elastic / elastic/beats

Support Cisco FMC fileset

Open
#34,010 8 comments 0 reactions 0 assignees View on GitHub
enhancement Stalled Team:Security-Deployment and Devices
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 2h
Merged PRs (30d)
364

Description

**Describe the enhancement:**
Cisco firewalls are managed by the Cisco Firepower Management Center (FMC)
Security events such as intrusion events and security intelligence events are logged from the FMC itself instead of the FTD-device, which is already supported in the Cisco Filebeat Module.
The logs from the FMC does not fit the current module, and the entire log ends up in "log.orginal" which is not indexed or searchable.
**Describe a specific use case for the enhancement or feature:**
Being able to index, search, and use Elastic in a more comprehensive way in the SOC. Make visualizations and dashboards to better support the IRT-team when investigating incidents.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.