Elastic Stack 8 - Filebeat to monitor Cisco Firepower Firewalls

Beats logo

Cisco Firepower are the worst firewalls in the entire universe, but this is not the object here… I'm only going to talk about monitoring this crap in a Elastic Stack environment.

To do this, we're going to work with the Filebeat module.

One good thing is that Filebeat comes with a Cisco module that can handle Firepower logs sent via syslog. The bad thing is that there is no preset dashboard so we will have to create one manually.

Kibana | Firepower Dashboard
Cisco Firepower Dashboard.

Filebeat Architecture

SIEM | Filebeat schema with elasticsearch and kibana
Filebeat Architecture.

Configuring Cisco Firepower

The first thing we need to do is to configure our Cisco Firepower to send syslog informations to our Filebeat agent. To do this, we need to declare the syslog server and enable syslog to the rules we want to monitor.

Add syslog server object

  • Go to Objects > Syslog servers and click Add button :
FirePower | Add syslog server
  • Enter Syslog server informations (which is our elastic server) then click OK :
FirePower | Add syslog server

Configure logging

  • From main Firewall configuration page go to Logging Settings :
FirePower | System settings menu
  • Go to Logging Settings menu and configure Logging :
FirePower | System settings, Logging Settings menu

Enable syslog to rules

  • Edit Firewall rule(s) you want to monitor :
FirePower | Edit firewall rule
  • Enable Logging :
FirePower | Edit firewall rule

Installing Filebeat

Note : I'll install filebeat on the same machine than the Elasticsearch engine.

If you have not yet imported Elasticsearch PGP key and add repository definition, see part I.

  • Install Filebeat :
root@host:~# apt install filebeat
  • Edit /etc/filebeat/modules.d/cisco.yml to enable ftd/firepower module :
  ftd:
    enabled: true

    var.syslog_host: 0.0.0.0
    var.syslog_port: 514
  • Edit /etc/filebeat/filebeat.yml to set filebeat :
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]

  # Protocol - either `http` (default) or `https`.
  protocol: "https"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "elastic"
  password: "elastic_password;)"
  ssl.verification_mode: none


# =================================== Kibana ===================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  host: "https://X.X.X.X:5601"
  ssl.verification_mode: none
  • Restart Filebeat :
root@host:~# systemctl restart filebeat

Kibana

Check logs

Wait some minutes and open kibana.

  • Go to Analytics > Discover :
Kibana | Main menu, Analytics, Discover
  • Select filebeat-* and verify that your Data arrives :
Kibana | Main menu, Discover

Dashboard

There is no predefined dashboard for Firepower devices, so we need to create a new one.

  • Open main menu and go to Kibana > Dashboard :
Kibana | Main Menu to Dashboard
  • Click Create dashboard :
Kibana | Create Dashboard button

Maps

Goal
Kibana | Maps Visualisation
Procedure
  • Click Create new Maps icon :
Kibana | Create Maps Dashboard
  • Click Add layer > Choropleth :
Kibana | Add layer to a Map Visualisation
  • Set Boundaries source and Statistics source parameters, then click Save and return :
Kibana | Map Visualisation parameters

Gauge

Goal
Kibana | Gauge Visualisation
Procedure
  • Click Select type > Aggregation based > Gauge and search for filebeat :
Kibana | Add Gauge Visualisation
  • Add Filter select Aggregation then click Save and return :
Kibana | Set Gauge Visualisation parameters

Tag cloud

Goal
Kibana | Tag cloud Visualisation
Procedure
  • Click Select type > Aggregation based > Tag cloud and search for filebeat :
Kibana | Add Tag cloud Visualisation
  • Add Filter set Aggregation parameters then click Save and return :
Kibana | Set VisualiTag cloud Visualisation parameters

Pie

Goal
Kibana | Pie Visualisation
Procedure
  • Click Select type > Aggregation based > Pie and search for filebeat :
Kibana | Add Pie Visualisation
Source Port and Transport
  • Set Metrics and Buckets parameters then click Save and return :
Kibana | Set Pie Visualisation parameters
Destination Port and Transport
  • Set Metrics and Buckets parameters then click Save and return :
Kibana | Set Pie Visualisation parameters

Data table

Goal
Kibana | Data table Visualisation
Procedure
  • Click Select type > Aggregation based > Data table and search for filebeat :
Kibana | Add Data table Visualisation
  • Add Filter set Metrics and Buckets parameters then click Save and return :
Kibana | Set Data table Visualisation parameters
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

Contact :