withple.blogg.se - Cisco secure firewall

The SKU is tied to the Firewall platform and not the software running on it.

CDO Device License - is tied to the number of devices managed by CDO.

CDO-ML-XXXX-LIC - is a combined SKU which offers device management with an unlimited amount of log storage with 90 days of rolling retention.

For the use of two CDO tenants, combine two SKU counts.

CDO Base Licensing (CDO-SEC-SUB) - is tied to CDO tenancy, one SKU count per CDO tenant.

The licensing has multiple options, depending on the features and deployment use case. The cloud-delivered FMC is part of the Cisco Defense Orchestrator and follows the CDO licensing model. The Cisco Secure Firewall inherently supports granularity when choosing one or any of the above combinations for logging by providing the flexibility of choosing event types and their destination.Į.g., Connection Events can be streamed to the cloud, but the IPS and File and Malware events can be retained on-premises. Using the on-premises FMC for logging and analytics only requires running version 7.2 or later.

External SIEM - Combine with any of the above options, you have the flexibility of logging to an external SIEM through eStreamer and Syslog.

It can be further enhanced by integrating with Cisco Secure Analytics and Logging on-premises, which provides additional behavioural analysis powered by Secure Network Analytics (formerly known as Stealthwatch Enterprise). Logging to an on-premises FMC - configuration management is cloud-delivered, but the log storage and analytics are available through an on-premises FMC.It can also send behavioural analysis alerts to an external SIEM. It can be further enhanced by behavioural analysis from Secure Cloud Analytics (formerly known as Stealthwatch Cloud). Complete Cloud Adoption - configuration management, log storage and analytics are cloud-delivered.For example, customers can manage the firewall from the cloud but retain the events with the sensitive information on-premises, or cloud-savvy customers can move the eventing and logging to the cloud with the unified event viewer in the cloud, offering both real-time and historical views. The cloud-delivered FMC offers flexible deployment options depending on the use case requirements.