Share via

Ingesting Cisco ASA logs into Sentinel using the AMA agent

Stephen Crooks 20 Reputation points
2023-07-11T14:18:52.23+00:00

Hi there,

We are looking to onboard Cisco ASA logs into Microsoft Sentinel. Currently the Cisco ASA integration guide (linked below) on Microsoft Docs is referencing using the old MMA agent to get these logs onboarded. As this agent is being deprecated in Aug 2024, we would rather not use the old MMA agent and then have to revisit this later on.

The problem is that the Cisco ASA data connector in Sentinel is utilising the CommonSecurityLog table. My understanding is that the MMA agent converted the syslogs into CEF and forwarded them to Sentinel in the CommonSecurityLog table, but that the AMA agent doesn't do this, therefore the logs are being sent to the syslog table.

My question is if anyone knows if Microsoft are working on an updated solution for Cisco ASA logs using the AMA agent, or if anyone has a work-around to get the Cisco ASA logs into sentinel in the correct format needed for the Data Connector, again, using the AMA agent.

Note: Cisco ASA doesn't support CEF so it sends in syslog.

https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/cisco-asa

Thanks in advance

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,327 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,164 questions
Accepted answer
  1. Andrew Blumhardt 9,866 Reputation points Microsoft Employee
    2023-07-14T20:23:47.94+00:00

    There is an AMA version currently undergoing private preview to be released in the near future. Sorry, no specific ETA at this time.

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. JamesTran-MSFT 36,636 Reputation points Microsoft Employee
    2023-07-19T17:53:27.2733333+00:00

    @Stephen Crooks

    Thank you for your time and patience on this and I apologize for the delayed response!

    Adding onto what was shared by Andrew, I understand that you're trying to onboard Cisco ASA logs into Microsoft Sentinel and want to use the most recent / up to date connector to avoid any migrations in the future. To hopefully help point you in the right direction or resolve your issue, I'll share my findings below.

    Findings:

    When it comes to workarounds for sending Cisco ASA Syslog's, you can look into forwarding your Syslog data to a Log Analytics workspace with Microsoft Sentinel by using the Azure Monitor Agent. For more info.

    Additional Links:

    I hope this helps!

    If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

    If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

  2. Peter Cronwright 6 Reputation points
    2024-07-07T23:15:58.16+00:00

    Just wanted to add for anyone else looking for this. The new connector is now available which uses AMA but is in preview.
    https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/cisco-asa-ftd-via-ama

    The connector creates a data collection rule which uses the "Microsoft-CiscoAsa" log stream format, which seems to do the conversion - same as the legacy agent.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.