From 4a1547b9c93203d578b3bea652820c8c1c18e409 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 22 Apr 2025 11:51:26 -0700 Subject: [PATCH 1/2] updating message --- ...ure_firewall___blacklisted_ssl_certificate_fingerprint.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml index 06d0a93a32..7f4c1d55aa 100644 --- a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml +++ b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml @@ -51,9 +51,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: > - Suspicious SSL certificate fingerprint ($SSL_CertFingerprint$) used in connections - [ListingReason: $Reasons$] + message: Suspicious SSL certificate fingerprint ($SSL_CertFingerprint$) used in connections [ ListingReason: $Reasons$ ] risk_objects: - field: src_ip type: system From f37ca5fc687ee1468c05281b83ae0eef4b615abc Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 22 Apr 2025 12:05:49 -0700 Subject: [PATCH 2/2] update message formatting --- ...ecure_firewall___blacklisted_ssl_certificate_fingerprint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml index 7f4c1d55aa..7cd8050eb2 100644 --- a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml +++ b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml @@ -51,7 +51,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious SSL certificate fingerprint ($SSL_CertFingerprint$) used in connections [ ListingReason: $Reasons$ ] + message: Suspicious SSL certificate fingerprint - [$SSL_CertFingerprint$] used in connections [ListingReason - $Reasons$] from $src_ip$ risk_objects: - field: src_ip type: system