Manage SAL (OnPrem) for Security Cloud Control-Managed Threat Defense Devices

Starting with Secure Firewall Threat Defense(formerly Firepower Threat Defense) version 7.2, you can choose to send fully qualified events that are generated by Security Cloud Control-managed threat defense devices to the management center. The management center receives and displays data analytics for these events. The management center receiving and displaying the event data is also referred to as an analytics-only management center. .

If your devices are enabled to send connection events to a Secure Network Analytics Manager using SAL (OnPrem), you can view and work with these remotely stored events in the management center event viewer and context explorer, and include them when generating reports. By deploying the Secure Network Analytics appliance and integrating it with the firewall deployment, you can export the event data to the Secure Network Analytics appliance. This allows you to view and manage the events in the management center UI. From the management center interface, you can also cross-launch to Secure Network Analytics Manager to view and manage the events data.

The management center can receive and display event analytics for the following Security Cloud Control-managed threat defense devices:

• New or existing threat defense devices onboarded to Security Cloud Control

  For information on onboarding a threat defense device to Security Cloud Control, see Prerequisites to Onboard a Device to Cloud-delivered Firewall Management Center.

  The workflow is as follows:

  1. Onboard a threat defense device to Security Cloud Control.

     Onboard the threat defense devices using the onboarding methods that are described in Prerequisites to Onboard a Device to Cloud-delivered Firewall Management Center. The onboarding process includes assigning policies and choosing the appropriate licenses.

  2. Register this threat defense device in the appropriate management center.

     For the management center to display events generated by a Security Cloud Control-managed threat defense device, you must register the threat defense device in the management center. To register this device in the management center, enable the device to be registered using the configure manager add {hostname | IPv4_address | IPv6_address}reg_key[nat_id] CLI, and then add the device to the management center using the Security Cloud Control Managed Device check box.

     Note	The registration key and the NAT ID must be unique from those used while onboarding the device to Security Cloud Control.

     For more information, see Add a Device to the Management Center and Complete the Threat Defense Initial Configuration Using the CLI in Firepower Management Center Device Configuration Guide.

  3. View events in the management center or cross-launch to a configured Secure Network Analytics Manager.

     To view and work with the events in the management center event viewer. If the Secure Network Analytics appliance is deployed and integrated with the firewall deployment, you can export the event data to the Secure Network Analytics appliance. This allows you to cross-launch from the management center UI to the Secure Network Analytics Manager to view and manage the events data.

     For more information, see Events and Assets and Event Analysis Using External Tools.

• Existing threat defense devices on the management center.

  You can change the management of the threat defense devices from management center to Security Cloud Control using the change threat defense manager functionality. The change threat defense manager functionality provides you to ability to change the management of threat defense devices from management center to Security Cloud Control. While changing the manager, you can choose to retain the events data generated by these threat defense devices on the management center. If you choose to retain the events data on the management center, a copy of the threat defense device in an analytics-only mode is retained on the management center.

  For more information, see Migrate Secure Firewall Threat Defense to Cloud.

  The workflow is as follows:

  1. Onboard the management center to Security Cloud Control

     To onboard the existing threat defense devices from management center to Security Cloud Control, you must onboard the appropriate management center to Security Cloud Control.

     For more information, see Onboard an FMC.

  2. Complete the change threat defense management process

     During the change threat defense management process, while changing the device manager, you can choose to retain events data generated by these threat defense devices on the management center.

     For more information, see Migrate Secure Firewall Threat Defense to Cloud.

  3. View events in the management center or cross-launch to configured Secure Network Analytics appliance.

     To view and work with the events in the management center event viewer. If the Secure Network Analytics appliance is deployed and integrated with the firewall deployment, you can export the event data to the Secure Network Analytics appliance. This allows you to cross-launch from the management center UI to the Secure Network Analytics Manager to view and manage the events data.

     For more information, see Events and Assets and Event Analysis Using External Tools.