,[ipProto]=6,[fileName]=CplLnk.exe ,[filePath]=,[fileSize64]=716325,[fileType]=1,[fileTimestamp]=0,[hashAlgo]=SHA,[hashCode]=f1bfab10090541a2c3e58b4b93c504be8b65cdc823209c7f4def24acc38d7fd1 ,[fileDirection]=1,[fireAmpFileAction]=3,[parentFileName]=,[parentFileHashCode]=,[infoURL]=http://wrl/wrl/CplLnk.exe ,[threatScore]=0,[fireAmpDisposition]=3,[fireAmpRetrospectiveDisposition]=3,[iocNum]=1,[accessCtlPolicyId]=125870424,[srcGeoCountryCode]=0,[destGeoCountryCode]=0,[webAppId]=0,[clientAppId]=638,[applicationId]=676,[connEventTime]=1430502933,[connCounter]=409,[cloudSecIntelId]=0,[phLogDetail]=

File events: PH_DEV_MON_FIREAMP_FILE

Rules

There are no predefined rules for this device.

Reports

The following reports are provided:

Configuration

Cisco FireSIGHT Configuration
FortiSIEM Configuration

Cisco FireSIGHT Configuration

Login to Cisco FIRESIGHT console.
Go to System > Local > Registration > eStreamer
Click Create Client
1. Enter IP address and Password for FortiSIEM. The password can only contain alpha (a-z, A-Z) and numeric (0-9) characters. Special characters are not allowed.
2. Click Save.
Select the types of events that should be forwarded to FortiSIEM.
Click Download Certificate and save the certificate to a local file.

FortiSIEM Configuration

Complete these steps in the FortiSIEM UI by first logging in to the FortiSIEM Supervisor node.

Define Cisco FireSIGHT console and FirePower Threat Defense Credential in FortiSIEM
Create IP Range to Credential Association and Test Connectivity

Define Cisco FireSIGHT console and FirePower Threat Defense Credential in FortiSIEM

Go to the ADMIN > Setup > Credentials tab.
In Step 1: Enter Credentials, click New to create a new credential.
1. Follow the instructions in “Setting Credentials“ in the User's Guide to create a new credential.
2. Enter these settings in the Access Method Definition dialog box and click Save:

Settings	Description
Name	Enter a name for the credential
Device Type	Cisco FireAMP
Access Protocol	eStreamer SDK
Password	Enter the Password as in Step 3a from Cisco FireSIGHT Configuration.
Certificate File	Click Upload and enter/select the certificate downloaded in Step 5 from Cisco FireSIGHT Configuration.
Organization	The organization the device belongs to.
Description	Description of the device.

Create IP Range to Credential Association and Test Connectivity

From the FortiSIEM Supervisor node, take the following steps (In ADMIN > Setup > Credentials).

In Step 2: Enter IP Range to Credential Associations, click New to create a mapping.
1. Enter the IP address of the FireSIGHT console in the IP/Host Name field.
2. Select the name of the credential created in Define Cisco FireSIGHT console and FirePower Threat Defense Credential in FortiSIEM from the Credentials drop-down list.
3. Click Save.
Select the entry just created and click the Test drop-down list and select Test Connectivity. FortiSIEM will start collecting events from the FIRESIGHT console.

Using Cisco eStreamer Client

Cisco has published a free eStreamer client to pull events from FireAMP server. This client is more up-to-date than FortiSIEM’s own eStreamer client.

If you decide to use Cisco’s eStreamer client instead of FortiSIEM’s eStreamer client, follow these steps.

Step 1: Install a New Version of Python with a New User 'estreamer'
Step 2: Download and Configure eStreamer Client
Step 3: Start eStreamer Client

Step 1: Install a New Version of Python with a New User 'estreamer'

This is required because the python version used by FortiSIEM is compiled with PyUnicodeUCS2, while eStreamer client requires the standard version of python built with PyUnicodeUCS4.

Log in to FortiSIEM Collector or the node where eStreamer client is going to be installed.
Install openssl-devel and openssl-devel.i686 by running the following command.
yum install openssl-devel openssl-devel.i686
Create eStreamer user using the following command.
1. useradd estreamer
Download the python library using the following commands.
1. su estreamer
2. mkdir ~/python
3. cd ~/python
4. wget https://www.python.org/ftp/python/2.7.18/Python-2.7.18.tgz
Install python library by using the following commands.
1. tar zxfv Python-2.7.18.tgz
2. find ~/python -type d | xargs chmod 0755
3. cd Python-2.7.18
4. ./configure --prefix=$HOME/python --enable-unicode=ucs4
5. make && make install
6. Add the following two lines to ~/.bashrc.
  export PATH=$HOME/python/Python-2.7.18/:$PATH
  export PYTHONPATH=$HOME/python/Python-2.7.18
7. source ~/.bashrc

Step 2: Download and Configure eStreamer Client

SSH to FortiSIEM Collector or the node where eStreamer client is going to be installed as estreamer user.
Git clone: git://github.com/CiscoSecurity/fp-05-firepower-cef-connector-arcsight.git
Change directory using the following command.
cd fp-05-firepower-cef-connector-arcsight
Login to eStreamer server and take the following steps.
1. Go to System > Integration > eStreamer.
2. Create a New client and enter the IP address of the Supervisor/Collector as the host.
3. Download the pkcs12 file and save it to directory.
  fp-05-firepower-cef-connector-arcsight
Go back to fp-05-firepower-cef-connector-arcsight directory.
Run sh encore.sh, and type 2 for selection of output in CEF as prompted. An estreamer.conf file is generated.
Edit estreamer.conf with the below settings (in JSON format).
- handler.outputters.stream.uri : "udp://VA_IP:514"
- servers.host : eStreamer_Server_IP
- servers.pkcs12Filepath : /path/to/pkcs12
Run the following two commands.
- openssl pkcs12 -in "client.pkcs12" -nocerts -nodes -out "/path/to/fp-05-firepower-cef-connector-arcsight/{eStreamer_Server_IP}-{port}_pkcs.key"
- openssl pkcs12 -in "client.pkcs12" -clcerts -nokeys -out "/path/to/fp-05-firepower-cef-connector-arcsight/{eStreamer_Server_IP}-{port}_pkcs.cert"

Notes:

8302 is the default port.
The public IP of the device must be used to create client.pkcs12 according to Cisco FireSIGHT Configuration documentation. The command curl ifconfig.co can be used to get the public IP of the device.

Step 3: Start eStreamer Client

SSH to FortiSIEM Collector or the node where eStreamer client is installed, as eStreamer user.Start eStreamer client by entering:
sh encore.sh start

Now eStreamer client is ready for use. FortiSIEM 5.2.5 contains an updated parser for the events generated by Cisco eStreamer client. Trigger a few events in eStreamer server and query from FortiSIEM to verify if everything is working.

Cisco FireSIGHT and FirePower Threat Defense | External Systems Configuration Guide (2024)

FAQs

What is the difference between firepower and FireSIGHT? ›

Firepower is the term Cisco uses for most of the products aquired from Sourcefire. Firepower Management Center aka Firesight Management Center aka Defense Center. If you need further information let me know. Firepower is the term Cisco uses for most of the products aquired from Sourcefire.

Know More ›

What is a key difference between Cisco Firepower and Cisco ASA? ›

Cisco Firepower provides identity based access control while Cisco ASA does not.

Get More Info Here ›

What is the Cisco Firepower Threat Defense? ›

Cisco Firepower Threat Defense is an integrative software image combining CISCO ASA and Firepower feature into one hardware and software inclusive system. The Cisco Firepower NGIPS is a next generation intrusion prevention system.

Is Cisco FirePower an IPS? ›

Cisco Firepower Next-Generation IPS (NGIPS) threat appliances provide network visibility, security intelligence, automation and advanced threat protection.

What is the vulnerability of Cisco ASA FirePower? ›

CVE-2024-20358: A vulnerability in the Cisco ASA restore functionality that is available in Cisco ASA and Cisco FTD that could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges.