All Apps and Add-ons

Filtering FirePower logs to reduce license usage

smallfry
Explorer

Hi everyone. As you know, FirePower produces tons of logs that took up the expensive Splunk licensing. I filtered out a lot of Windows event logs and would like to do the same for FirePower. Any recommendations as to what to filter, such as those that took up lots of space but are not really useful?

0 Karma

douglashurd
Builder

One of our architects here in Cisco tells me that he eliminates DNS requests (Connection Events) from logging and sees a massive reduction.

0 Karma

DavidHourani
Super Champion

Hi @smallfry,

What's useful or not really depends on your policy, best way to go about this is to take a couple of weeks of logs and run them through security teams and see what are their requirements.

If there are no requirements then I suggest increasing the syslog facility level for logging and log alerts/warnings only for a start and if that's not enough then go for the other levels as well. FirePower is very flexible for when it comes to logging so you can even do that on a rule base and remove any non-priority subnets from the logging.

Cheers,
David

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!