How Does FMC Send High-Volume Logs to Security Analytics and Logging SaaS?
Short answer
C Configure Cisco FMC to send firewall events by syslog to the Secure Event Connector, which forwards them to Cisco Security Analytics and Logging (SaaS).
Question
Key Takeaways
The question tests the supported transport path from FMC to Security Analytics and Logging SaaS; the trap is assuming a direct FMC plugin, SNMP trap, or file transfer can ship events without the Secure Event Connector.
Cisco FMC forwards high-volume firewall events to Security Analytics and Logging (SaaS) by syslog through the Secure Event Connector rather than by direct SNMP, HTTP plugin, or SFTP methods. This page confirms option C and explains why the connector is the supported cloud-logging path.
Common mistake: The most common wrong answer is B, assuming an FMC plugin makes HTTP POST calls directly to the cloud; Cisco SAL SaaS uses the Secure Event Connector, with syslog as the event feed.
Expert Analysis
Why the Answer Is Correct
Cisco Security Analytics and Logging (SaaS) uses the Secure Event Connector as the component that collects firewall events and forwards them to the Cisco cloud. For FMC-managed deployments, the supported high-volume path is to send events by syslog to the Secure Event Connector instead of trying to stream them directly from the firewall to the cloud. This matches the administrator's goal of limiting strain on firewall resources because the connector handles cloud delivery. Therefore, option C is the only answer that describes the documented SAL SaaS ingestion method.
Why the Other Options Are Wrong
Option A is wrong because SNMP traps are for alerting and status monitoring, not for bulk security-event logging into Security Analytics and Logging. Option B is wrong because there is no documented "Security Analytics FMC plugin" that sends events by HTTP POST to the SaaS service for this purpose. Option D is wrong because SFTP from the FMC CLI is a file-transfer mechanism, not the supported event-streaming path to Cisco Security Analytics and Logging. None of these alternatives provides the Secure Event Connector role required by the SaaS architecture.
Community Comment Notes
dfb0b7d and aa4a63c both selected C and described the Secure Event Connector as the component that receives events and forwards them to the Cisco cloud. dfb0b7d noted that the SEC "receives events from ASA, and FDM-managed devices and forwards them to the Cisco cloud", which reinforces its role as the cloud-forwarding gateway rather than a direct firewall upload. XBfoundX supplied a Cisco support link for Firepower Threat Defense configuration, supporting the view that this is a documented FMC/FTD logging workflow. The community consensus is therefore consistent with the vendor architecture and with option C.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
Memorize the SAL SaaS chain: FMC/FTD events go to the Secure Event Connector, which forwards them to the Cisco cloud. Reject answers that propose direct SNMP traps, an FMC HTTP plugin, or SFTP from the CLI, because those are not the supported high-volume event path.
Frequently Asked Questions
Why not use HTTP POST with an FMC plugin for Security Analytics and Logging SaaS?
Does the Secure Event Connector receive logs directly from FTD or from FMC?
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
dfb0b7d 👍 3 Answered CThe Secure Event Connector (SEC) is a component of the Security Analytics and Logging SaaS solution. It receives events from ASA , and FDM-managed devices and forwards them to the Cisco cloud.
-
aa4a63c 👍 2 Answered CTo send FMC logs to the cloud using Cisco Security Analytics and Logging (SaaS), you'll need to configure your FMC to forward logs to a Secure Event Connector (SEC), which then sends them to the Cisco cloud for storage and analysis.
-
XBfoundX 👍 1The Secure Event Connector (SEC) is a component of the Security Analytics and Logging SaaS solution. It receives events from ASA , and FDM-managed devices and forwards them to the Cisco cloud. Security Cloud Control displays the events on the Event Logging page enabling you to analyze the security events from all devices in one place. The SEC is installed on a Secure Device Connector deployed in your network, on its own Security Cloud Control Connector virtual machine deployed in your network, or on an AWS Virtual Private Cloud (VPC).
-
XBfoundX 👍 1 Answered Chttps://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/223081-configure-firepower-thread-defense.html
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.