Logging connections with access control rules

Depending on your choices for the rule action and deep inspection options, your logging options differ; refer to Rules and policy actions effect on logging.

Procedure

Step 1

In the access control policy editor, click Edit (edit icon) next to the rule where you want to configure logging.

Note

Some settings may be unavailable because they are inherited from a base policy or because your Security Cloud Control role does not permit modification.

Step 2

Click Logging.

Step 3

Specify whether you want to Log at Beginning of Connection or Log at End of Connection.

To optimize performance, log either the beginning or the end of any connection, but not both.

Step 4

(Optional) Check the Log Files check box to log file and malware events associated with the connection.

It is recommended to leave this option enabled.

Note

To deliver file and malware events to Security Cloud Control, you must also enable the corresponding file and malware event option in Cisco Cloud Events and ensure that the device is included in cloud event delivery. For more information, refer to Send Cloud-Delivered Firewall Management Center-Managed Event Logs to SAL (SaaS) Using a Direct Connection.

Step 5

Specify where to send the connection events:

  • Event Viewers: For cloud analytics, configure event delivery to the Security Cloud Control and view the resulting events in Security Cloud Control event viewer. Event availability depends on the rule’s logging configuration and the configured cloud event delivery settings.

  • Syslog Server: Configure the policy's default syslog destination under More > Logging. Enable syslog logging in the applicable rules and configure overrides where required. The managed Threat Defense device must have network connectivity to the configured syslog receiver. For more information, refer to Send Cloud-Delivered Firewall Management Center-Managed Events to SAL (SaaS) Using Syslog.

    Show Overrides: Displays the options to override the settings configured in the access control policy.

    • Override Severity: When you choose this option and select a severity for the rule, connection events for this rule will have the selected severity regardless of the severity configured in the Logging tab in Access Control Policy.

    • Override Default Syslog Destination: Send the syslog generated for the connection event for this rule to destination specified in this alert.

  • SNMP Trap: Connection events are sent to the selected SNMP trap.

Note

To view these events in Security Cloud Control, enable cloud event delivery for the device and select the applicable event types in Cisco Cloud Events. Enabling logging in the policy alone does not configure cloud delivery. For more information, refer to Send Cloud-Delivered Firewall Management Center-Managed Event Logs to SAL (SaaS) Using a Direct Connection.

Step 6

Click Confirm.

Step 7

Click Apply to save the rule.

What to do next

Deploy configuration changes.