From e78f39612bbff1d313bb900fc2cd99e399238cdf Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 17 Apr 2025 13:59:44 -0700 Subject: [PATCH] updates to rba and such --- ...igh_volume_of_intrusion_events_per_host.yml | 6 ++++-- ...re_firewall___possibly_compromised_host.yml | 4 +++- ...re_firewall___rare_snort_rule_triggered.yml | 13 ------------- ...rt_rule_triggered_across_multiple_hosts.yml | 18 ++++++++++-------- 4 files changed, 17 insertions(+), 24 deletions(-) diff --git a/detections/network/cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml b/detections/network/cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml index 7ebc762ac7..6c885c54b1 100644 --- a/detections/network/cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml +++ b/detections/network/cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml @@ -49,12 +49,14 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A high number of Snort intrusion detections were triggered by $src_ip$ in a 30-minute time window. + message: A high number [$TotalEvents$] of Snort intrusion detections for [$signature$] were triggered by [$src_ip$] in a 30-minute time window. risk_objects: - field: src_ip type: system score: 40 - threat_objects: [] + threat_objects: + - field: signature + type: signature tags: analytic_story: - Cisco Secure Firewall Threat Defense Analytics diff --git a/detections/network/cisco_secure_firewall___possibly_compromised_host.yml b/detections/network/cisco_secure_firewall___possibly_compromised_host.yml index 48191c7638..ab8b0cc1a3 100644 --- a/detections/network/cisco_secure_firewall___possibly_compromised_host.yml +++ b/detections/network/cisco_secure_firewall___possibly_compromised_host.yml @@ -51,7 +51,9 @@ rba: - field: src_ip type: system score: 35 - threat_objects: [] + threat_objects: + - field: signature + type: signature tags: analytic_story: - Cisco Secure Firewall Threat Defense Analytics diff --git a/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml b/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml index 46f35d1c82..493e713d1a 100644 --- a/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml +++ b/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml @@ -36,19 +36,6 @@ how_to_implement: | known_false_positives: False positives may occur with certain rare activity. Apply additional filters where required. references: - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf -drilldown_searches: -- name: View the detection results for - "$src_ip$" - search: '%original_detection_search% | search src_ip = "$src_ip$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$src_ip$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") starthoursago=168 | stats count min(_time) - as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) - as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ tags: analytic_story: - Cisco Secure Firewall Threat Defense Analytics diff --git a/detections/network/cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml b/detections/network/cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml index cff36a9274..6dfd68a496 100644 --- a/detections/network/cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml +++ b/detections/network/cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml @@ -12,7 +12,7 @@ data_source: search: | `cisco_secure_firewall` EventType=IntrusionEvent | bin _time span=1h - | stats dc(src_ip) as AffectedHosts, values(src_ip) as hosts + | stats dc(src_ip) as unique_src_ips, values(src_ip) as src_ip min(_time) as firstTime max(_time) as lastTime Values(dest) as dest Values(dest_port) as dest_port @@ -20,7 +20,7 @@ search: | Values(transport) as transport Values(app) as app by signature_id, signature class_desc MitreAttackGroups InlineResult InlineResultReason - | where AffectedHosts >= 10 + | where unique_src_ips >= 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts_filter` @@ -37,12 +37,12 @@ known_false_positives: False positives should be minimal. Simultaneous vulnerabi references: - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf drilldown_searches: -- name: View the detection results for - "$src_ip$" - search: '%original_detection_search% | search src_ip = "$src_ip$"' +- name: View the detection results for - "$src_ip$" and "$signature_id$" + search: '%original_detection_search% | search src_ip = "$src_ip$" and signature_id = "$signature_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$src_ip$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") starthoursago=168 | stats count min(_time) +- name: View risk events for the last 7 days for - "$src_ip$" and "$signature_id$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$", "$signature_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -50,12 +50,14 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: The Snort rule $signature_id$ was triggered by $AffectedHosts$ unique internal hosts within a one-hour window, indicating potential widespread exploitation or coordinated targeting activity. + message: The Snort rule $signature$ was triggered by $unique_src_ips$ unique internal hosts within a one-hour window, indicating potential widespread exploitation or coordinated targeting activity. risk_objects: - field: src_ip type: system score: 25 - threat_objects: [] + threat_objects: + - field: signature + type: signature tags: analytic_story: - Cisco Secure Firewall Threat Defense Analytics