From 19c74a61da00a5e4ff3d7478570baa2d02f0b841 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 29 Apr 2025 13:08:50 +0200 Subject: [PATCH] more filter updates --- .../network/cisco_secure_firewall___lumma_stealer_activity.yml | 2 +- ...ure_firewall___lumma_stealer_outbound_connection_attempt.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/network/cisco_secure_firewall___lumma_stealer_activity.yml b/detections/network/cisco_secure_firewall___lumma_stealer_activity.yml index 54a833017c..88f0c22ef2 100644 --- a/detections/network/cisco_secure_firewall___lumma_stealer_activity.yml +++ b/detections/network/cisco_secure_firewall___lumma_stealer_activity.yml @@ -60,7 +60,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Lumma Stealer Activity on host $scr_ip$. + message: Lumma Stealer Activity on host $src_ip$. risk_objects: - field: src_ip type: system diff --git a/detections/network/cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml b/detections/network/cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml index 79fa8faac4..a110056d61 100644 --- a/detections/network/cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml +++ b/detections/network/cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml @@ -17,7 +17,7 @@ search: | by src_ip dest_ip dest_port transport signature_id signature class_desc MitreAttackGroups rule InlineResult InlineResultReason app | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `cisco_secure_firewall___lumma_stealer_outbound_connection_attempt` + | `cisco_secure_firewall___lumma_stealer_outbound_connection_attempt_filter` how_to_implement: | This search requires Cisco Secure Firewall Threat Defense Logs, which includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.