Detection: Cisco Secure Firewall - Rare Snort Rule Triggered

Description

This analytic identifies Snort signatures that have triggered only once in the past 7 days across all Cisco Secure Firewall IntrusionEvent logs. While these rules typically do not trigger in day-to-day network activity, their sudden appearance may indicate early-stage compromise, previously unseen malware, or reconnaissance activity against less commonly exposed services. Investigating these outliers can provide valuable insight into new or low-noise adversary behaviors.

Search

 1`cisco_secure_firewall` EventType=IntrusionEvent earliest=-7d
 2
 3| stats dc(_time) as TriggerCount min(_time) as firstTime max(_time) as lastTime 
 4        values(signature) as signature 
 5        values(src_ip) as src_ip 
 6        values(dest) as dest 
 7        values(dest_port) as dest_port
 8        values(transport) as transport
 9        values(app) as app 
10        values(rule) as rule 
11        by signature_id class_desc MitreAttackGroups InlineResult InlineResultReason
12
13| where TriggerCount = 1
14
15| `security_content_ctime(firstTime)`
16
17| `security_content_ctime(lastTime)`
18
19| `cisco_secure_firewall___rare_snort_rule_triggered_filter`

Data Source

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This search requires Cisco Secure Firewall Threat Defense Logs, which includes the IntrusionEvent EventType. This search uses an input macro named cisco_secure_firewall. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The intrusion access policy must also be configured.

Known False Positives

False positives may occur with certain rare activity. Apply additional filters where required.

Associated Analytic Story

• Cisco Secure Firewall Threat Defense Analytics

References

• https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 2