Implement secure logging analytics (SaaS) for ASA devices

Implement Secure Logging Analytics (SaaS) to send ASA device events to the Cisco cloud for security analysis and monitoring.

Use this workflow to set up secure logging analytics for ASA devices, enabling cloud-based security monitoring and analysis capabilities.

Before you begin

Review Secure Logging Analytics (SaaS) for ASA devices to learn about:
- How events are sent to the Cisco cloud
- Applications in the solution
- Licenses you need
- Data plan you need
You have contacted your managed service provider or Security Cloud Control Sales representative to create a Security Cloud Control tenant.
Review About Secure Device Connector. Connecting Security Cloud Control to your ASA using an SDC is considered a "best practice" but it is not required.
If you choose to deploy an SDC in your network, you can use this method to install it:
- Use Deploy a VM for Running the Secure Device Connector and Secure Event Connector.
You have installed one or more SECs for your tenant and you can send events from any ASA to any SEC onboarded to your tenant.

Follow these steps to implement Cisco Security Analytics and Logging (SaaS) and send events through the Secure Event Connector to the Cisco Cloud:

Procedure

Step 1	Be sure to review "Before you Begin" above to make sure your environment is properly configured.
Step 2	Onboard ASA device to Security Cloud Control Firewall Management using username and password.
Step 3	Send ASA Syslog Events to the Cisco Cloud.
Step 4	Configuring NSEL for ASA Devices Using a Security Cloud Control Macro.
Step 5	Confirm events are visible in Security Cloud Control. From the navigation bar, select Events & Logs > Events > Event Logging. Click the Live tab to view live events.

You have successfully implemented Secure Logging Analytics (SaaS) for your ASA devices. Events are now being sent to the Cisco cloud for analysis and monitoring. If you have the appropriate licenses, you can also access Secure Cloud Analytics for advanced security monitoring and alerting capabilities.

What to do next

For troubleshooting and monitoring:

For reviewing Cisco Secure Cloud Analytics alerts by cross-launching from Security Cloud Control: