Monitor Cisco Firepower FTD with Elastic Fleet

Last updated: Jul 12, 2026

Illustration showing Elastic and Cisco logos with hearts for Cisco Firepower FTD monitoring

This guide assumes that you already have a fully working Elastic Stack with Fleet Server. If needed, you can follow this wonderful 😎 tutorial to install a complete Elastic Stack. In this article, we will see how to monitor a Cisco Firepower FTD firewall with Elastic Fleet, Elastic Agent and Kibana.

In this tutorial, we will install the Cisco FTD integration on the same Debian Linux server where Elasticsearch, Kibana and the Fleet Server are already installed.

Network Architecture

As shown in the network architecture diagram, the Elastic Agent will be installed on the Elasticsearch server. The Cisco Firepower FTD firewall will forward its logs to Elastic Fleet via the Syslog protocol on 9003/udp. This listening port can be changed if needed.

Cisco Firepower FTD sending syslog logs to Elastic Agent, Fleet Server, Elasticsearch and Kibana — Cisco Firepower FTD monitoring architecture with Elastic Fleet, Elastic Agent, Elasticsearch and Kibana.

Add Cisco FTD Integration in Kibana

First, open Kibana and add the Cisco FTD integration so that your Elastic Stack can collect and parse logs sent by your Cisco Firepower FTD firewall. However, this integration does not include a prebuilt Kibana dashboard, so we will create our own dashboard later in this guide.

In Kibana, open the main menu, then go to Management → Integrations:

Kibana main menu showing the Management section and the Integrations entry — Opening the Integrations menu in Kibana.

Search for FTD, then click the Cisco FTD integration:

Kibana Integrations page showing a search for FTD and the Cisco FTD integration result — Searching for the Cisco FTD integration in Kibana.

Click the Add Cisco FTD button:

Kibana Cisco FTD integration page showing the Add Cisco FTD button — Adding the Cisco FTD integration in Kibana.

Enter a name for the Cisco FTD integration, then scroll down:

Kibana form showing the integration name field for the Cisco FTD integration — Naming the Cisco FTD integration in Kibana.

Enter the IP address of your Elastic Agent server, then keep or change the UDP port used to receive Cisco Firepower FTD syslog logs:

Kibana Cisco FTD integration settings showing the UDP host and port for syslog logs — Configuring the UDP host and port used to collect Cisco FTD syslog logs.

At the bottom of the page, select the Existing hosts tab, choose the Fleet Server Policy, then click Save and continue:

Kibana page showing the Existing hosts tab, Fleet Server Policy selection, and Save and continue button — Adding the Cisco FTD integration to an existing Fleet policy.

Finally, click Save and deploy changes to apply the Cisco FTD integration to the selected Fleet policy:

Kibana confirmation dialog showing the Save and deploy changes button for the Cisco FTD integration — Deploying the Cisco FTD integration changes to the selected Fleet policy.

On the Elasticsearch server, check that Elastic Agent is listening on the configured Cisco FTD syslog port:

root@elk:~# ss -taun | grep 9003
udp   UNCONN    0      0                                  192.168.1.200:9003                 0.0.0.0:*
tcp   LISTEN    0      4096                               192.168.1.200:9003                 0.0.0.0:*

Configure Cisco Firepower FTD

We will now configure the Cisco Firepower FTD firewall to forward filtered traffic logs to the Elastic Agent, which is listening on 192.168.1.200 and udp/9003.

Go to Objects > Syslog Servers, then click the Add button:

Cisco Firepower FTD Syslog Servers page showing the Add button — Adding a syslog server object in Cisco Firepower FTD.

Enter the Syslog server information, using the IP address of the Elastic Agent that will receive the Cisco FTD logs, then click OK:

Cisco Firepower FTD dialog showing syslog server IP address, UDP protocol and port 9003 — Configuring the syslog server used to send Cisco FTD logs to Elastic Agent.

Now that the Elastic Agent server has been declared as a Syslog server object, go to System Settings > Logging Settings:

Cisco Firepower FTD System Settings menu showing the Logging Settings entry — Opening the Logging Settings menu in Cisco Firepower FTD.

Configure the Logging Settings as shown below, then click Save:

Cisco Firepower FTD Logging Settings page with syslog server, severity level and Save button — Configuring Cisco Firepower FTD logging settings for syslog forwarding.

Go to Policies, then edit the access control rule for which you want to enable traffic logging:

Cisco Firepower FTD access control policy showing the edit button for a firewall rule — Editing an access control rule in Cisco Firepower FTD.

In the Logging tab, enable connection logging, select the previously configured Syslog Server, then click OK:

Cisco Firepower FTD access rule Logging tab showing connection logging and syslog server selection — Enabling connection logging for an access rule in Cisco Firepower FTD.

Create a Kibana Dashboard for Cisco Firepower FTD

Unlike some other Elastic integrations, the Cisco FTD integration does not include a prebuilt Kibana dashboard. We will therefore create a custom dashboard to monitor Cisco Firepower FTD traffic logs.

In Kibana, open the main menu, then go to Analytics → Dashboards:

Kibana main menu showing the Analytics section and the Dashboards entry — Opening the Dashboards menu in Kibana.

Click Create dashboard to create a new Kibana dashboard:

Kibana Dashboards page showing the Create dashboard button — Creating a new Kibana dashboard.

Geo Map by Country

The goal is to identify the countries generating or receiving traffic through the Cisco Firepower FTD firewall.

Expected result:

Kibana map showing Cisco FTD traffic volume by country — Cisco FTD traffic visualization by country in Kibana Maps.

In the new dashboard, click Create visualization to add a map panel:

Kibana dashboard editor showing the Create visualization option — Creating a new visualization panel in the Kibana dashboard.

Click Add layer, then select Choropleth:

Kibana Maps interface showing the Add layer button and the Choropleth layer option — Adding a choropleth layer in Kibana Maps.

Configure the Boundaries source and Statistics source, then click Add and continue. Once the map is displayed, click Save and return:

Kibana Maps settings showing World Countries boundaries and Cisco FTD logs joined by destination country — Configuring a choropleth layer to map Cisco FTD logs by destination country.

Blocked Traffic Gauge

The goal is to monitor blocked traffic in near real time from Cisco Firepower FTD logs.

Expected result:

Kibana gauge showing the amount of blocked network traffic from Cisco FTD logs — Gauge panel showing blocked network traffic from Cisco FTD logs in Kibana.

Click Add panel, select New panel, then choose Lens:

Kibana dashboard editor showing the Add panel menu, New panel option and Lens visualization — Adding a new Lens panel to the Kibana dashboard.

Select Gauge, choose the logs-* data view, then configure the Metric field:

Kibana Lens showing a gauge visualization filtered on blocked Cisco FTD traffic logs — Configuring a Kibana Lens gauge to display blocked Cisco FTD traffic.

Adjust the Minimum value and Maximum value according to the usual amount of blocked traffic on your network:

Kibana gauge configuration showing minimum and maximum values for blocked traffic — Adjusting the minimum and maximum values of the blocked traffic gauge in Kibana.

Top Source Ports by Protocol

The goal is to identify the most frequently used source ports in Cisco Firepower FTD traffic logs.

Expected result:

Kibana pie chart showing the most used source ports in Cisco FTD traffic logs — Pie chart showing the most frequently used source ports in Cisco FTD traffic logs.

Click Add panel, then select Visualization:

Kibana dashboard editor showing the Add panel menu and the Visualization option — Adding a visualization panel to the Kibana dashboard.

Configure the Pie visualization by using network.transport as the slice field and Records as the metric:

Kibana Lens pie chart configuration using network.transport slices and Records metric — Configuring a Kibana pie chart to show Cisco FTD traffic by network transport.

Add a second slice field, then select source.port and rank the top values by Firewall flows:

Kibana Lens pie chart configuration showing source.port as a slice field ranked by firewall flows — Configuring the pie chart to display the top source ports from Cisco FTD traffic logs.

Top Destination Ports

The goal is to identify the most frequently used destination ports in Cisco Firepower FTD traffic logs.

Expected result:

Kibana pie chart showing the most used destination ports in Cisco FTD traffic logs — Pie chart showing the most frequently used destination ports in Cisco FTD traffic logs.

Click Add panel, then select Visualization:

Configure the Pie visualization by using network.transport as the slice field and Records as the metric:

Add a second slice field, then select destination.port and rank the top values by Firewall flows:

Kibana Lens pie chart configuration showing destination.port as a slice field ranked by firewall flows — Configuring the pie chart to display the top destination ports from Cisco FTD traffic logs.

Top Blocked IP Addresses

The goal is to identify the IP addresses most frequently blocked by the Cisco Firepower FTD firewall.

Expected result:

Kibana tag cloud showing the IP addresses most frequently blocked by Cisco FTD — Tag cloud showing the IP addresses most frequently blocked by Cisco FTD.

Click Add panel, then select Visualization:

Configure the Tag cloud visualization by using cisco.ftd.security_event.src_ip as the field and a Count metric filtered on blocked traffic:

Kibana tag cloud configuration using cisco.ftd.security_event.src_ip and a Count metric filtered on blocked traffic — Configuring a tag cloud to display the IP addresses most frequently blocked by Cisco FTD.

Top Blocking Rules

The goal is to identify the blocked access control rules that match the most Cisco Firepower FTD traffic.

Expected result:

Kibana table showing the Cisco FTD blocking rules with the highest number of matched records — Table showing the Cisco FTD blocking rules with the highest number of matched records.

Click Add panel, then select Visualization:

Configure the Table visualization by using cisco.ftd.rule_name as the row field and a Count of records metric filtered on blocked traffic:

Kibana table configuration using cisco.ftd.rule_name and a Count of records metric filtered on blocked traffic — Configuring a table to display the Cisco FTD blocking rules with the highest number of matched records.

Conclusion

You now have a basic but useful Kibana dashboard to monitor Cisco Firepower FTD logs with Elastic Fleet and Elastic Agent. From here, you can extend the dashboard with additional filters, alerts, and visualizations based on your own firewall rules and network traffic patterns. Now it's your turn!