diff --git a/detections/network/cisco_secure_firewall___high_eve_threat_confidence.yml b/detections/network/cisco_secure_firewall___high_eve_threat_confidence.yml
index 67337ee63a..8f5223d653 100644
--- a/detections/network/cisco_secure_firewall___high_eve_threat_confidence.yml
+++ b/detections/network/cisco_secure_firewall___high_eve_threat_confidence.yml
@@ -33,6 +33,19 @@ known_false_positives: |
   It is recommended to validate the associated process (`EVE_Process`) and destination context, and correlate with other logs (e.g., endpoint or threat intel) before taking response action.
 references:
   - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
+drilldown_searches:
+- name: View the detection results for - "$src_ip$"
+  search: '%original_detection_search% | search  src_ip = "$src_ip$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$src_ip$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") starthoursago=168  | stats count min(_time)
+    as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
+    as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
 rba:
   message: High threat confidence ($EVE_ThreatConfidencePct$%) from $EVE_Process$ on $src_ip$"
   risk_objects: