Sending Cisco Firewall Logs to CloudWatch Without Drowning in Noise

Overview In an earlier post I set up SAML and MFA for VPN on a Cisco Firepower 1120 running ASA. Once that was in place, the next question was obvious: how do I know when something is wrong with the firewall without logging into ASDM every morning? We already ran most of our infrastructure in AWS, so Amazon CloudWatch was the natural place to land firewall logs. The first attempt worked, and it also sent everything. The log volume was noisy, expensive to keep, and useless for alerting. This post covers the version I ended up with: a small Linux syslog relay, a trimmed log stream, and a handful of metric filters that drive alarms and a dashboard.