Cisco eStreamer collector

Service description

The Cisco Event Streamer (also known as Cisco eStreamer) allows you to stream Firepower System events to external client applications. You can stream host, discovery, correlation, compliance allow list, intrusion, user activity, file, malware, and connection data from a Management Center and you can stream intrusion data from 7000 and 8000 series devices.

Data source description

Currently, the Cisco eStreamer collector generates host, discovery, correlation, compliance allow list, intrusion, user activity, file, malware, and connection events. The collector processes the eStreamer responses and sends them to the Devo platform, which will categorize all the information received on the following tables:

Setup

The Cisco eStreamer data collector works over the Cisco FMC (Firepower Management Center) devices. To start receiving data from the eStreamer protocol, you need to set up the eStreamer service in the FMC.

Setting up eStreamer

1. Access the FMC web console.

2. Go to System → Integration → eStreamer
   
   

   Open

   

3. Check the events that you want to receive and save the changes.
   
   

   Open

   

4. Create a new client and save the certificate (and password) to use later in the collector. Using a password is mandatory. The IP to use is the IP of the collector, the client, not the one from FMC server.

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

Troubleshooting

Some common points to check in case of problems:

• Doublecheck that the IP of the FMC is the parameter host, and the certificate was created for the IP of the client (the collector).

• The FMC has the API server listening and the IP address that is used can be checked by executing this command from a terminal in the FMC: netstat -an | grep 8302

• It is needed that both FMC and the collector have network visibility. Check if there is a firewall between the FMC and the collector. Port 8302 must be open for the collector. You can check it by installing nmap utility in the collector computer (for instance, in Ubuntu or Debian, sudo apt install nmap). Then execute from a terminal in the collector computer: nmap -p8302 x.y.ip.fmc where x.y.ip.fmc should be the IP of the FMC.

• The certificate generated should use a password. A password-less certificate can cause an error in the collector

• It is possible to discover if the FMC is rejecting the certificate. Execute in a terminal in the FMC the command cat /var/log/messages | grep "EventStreamer" | grep "Certificate" or cat /var/log/messages | grep "EventStreamer" | grep "Certificate" | grep ERROR

• Other interesting points to check can be found on this website.

Change log for 1.x.x