Cisco ASA Solution
Solution: CiscoASA
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
| Attribute | Value |
|---|---|
| Publisher | Microsoft Corporation |
| Support Tier | Microsoft |
| Support Link | https://support.microsoft.com/ |
| Categories | domains |
| Version | 3.0.5 |
| Author | Microsoft - support@microsoft.com |
| First Published | 2022-05-23 |
| Solution Folder | CiscoASA |
| Marketplace | Azure Marketplace · Rating: ★★☆☆☆ 1.5/5 (2 ratings) · Popularity: 🟢 High (89%) |
The Cisco ASA solution for Microsoft Sentinel enables you to ingest Cisco ASA logs into Microsoft Sentinel.
Cisco ASA/FTD via AMA - This data connector helps in ingesting Cisco ASA logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here.
Underlying Microsoft Technologies used:
This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:
a. Agent-based log collection (Syslog)
Additional Information
📖 Setup Guide: Cisco firewalls connector - Connect Cisco ASA and Firepower firewalls to Microsoft Sentinel
Contents
Data Connectors
This solution provides 1 data connector(s) (plus 1 discovered⚠️):
🔍 Discovered: This item was discovered by scanning the solution folder but is not listed in the Solution JSON file.
Tables Used
This solution uses 2 table(s):
| Table | Used By Connectors | Used By Content |
|---|---|---|
CommonSecurityLog |
Cisco ASA via Legacy Agent, Cisco ASA/FTD via AMA | Analytics, Workbooks |
Heartbeat |
Cisco ASA/FTD via AMA | - |
Content Items
This solution includes 6 content item(s):
| Content Type | Count |
|---|---|
| Playbooks | 3 |
| Analytic Rules | 2 |
| Workbooks | 1 |
Analytic Rules
| Name | Severity | Tactics | Tables Used |
|---|---|---|---|
| Cisco ASA - average attack detection rate increase | Low | Discovery, Impact | CommonSecurityLog |
| Cisco ASA - threat detection message fired | Medium | Discovery, Impact | CommonSecurityLog |
Workbooks
| Name | Tables Used |
|---|---|
| Cisco | CommonSecurityLog |
Playbooks
| Name | Description | Tables Used |
|---|---|---|
| Block IP - Cisco ASA | This playbook allows blocking/allowing of IPs in Cisco ASA, using a Network Object Group. The Networ... | - |
| Cisco ASA - Create or Inbound Access Rule On Interface | This playbook allows blocking/unblocking of IPs in Cisco ASA, using Access Rules which will be c... | - |
| Cisco ASA - Create or remove access rules on an interface for IP Addresses | This playbook allows blocking/unblocking of IPs in Cisco ASA, using Access Control Entries which... | - |
Release Notes
| Version | Date Modified (DD-MM-YYYY) | Change History |
|---|---|---|
| 3.0.7 | 01-09-2025 | Updates to the template_CiscoAsaAma.json file to reflect the general availability of the Cisco ASA/FTD via AMA connector |
| 3.0.6 | 10-07-2025 | Preview tag removed from Connector title |
| 3.0.5 | 25-04-2025 | Removed Legacy Data Connector |
| 3.0.4 | 22-05-2024 | Updated connectivity criteria for Data Connector |
| 3.0.3 | 14-03-2024 | Change the connectivity criteria to use the resource graph and not LA data |
| 3.0.2 | 07-03-2024 | New AMA based connector is now in public preview |
| 3.0.1 | 31-01-2023 | Added new Data Connector Cisco ASA/FTD via AMA (Preview) to the solution |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊