admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3484 from splunk/cisco_slashn

Browse Source 
Cisco slashn
This commit is contained in:
pyth0n1c
2025-04-22 12:12:32 -07:00
committed by GitHub
parent 45af4dedab 1411dac82f
commit 2bbcdd5032
1 changed files with 1 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml
+1 -3
View File
@@ -51,9 +51,7 @@ drilldown_searches:
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: >
Suspicious SSL certificate fingerprint ($SSL_CertFingerprint$) used in connections
[ListingReason: $Reasons$]
message: Suspicious SSL certificate fingerprint - [$SSL_CertFingerprint$] used in connections [ListingReason - $Reasons$] from $src_ip$
risk_objects:
- field: src_ip
type: system