updates to rba and such

detections/network/cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml

@@ -49,12 +49,14 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: A high number of Snort intrusion detections were triggered by $src_ip$ in a 30-minute time window.
+  message: A high number [$TotalEvents$] of Snort intrusion detections for [$signature$] were triggered by [$src_ip$] in a 30-minute time window.
   risk_objects:
     - field: src_ip
       type: system
       score: 40
-  threat_objects: []
+  threat_objects:
+    - field: signature
+      type: signature
 tags:
   analytic_story: 
     - Cisco Secure Firewall Threat Defense Analytics

detections/network/cisco_secure_firewall___possibly_compromised_host.yml

@@ -51,7 +51,9 @@ rba:
     - field: src_ip
       type: system
       score: 35
-  threat_objects: []
+  threat_objects:
+    - field: signature
+      type: signature
 tags:
   analytic_story: 
     - Cisco Secure Firewall Threat Defense Analytics

detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml

@@ -36,19 +36,6 @@ how_to_implement: |
 known_false_positives: False positives may occur with certain rare activity. Apply additional filters where required.
 references:
   - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
-drilldown_searches:
-- name: View the detection results for - "$src_ip$"
-  search: '%original_detection_search% | search  src_ip = "$src_ip$"'
-  earliest_offset: $info_min_time$
-  latest_offset: $info_max_time$
-- name: View risk events for the last 7 days for - "$src_ip$"
-  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") starthoursago=168  | stats count min(_time)
-    as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
-    as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
-    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
-    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
-  earliest_offset: $info_min_time$
-  latest_offset: $info_max_time$
 tags:
   analytic_story: 
     - Cisco Secure Firewall Threat Defense Analytics

detections/network/cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml

@@ -12,7 +12,7 @@ data_source:
 search: |
   `cisco_secure_firewall` EventType=IntrusionEvent
   | bin _time span=1h
-  | stats dc(src_ip) as AffectedHosts, values(src_ip) as hosts 
+  | stats dc(src_ip) as unique_src_ips, values(src_ip) as src_ip 
           min(_time) as firstTime max(_time) as lastTime
           Values(dest) as dest
           Values(dest_port) as dest_port
@@ -20,7 +20,7 @@ search: |
           Values(transport) as transport
           Values(app) as app
           by signature_id, signature class_desc MitreAttackGroups InlineResult InlineResultReason 
-  | where AffectedHosts >= 10
+  | where unique_src_ips >= 10
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
   | `cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts_filter`
@@ -37,12 +37,12 @@ known_false_positives: False positives should be minimal. Simultaneous vulnerabi
 references:
   - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
 drilldown_searches:
-- name: View the detection results for - "$src_ip$"
-  search: '%original_detection_search% | search  src_ip = "$src_ip$"'
+- name: View the detection results for - "$src_ip$" and "$signature_id$"
+  search: '%original_detection_search% | search  src_ip = "$src_ip$" and signature_id = "$signature_id$"'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
-- name: View risk events for the last 7 days for - "$src_ip$"
-  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") starthoursago=168  | stats count min(_time)
+- name: View risk events for the last 7 days for - "$src_ip$" and "$signature_id$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$", "$signature_id$") starthoursago=168  | stats count min(_time)
     as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message)
     as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
     as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
@@ -50,12 +50,14 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: The Snort rule $signature_id$ was triggered by $AffectedHosts$ unique internal hosts within a one-hour window, indicating potential widespread exploitation or coordinated targeting activity.
+  message: The Snort rule $signature$ was triggered by $unique_src_ips$ unique internal hosts within a one-hour window, indicating potential widespread exploitation or coordinated targeting activity.
   risk_objects:
     - field: src_ip
       type: system
       score: 25
-  threat_objects: []
+  threat_objects:
+    - field: signature
+      type: signature
 tags:
   analytic_story: 
     - Cisco Secure Firewall Threat Defense Analytics