Skip to content
KYRA MDR KYRA MDR Docs

Cisco AnyConnect Integration

Overview

Cisco AnyConnect provides enterprise VPN remote access with posture assessment. KYRA MDR collects AnyConnect session logs from the ASA/FTD headend. Supports AnyConnect 4.x with ASA 9.x or FTD 6.x/7.x.

Prerequisites

  • A KYRA MDR Collector installed and running
  • Cisco ASA or FTD configured as AnyConnect headend
  • Syslog configured on the ASA/FTD
  • AnyConnect VPN configured and operational

Configuration

AnyConnect events are forwarded through ASA/FTD syslog:

  1. Ensure syslog is configured on the ASA (see Cisco ASA integration)
  2. Enable VPN-specific syslog messages:
logging class vpn trap informational
logging class vpnfo trap informational
logging class ssl trap informational
logging class auth trap informational
  1. Enable session logging:
logging message 722051 level informational
logging message 722022 level informational
logging message 722023 level informational
logging message 113019 level informational
  1. Write the configuration: write memory

Collected Log Types

Log TypeDescriptionSecurity Use
Session StartVPN session establishment (722051)Access monitoring
Session EndVPN session termination (722023)Session tracking
AuthenticationUser authentication events (113019)Credential monitoring
Group PolicyGroup policy assignment (722028)Access control verification
PostureEndpoint posture assessment resultsCompliance enforcement
DAPDynamic Access Policy evaluationAdaptive access control

Troubleshooting

No VPN syslog: Ensure vpn and auth logging classes are enabled.

Missing session details: Enable specific message IDs (722051, 722022, 722023).

Certificate auth: Enable SSL logging class for certificate validation events.

Contact kyra@seekerslab.com for support.