This week I ran into an issue that seems rather unexplained, but I felt I should mention it to help others, especially during this awkward time with being many potential targets of the current rampage of cyberattacks during the Ukraine attack.
I use CDO (Cisco Defense Orchestrator) and StealthWatch Cloud (SWC), now called Security Analytics. After some time of successful use, the long "arm" between CDO and SWC failed. It was assumed by TAC that this could mean "the firewall" stopped logging to CDO, or lost its connection to CDO.
But we have many sets of HA FTD firewalls that report to CDO. So what gives? Why the sudden and quiet failure as shown below? Why would a multitude of firewalls all stop communicating at once?
It's confusing enough to know exactly how CDO, SWC, and SecureX all play together, but this was perplexing. Did the API key fail? What there some new version of SWC or CDO deployed through scrum that failed?
Well, here's what I found: Nothing. No rhyme or reason. It just failed. We're all guessing as to exactly what caused the trouble or what caused CDO to stop talking to SWC. My only guess was changing the hostnames of the firewalls.
The fix: Un-register and re-register all firewalls with CDO. Once the first pair was re-registered, the connection-events sensor came back online in SWC.
