This article leads you through the process of integrating Cisco Firepower with Red Canary. Follow the procedure from beginning to end. 

Step 1: Red Canary–Create your Red Canary generated email

Create a Red Canary provided-email to send Cisco Firepower alerts for ingestion. 

1. From your Red Canary homepage, click Integrations.
2. From the Integrations section, locate and then click the Cisco Firepower security product you want to integrate with Red Canary. 
   Note: If you do not see your security product listed, click See all integrations.
3. In the search bar, type and then select the Cisco Firepower security source.
   
4. Continue onto the next step by configuring your Cisco Firepower security source in Red Canary.
   Note: Your third-party security source may require that you contact Red Canary to configure.
5. Enter a Name for your external alert source.  
6. Select a Display Category.
7. Under the Ingest Format/Method dropdown, select Cisco Firepower via Email.
   1. NOTE: We only do Alert Investigation on Cisco Firepower alerts if they are received via email.
8. Click Save Configuration. This will generate the email address to which Cisco Firepower alerts will be sent.
   
   
9. Click Edit Configuration.
10. Click Activate.

NOTE: Any devices inline between the Firepower device and Red Canary that may manipulate email messages (i.e., Perimeter Devices) should have an exclusion in place to bypass these processes; otherwise, the email message may be manipulated prior to being ingested by Red Canary and subsequently reformatted to HTML.

For more information on completing the set up for Cisco Firepower, please click here.