Cisco ASA
The Cisco Adaptive Security Appliance is a long-established stateful firewall and VPN concentrator, still widely deployed at the perimeter and as the remote-access gateway for AnyConnect users. Its syslog output is distinctive: every message carries a numeric identifier that names the event precisely, so connection build and teardown, translation events, access-list denies, VPN session establishment and user authentication each have their own stable message ID. That structure makes ASA logs unusually good source material for detection — VPN logins from new countries, sustained access-list denies, and session teardowns with byte counts for exfiltration analysis all come from this one feed.
Device-side setup
Configure the device to forward syslog to the listener described below, following the vendor's own documentation for its syslog export. Nothing has to be built on the platform side beyond installing the template below — it supplies the parser and wires the pipeline.
Syslog configuration
The appliance sends to a syslog listener: either the cloud syslog endpoint or a local collector appliance. The two destinations use different ports. The cloud endpoint has a per-tenant domain and a block of ports allocated to your account: Platform → Administration → Syslog Ports shows the domain, the port range, and which protocol listens on which port — read the numbers off that page rather than assuming a standard one. A collector appliance listens by default on UDP/514, TCP/514, TLS on 6514 and TLS RFC 6587 on 7514, and each of its listeners can carry a Customer Tag that attributes the records arriving on it. See Syslog Import for the protocol options and Syslog Ports for the listener configuration. Either TLS listener presents a certificate the sending device has to trust: the Download CA (ca.crt) button on the Syslog Ports page supplies it, and without it the handshake fails with nothing logged on the platform side. Note the ASA behaviour of blocking new connections when TCP logging is configured and the log destination becomes unreachable — a real operational risk worth calling out.
Install the Application
Go to Platform → Applications → Install Application From Template and choose Cisco ASA Syslog from the On-Premise IT category. The template supplies the parser and builds the pipeline — there is no source to add, no processor to attach, and no sink to wire by hand. Both parameters are required:
| Parameter | Notes |
|---|---|
| datalake | Pre-filled managed. |
| datalake index name | Pre-filled CiscoASA. Two applications writing to the same index name in the same lake will collide, and the second one aborts. |
Press Install. The application then appears in the Installed Applications view, where its badge reads Running once the pipeline is up.
Related
- On-Prem / Syslog — other syslog devices.
- Syslog Import and Syslog Ports — the transport and listener.
- No parser cookbook exists yet for Cisco ASA. The template ships a working parser, so one is only needed if you want to customise the parsing; the parser cookbooks are the starting point if you do.
- Time Adjustment — a recipe for correcting device timestamps sent in local time.