GitHub Repo

Detection: Cisco IOS XE WebUI Programmatic Configuration

Updated Date: 2026-05-19 ID: f9686576-a23d-4c4d-bfad-a45499dc448a Author: Nasreddine Bencherchali Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process.

 1`cisco_ios`
 2facility="SYS"
 3mnemonic="CONFIG_P"
 4message_text="*Configured programmatically by process SEP_webui_wsma_http*"
 5
 6| rex field=_raw "process\s(?<process>\S+)\sfrom.*as\s(?<user>\S+)\son\s(?<vty>\S+)"
 7
 8| eval dest=coalesce(host, dvc, dest, "unknown")
 9
10| stats count min(_time) as firstTime
11              max(_time) as lastTime
12              values(process) as process
13              values(vty) as vty
14  by dest user
15
16| `security_content_ctime(firstTime)`
17
18| `security_content_ctime(lastTime)`
19
20| `cisco_ios_xe_webui_programmatic_configuration_filter`

Data Source

Name Platform Sourcetype Source
Cisco IOS Logs Other 'cisco:ios' 'cisco:ios'

Macros Used

Name Value
cisco_ios sourcetype=cisco:ios
cisco_ios_xe_webui_programmatic_configuration_filter search *
cisco_ios_xe_webui_programmatic_configuration_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1078 Valid Accounts Initial Access
T1190 Exploit Public-Facing Application Persistence
Installation
Exploitation
Delivery
DE.AE
CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Finding (Notable) No
Creates Intermediate Finding (Risk Event) Yes
Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios". Enable WebUI activity logging by IOS-XE.

Known False Positives

No false positives have been identified at this time.

Associated Analytic Story

Intermediate Findings

Message Entity Field Entity Type Risk Score
User $user$ performed Cisco IOS-XE WebUI programmatic configuration on $dest$. user user 20

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset ctb:catalyst:syslog cisco:ios
Integration ✅ Passing Dataset ctb:catalyst:syslog cisco:ios

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1