Cisco ASA log analyzer

Cisco ASA log management and analysis

Cisco ASA provides the capabilities of several security devices like firewall, anti-malware, intrusion prevention system (IPS), and virtual private network (VPN) devices. Processing Cisco ASA logs is essential to monitor and gather important information pertaining to all these functions.

With EventLog Analyzer, you can collect and analyze Cisco ASA logs in one central location and also ensure that all the logs are processed and stored efficiently and securely.

EventLog Analyzer also provides out-of-the-box reports and alerts for theCisco ASA syslog analyzer data. It provides actionable insights into network traffic patterns, remote connections, and network attacks to boost your network security.

Cisco ASA logging to Syslog server

You can configure your Cisco ASA devices to send logs to EventLog Analyzer by following the steps below:

1. Navigate to Configuration → ASA Firepower Configuration → Policies → Actions Alerts and click the Create Alert drop-down menu and choose option Create Syslog Alert.
2. For web interfaces, navigate to Policies → Actions Alerts. Enter the values for the Syslog server.

• Name: Specify the name which uniquely identifies the Syslog server.
• Host: Specify the IP address/hostname of Syslog server.
• Port: Specify the port number of Syslog server.
• Facility: Select any facility that is configured on your Syslog server.
• Severity: Select any Severity that is configured on your Syslog server.
• Tag: Specify tag name that you want to appear with the Syslog message.

Track VPN access to your network

In today's increasingly dynamic workplace, users often connect to your company's network remotely using a VPN. If you're using Cisco ASA to host a VPN, EventLog Analyzer helps you track all the accesses to it. The predefined reports display all successful and failed VPN logon attempts, as well as users locked out due to multiple failed VPN logon attempts. EventLog Analyzer also categorizes the information by the user and remote device used, to provide you with a trend report.

VPN reports you need to keep track of

VPN Logons | Failed VPN Logons | VPN Lockouts | VPN Unlocks | Top Logon based on users | Top logons based on Remote devices | Top Failed VPN Logons based on User | Top Failed VPN Logons based on Remote Device | Top VPN Lockouts based on User | VPN logon trend reports | Failed VPN Logons Trend

Monitor privileged user activity

It is important to monitor administrator activity on security devices like the Cisco ASA, as these devices enforce policies and keep your network secure. A breached account or a malicious administrator could spell disaster for your organization.

EventLog Analyzer provides reports to track all Cisco ASA logons. These are classified by user, remote device, and port. You can also raise alerts for critical activities in Cisco ASA like, changes to user accounts and group policies.

Reports to track privileged accounts

Logons | Failed Logons | Top Successful logons based on user | Top logons based on remote devices | Top logons based on ports | Top failed logons based on users | Top failed logons based on remote devices | Top failed logons based on ports | Logon Trend | Failed logon trend | Added users | Deleted users | Added Group policies | Deleted group policies | Changed user privilege levels | Executed commands

Cisco ASA traffic analysis

Monitoring and analyzing your Cisco ASA traffic is useful in understanding your network activities. Cisco ASA firewall logs help you gauge the performance of your existing policies and make changes if necessary.

With EventLog Analyzer's Cisco ASA reports, you can monitor traffic and analyze patterns in allowed and denied connections. you can also categorize the reports by source, destination, port, and protocol.

Reports to monitor traffic

Allowed Firewall Traffic | Top Firewall Traffic based on Source | Top Firewall Traffic based on Destination | Top Firewall Traffic based on Protocol | Top Firewall Traffic based on Port | Firewall Denied Connections | Top Firewall Denied Connections based on Source | Top Firewall Denied Connections on Device | Top Firewall Denied Connections based on Protocol | Top Firewall Denied Connections based on Port | Denied Connections Trend

Secure your network from attacks

Cisco ASA is capable of identifying and blocking several common network attacks, leaving administrators with a wealth of threat data. With that being said, you should review your Cisco ASA's security data on a regular basis to identify threats to your network.

EventLog Analyzer makes this task easy with its Cisco ASA security reports, detailing several attack types, providing overviews and trends. With the Advanced Threat Analytics feature, you can identify malicious IPs, URLs, and domains attempting to connect to your network, and take the necessary actions at the right moment.

Reports to keep you secure

Syn Flood Attack | Routing Table Attack | Attack Reports | Top Attacks | Top Attackers | Top Attacked Device | Top Interface | Attacks Trend