Cisco FTD

Cisco FTD Log Forwarding Configuration

To configure log forwarding from Cisco FTD, use the syslog server configuration available through Firepower Management Center (FMC). Follow the official Cisco documentation below for step-by-step setup instructions.

  • Configure Syslog Server

    When configuring syslog, in the Add Syslog Server dialog, ensure the Log messages in Cisco EMBLEM format (UDP only) option is not checked. This ensures that the logs are forwarded in the standard syslog format required by Scope.

Supported Log Formats

The Scope application supports ingestion of Cisco FTD logs in the Syslog format.

Sample logs

<166>Aug 14 2019 14:54:25 HOST_OR_IP %FTD-1-430004: SrcIP: 10.0.1.20, DstIP: 10.0.100.30, SrcPort: 41522, DstPort: 8000, Protocol: tcp, FileDirection: Download, FileAction: Detect, FileName: exploit.exe