From f37ca5fc687ee1468c05281b83ae0eef4b615abc Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 22 Apr 2025 12:05:49 -0700 Subject: [PATCH] update message formatting --- ...ecure_firewall___blacklisted_ssl_certificate_fingerprint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml index 7f4c1d55aa..7cd8050eb2 100644 --- a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml +++ b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml @@ -51,7 +51,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious SSL certificate fingerprint ($SSL_CertFingerprint$) used in connections [ ListingReason: $Reasons$ ] + message: Suspicious SSL certificate fingerprint - [$SSL_CertFingerprint$] used in connections [ListingReason - $Reasons$] from $src_ip$ risk_objects: - field: src_ip type: system