Cisco Firepower eStreamer

Solution: Cisco Firepower EStreamer

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Attribute	Value
Publisher	Cisco
Support Tier	Partner
Support Link	https://www.cisco.com/c/en_in/support/index.html
Categories	domains
Version	3.0.1
Author	Cisco
First Published	2022-05-25
Solution Folder	Cisco Firepower EStreamer
Marketplace	Azure Marketplace · Popularity: 🔵 Medium (77%)
Pre-requisites	Common Event Format

The Cisco Firepower eStreamer Solution for Microsoft Sentinel works with Cisco Event Streamer (also known as eStreamer) and allows you to stream System intrusion, discovery and connection data from Firepower Management Center (FMC) or managed device to Microsoft Sentinel eStreamer is a Client Server API designed for the Cisco Firepower NGFW Solution. The eStreamer client requests detailed event data on behalf of the SIEM or logging solution in the Common Event Format (CEF).

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

Additional Information

📖 Setup Guide: Cisco firewalls connector - Connect Cisco ASA and Firepower firewalls to Microsoft Sentinel

Pre-requisites
Data Connectors
Tables Used
Content Items

Pre-requisites

This solution depends on 1 other solution(s):

Solution
Common Event Format

Data Connectors

This solution provides 2 data connector(s):

Connectors from dependency solutions:

Common Event Format (CEF) (dependency on Common Event Format)
Common Event Format (CEF) via AMA (dependency on Common Event Format)

Tables Used

This solution uses 1 table(s):

Table	Used By Connectors	Used By Content
`CommonSecurityLog`	Common Event Format (CEF) (dependency), Common Event Format (CEF) via AMA (dependency), [Deprecated] Cisco Firepower eStreamer via AMA, [Deprecated] Cisco Firepower eStreamer via Legacy Agent	-

Content Items

This solution includes 3 content item(s):

Content Type	Count
Playbooks	3

Playbooks

Name	Description	Tables Used
Block IP - Cisco Firepower	This playbook allows blocking of IPs in Cisco Firepower, using a Network Group object. This allo...	-
Block IP - Take Action from Teams - Cisco Firepower	This playbook allows blocking of IPs in Cisco Firepower, using a Network Group object. This allo...	-
Block URL - Cisco Firepower	This playbook allows blocking of FQDNs in Cisco Firepower, using a Network Group object. This al...	-

Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.0.1	10-07-2024	Deprecating data connectors.
3.0.0	26-09-2023	Addition of new Cisco Firepower EStreamer AMA Data Connector