Cisco Cisco Web Security Appliance S160 User Guide

Accessing online Help from the Add Log Subscription page brings up detailed information about 
all settings.

Log into the Advanced Web Security Reporting application as 

admin

.

In the Advanced Web Security Reporting application: 

Choose Settings > Data inputs > Cisco CWS Logs. 

Click New.

Provide a meaningful name for this data input.

Provide the client_id, s3_key and s3_secret that have been provided from CWS. The client_id is the 
bucket ID used in CWS.

Click More settings check box and provide the time Interval in seconds at which CWS logs can be 
pulled; default is 3600.

Log Style

Access

Traffic Monitor

N/A

AMP Engine

N/A

Log Level

Access

N/A

Traffic Monitor

N/A

AMP Engine

Select Debug.

It is important to change Log Level to 
Debug for AMP reporting, or little to no 
information will be reported.

(Optional) Custom Fields

Access only

%XK (Adds a web reputation threat reason.)

Retrieval Method

Select FTP on Remote 
Server

Any one

Hostname: IP address or host name of the 
Enterprise host.

Directory: name of Advanced Web Security 
Reporting instance directory.

Username/Password: FTP user name and 
password for access to the application.

If connection between Advanced Web 
Security Reporting and WSA is lost, logs 
for that period are not available until 
connection is restored.