Setting up this integration requires you to create one security device in Workbench for the SIEM (you will find a link to those instructions in this guide), and a separate security device for the Cisco ASA integration (that device will reference the SIEM's device).

Scope and Limitations

When choosing to set up this integration, remember the following:

1. You must use a supported SIEM to set up this type of connection. This integration's supported SIEMs include:
   • Exabeam New-Scale SIEM
   • Splunk
   • Sumo Logic
2. Custom detection rules cannot be used for a via SIEM connection.
3. If you are using the Sumo Logic Data Lake SKU:
   • You may onboard a via SIEM integration while using the Sumo Logic Data Lake SKU, but this may result in unexpected usage spikes and potential license overages.
   • These via SIEM integrations run predefined queries designed for the Sumo Logic Cloud SIEM SKU, which may consume significant search capacity.
   • There is currently no mechanism to prevent this behavior during self-service onboarding.

Prerequisites

1. For Sumo Logic Data Lake, we strongly recommend verifying your Sumo SKU before proceeding. Please consult your internal admin or Sumo Logic representative if you have any questions.

2.  If you are subject to Sumo Logic’s Flex pricing, you will need to provide a comma-separated list of indexes you wish for us to query when you set up the security device in Workbench.

   • If you are not sure if this applies to you or if you need more information, see Considerations for Sumo Logic Flex Pricing Customers.

Quick Links

Step 1: Set Up Logging

You must first confirm that your SIEM's data sources are logging properly, and then specify which logs the SIEM should ingest, where they should be stored, and any other data quality information that should be included.

You should work with your SIEM representative or refer to your SIEM's documentation if you need help with this step. The following web resources are also available:

Step 2: Set Up the SIEM

You must set up the SIEM as its own security device before you can configure this integration's security device, since you are using it as a connection. Select the link below to go to your SIEM's setup guide, then return to this page when you have completed it:

• Exabeam Fusion New-Scale SIEM
• Splunk
• Sumo Logic

Important

Be sure to confirm the SIEM's security device in Workbench is connected and logs are flowing before continuing to Step 3 in this guide.

Step 3: Add Cisco ASA (via SIEM) as a Security Device in Workbench