NSEL (NetFlow Secure Event Logging) is the way a Cisco ASA firewall (and ASASM / Secure Firewall ASA) sends information about network traffic to a monitoring system. It is built on NetFlow Version 9. Plain NetFlow reports flow statistics every so often. NSEL works differently — it is event-driven: it sends a record only when something meaningful happens to a connection, namely when that connection is set up, torn down, or denied.
How does NSEL work?
NSEL tracks IP flows statefully — the firewall keeps the open connections in its table. A NetFlow v9 record is created the moment a connection changes state, not at fixed time intervals. The data goes to a collector (the server that gathers it) over UDP; configurations commonly use port 2055. Each ASA connects to the collector on its own, and the collector tells the exporters apart by the source IP address and source port of the packet. Before the ASA sends the actual data, it first sends NetFlow v9 templates that describe which fields the records will contain.
NSEL records these events:
flow-create— a new flow appears (connection set up).flow-teardown— a flow ends (connection closed).flow-denied— a flow is denied by firewall policy (apart from traffic denied by EtherType ACLs).flow-update— an event sent every so often during a long-lived flow; it carries byte counters. Because it appears periodically, it resembles plain NetFlow.
Which events and which traffic are sent, and to which collector, is set through the Modular Policy Framework (MPF).
How does NSEL differ from plain NetFlow?
Plain NetFlow on routers and switches sends summarized flow aggregates — after a timer expires (active/inactive) or when the cache fills up. Its main point is to measure how much traffic went through. NSEL shows something else: specific connection events typical of a firewall — when a connection was created, when it was torn down, and when it was denied. Because the ASA performs NAT, NSEL records can carry both the original and the translated addresses and ports. That lets you tie a session seen inside the network to how it looks on the outside.
NSEL and syslog
Many NSEL events say roughly the same thing as the firewall’s syslog messages (for example a connection being set up and closed, or traffic being denied). To avoid reporting the same thing over two channels at once, the ASA lets you turn off the syslog messages that duplicate NSEL. NSEL does not replace syslog entirely, though — messages unrelated to flows, such as administrative or system events, still come only from syslog.
Why does NSEL matter for security?
For SOC teams and NDR/SIEM systems, NSEL is a source of insight into what crosses the firewall. flow-denied events show traffic blocked by policy — this can be reconnaissance, scanning attempts, or segmentation being broken. flow-create and flow-teardown pairs let you reconstruct who connected to whom, for how long, and how much data they sent, and the preserved NAT mapping helps tie this together during an investigation. Because records are created only on events, NSEL puts less load on the system than capturing every packet, while giving more detail than syslog alone — whose entries are often too sparse to tell whether something is a threat.
Learn more
- Cloud Access Security Broker (CASB) — NSEL logs cloud access events that can help CASB detect risky or unauthorized usage.
- Network Forensics — NSEL provides historical NetFlow logs useful for reconstructing network activity in forensics.
- NSM (Network Security Monitoring) — NSEL adds secure flow logging that supports NSM detection, alerting, and investigation.
- Data Loss Prevention (DLP) — NSEL can reveal data transfer patterns that help DLP spot possible exfiltration.
- Cloud Security Posture Management (CSPM) — NSEL helps CSPM by logging network events from cloud environments for visibility and review.
- Intrusion Detecting System — NSEL supplies flow logs that can support intrusion detection and incident triage.
- Microsegmentation — NSEL shows traffic flows between segments, helping verify and tune microsegmentation rules.
- Network Packet Broker (NPB) — NSEL complements NPB by logging flows derived from mirrored or forwarded traffic.
