How Does FMC Send High-Volume Logs to Security Analytics and Logging SaaS?
A network administrator is setting up Cisco FMC to send logs to Cisco Security Analytics and Logging (SaaS). The network administrator is anticipating a high volume of logging events from the firewalls and wants to limit the strain on firewall resources. Which method must the administrator use to send these logs to Cisco Security Analytics and Logging?
Community Insight
The question tests the supported transport path from FMC to Security Analytics and Logging SaaS; the trap is assuming a direct FMC plugin, SNMP trap, or file transfer can ship events without the Secure Event Connector.
Cisco FMC forwards high-volume firewall events to Security Analytics and Logging (SaaS) by syslog through the Secure Event Connector rather than by direct SNMP, HTTP plugin, or SFTP methods. This page confirms option C and explains why the connector is the supported cloud-logging path.
The most common wrong answer is B, assuming an FMC plugin makes HTTP POST calls directly to the cloud; Cisco SAL SaaS uses the Secure Event Connector, with syslog as the event feed.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Cisco Security Analytics and Logging (SaaS) uses the Secure Event Connector as the component that collects firewall events and forwards them to the Cisco cloud. For FMC-managed deployments, the supported high-volume path is to send events by syslog to the Secure Event Connector instead of trying to stream them directly from the firewall to the cloud. This matches the administrator's goal of limiting strain on firewall resources because the connector handles cloud delivery. Therefore, option C is the only answer that describes the documented SAL SaaS ingestion method.Why the Other Options Are Wrong
Option A is wrong because SNMP traps are for alerting and status monitoring, not for bulk security-event logging into Security Analytics and Logging. Option B is wrong because there is no documented "Security Analytics FMC plugin" that sends events by HTTP POST to the SaaS service for this purpose. Option D is wrong because SFTP from the FMC CLI is a file-transfer mechanism, not the supported event-streaming path to Cisco Security Analytics and Logging. None of these alternatives provides the Secure Event Connector role required by the SaaS architecture.Community Comment Notes
dfb0b7d and aa4a63c both selected C and described the Secure Event Connector as the component that receives events and forwards them to the Cisco cloud. dfb0b7d noted that the SEC "receives events from ASA, and FDM-managed devices and forwards them to the Cisco cloud", which reinforces its role as the cloud-forwarding gateway rather than a direct firewall upload. XBfoundX supplied a Cisco support link for Firepower Threat Defense configuration, supporting the view that this is a documented FMC/FTD logging workflow. The community consensus is therefore consistent with the vendor architecture and with option C.Official Reference
Exam Strategy
Memorize the SAL SaaS chain: FMC/FTD events go to the Secure Event Connector, which forwards them to the Cisco cloud. Reject answers that propose direct SNMP traps, an FMC HTTP plugin, or SFTP from the CLI, because those are not the supported high-volume event path.
Frequently Asked Questions
Why not use HTTP POST with an FMC plugin for Security Analytics and Logging SaaS?
There is no documented Security Analytics FMC plugin that posts events directly to the SaaS cloud for this workflow. Cisco uses the Secure Event Connector to receive and forward firewall events.
Does the Secure Event Connector receive logs directly from FTD or from FMC?
The SEC receives events from supported Cisco security devices, including FTD and ASA, and forwards them to the Cisco cloud; FMC is used to configure and manage the logging path.