Cisco ASA - threat detection message fired

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'Identifies when the Cisco ASA Threat Detection engine fired an alert based on malicious activity occurring on the network inicated by DeviceEventClassID 733101-733105 Resources: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html Details on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html'

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1046` Network Service Discovery
Impact	`T1498` Network Denial of Service

Rule body

id: 795edf2d-cf3e-45b5-8452-fe6c9e6a582e
name: Cisco ASA - threat detection message fired
description: |
  'Identifies when the Cisco ASA Threat Detection engine fired an alert based on malicious activity occurring on the network inicated by DeviceEventClassID 733101-733105
  Resources: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html
  Details on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CiscoAsaAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Discovery
  - Impact
relevantTechniques:
  - T1046
  - T1498
query: |
  CommonSecurityLog
  | where isempty(CommunicationDirection)
  | where DeviceEventClassID in ("733101","733102","733103","733104","733105")
  | extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP
version: 1.0.3
kind: Scheduled

Stages and Predicates

Stage 1: `source`

CommonSecurityLog

Stage 2: `where`

| where isempty(CommunicationDirection)

Stage 3: `where`

| where DeviceEventClassID in ("733101","733102","733103","733104","733105")

Stage 4: `extend`

| extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.'))

Stage 5: `extend`

| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)

HostNameDomain =

ifDomainIndex != -1substring(DeviceName, (DomainIndex + 1))

elseDeviceName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommunicationDirection`	is_null	(no value, null check)	`field:"CommunicationDirection" kind:is_null`
`DeviceEventClassID`	in	`733101` `733102` `733103` `733104` `733105`	`field:"DeviceEventClassID" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DomainIndex`	`extend`
`HostName`	`extend`
`HostNameDomain`	`extend`

Cisco ASA - threat detection message fired

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend