admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

adding drilldown

Browse Source
This commit is contained in:
Bhavin Patel
2025-04-16 16:31:04 -07:00
parent b6f87ba697
commit 7fdcb4e7e0
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/network/cisco_secure_firewall___high_eve_threat_confidence.yml
+13
View File
@@ -33,6 +33,19 @@ known_false_positives: |
It is recommended to validate the associated process (`EVE_Process`) and destination context, and correlate with other logs (e.g., endpoint or threat intel) before taking response action.
references:
- https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
drilldown_searches:
- name: View the detection results for - "$src_ip$"
search: '%original_detection_search% | search src_ip = "$src_ip$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$src_ip$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") starthoursago=168 | stats count min(_time)
as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: High threat confidence ($EVE_ThreatConfidencePct$%) from $EVE_Process$ on $src_ip$"
risk_objects: