Get in touch
← Sentinel Explorer
↳ GitHub sourceConnector

Cisco ASA/FTD via AMA

View on GitHub ↗Original file ↗

Description

The Cisco ASA firewall connector allows you to easily connect your Cisco ASA logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's network and improves your security operation capabilities.
Declared status
1
Declared author / publisher
Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

CommonSecurityLog

Declared permissions

read and write permissions.
Workspace data sources
Workspace
To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Enable data collection rule​
> Cisco ASA/FTD event logs are collected only from **Linux** agents.
Run the following command to install and apply the Cisco ASA/FTD collector:

Related content

Links established from declared identifiers and solution manifests.

Analytics rules14
Anomaly found in Network Session Traffic (ASIM Network Session schema)MediumCisco ASA - average attack detection rate increaseLowCisco ASA - Possible Data Exfiltration DetectionMediumCisco ASA - threat detection message firedMediumDetect port misuse by anomaly based detection (ASIM Network Session schema)MediumDetect port misuse by static threshold (ASIM Network Session schema)MediumExcessive number of failed connections from a single source (ASIM Network Session schema)MediumGreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)MediumLog4j vulnerability exploit aka Log4Shell IP IOCHighNetwork Port Sweep from External Network (ASIM Network Session schema)HighPort scan detected (ASIM Network Session schema)MediumPotential beaconing activity (ASIM Network Session schema)LowThreat Essentials - Time series anomaly for data size transferred to public internetMedium[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022High
Solutions1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
CiscoAsaAma
Additional source files 2Solutions/CiscoASA/Data Connectors/template_CiscoAsaAma.JSONsource ↗Solutions/CiscoASA/Data/Solution_Cisco asa.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.