Install the Secure Event Connector on the Security Cloud Control Connector VM

This task enables secure event logging by installing and configuring the Secure Event Connector on your Security Cloud Control Connector VM to establish communication between on-premises devices and the cloud-based logging service.

The Secure Event Connector enables secure logging analytics for your security devices by creating a secure tunnel between your on-premises environment and the cloud logging service. This connector must be properly installed and configured to ensure events are successfully transmitted and logged.

Before you begin

You should have installed Security Cloud Control Connector VM as described inInstall a Security Cloud Control Connector, to Support a Secure Event Connector, Using a Security Cloud Control VM Image .

Follow these steps to install the Secure Event Connector on the Security Cloud Control Connector VM:

Procedure

Step 1

Log in to Security Cloud Control. From the Security Cloud Control Home page, click Firewall.

Step 2

In the left pane, choose Administration > Secure Connectors.

Step 3

Select the Security Cloud Control Connector that you onboarded above. In the Secure Connectors table, it will be called a Secure Event Connector and it should still be in the "Onboading" status.

Step 4

Click Deploy an On-Premises Secure Event Connector in the Actions pane on the right.

Step 5

In step 2 of the wizard, click the link to Copy SEC bootstrap data.

Step 6

Create an SSH connection to the Security Cloud Control Connector and log in as the CDO user.

Step 7

Once logged in, switch to the sdc user. When prompted for a password, enter the password for the "Security Cloud Control" user. Here is an example of those commands: 

[cdo@sdc-vm ~]$ sudo su sdc
 [sudo] password for cdo: <type password for cdo user> 
[sdc@sdc-vm ~]$

Step 8

At the prompt, run the SEC.sh setup script:

[sdc@sdc-vm ~]$ /usr/local/cdo/toolkit/sec.sh setup

Step 9

At the end of the prompt, paste the bootstrap data you copied in step 4 and press Enter.

Please copy the bootstrap data from Setup Secure Event Connector page of CDO: KJHYFuYTFuIGhiJKlKnJHvHfgxTewrtwE
 RtyFUiyIOHKNkJbKhvhgyRStwterTyufGUihoJpojP9UOoiUY8VHHGFXREWRtygfhVjhkOuihIuyftyXtfcghvjbkhB=

After the SEC is onboarded, the SEC.sh runs a script to check on the health of the SEC. If all the health checks are "green," the health check sends a sample event to the Event Log. The sample event shows up in the Event Log as a policy named "SEC-health-check."

The Secure Event Connector installation process is illustrated, showing the bootstrap data and health check script execution. The image highlights the successful health check and the appearance of the sample event in the Event Log.

If you receive a message that the registration failed or that the SEC onboarding failed, go to Troubleshoot SEC Onboarding Failures.

If you receive the success message return to Security Cloud Control and click Done on the Deploy an ON-Premise Secure Event Connector dialog box.

Return to Implement secure logging analytics (SaaS) for ASA devices .

The Secure Event Connector is successfully installed and configured on the Security Cloud Control Connector VM. The connector establishes a secure communication channel for event logging, and a health check event appears in the Event Log confirming proper operation.