Cisco SA - Automated Web Reconnaissance via HTTP Access Errors

name: Cisco SA - Automated Web Reconnaissance via HTTP Access Errors
id: 4cd44520-d404-4ca8-b736-c9d6b86ecf31
version: 2
creation_date: '2026-05-08'
modification_date: '2026-06-09'
author: Mahamudul Chowdhury, Bhavin Patel, Splunk
status: production
type: Anomaly
description: |
    This analytic detects probable automated web reconnaissance using Cisco Secure Access proxy telemetry.
    A high volume of HTTP client errors (401/403/404/etc) across many unique URLs in a short window is consistent with directory/file enumeration behavior generated by tools such as Gobuster, DirBuster, ffuf, or Burp Intruder.
    Detecting this pattern helps identify pre-exploitation scanning activity, insider reconnaissance, compromised endpoints performing discovery, and attempts to find hidden administrative paths, APIs, backups, and exposed application files.
data_source:
    - Cisco Secure Access Proxy
search: |-
    `cisco_secure_access_proxy`
    | eval src_ip=coalesce(src_ip, src)
    | eval host=coalesce(hostname, host)
    | eval user=coalesce(user, identities)
    | eval status=tonumber(status)
    | eval domain=replace(url, "^https?://([^/]+).*$", "\\1")
    | eval user_agent=coalesce(http_user_agent, user_agent)
    | where status IN (400, 401, 403, 404, 405, 407, 414, 429, 431)
    | bucket _time span=10m
    | stats count as errors dc(url) as unique_urls values(status) as statuses values(user_agent) as user_agent values(host) as host values(user) as user by src_ip domain _time
    | where errors > 100 AND unique_urls > 50
    | eval firstTime=_time, lastTime=_time
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_sa___automated_web_reconnaissance_via_http_access_errors_filter`
how_to_implement: |
    Ingest Cisco Secure Access proxy logs into Splunk using the Splunk Add-on for Cisco Security Cloud.
    Update the `cisco_secure_access_proxy` macro so it resolves to the index, source, and sourcetype values used in your deployment.
known_false_positives: |
    Aggressive web vulnerability scanners, QA automation, uptime monitoring, and authorized security assessments can generate high HTTP error volumes with large URL diversity.
    Tune by allow-listing known scanner hosts, user agents, test domains, and approved assessment windows using the filter macro.
references:
    - https://attack.mitre.org/techniques/T1595/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Source $src_ip$ triggered probable automated web reconnaissance on $domain$ with $errors$ HTTP access errors across $unique_urls$ unique URLs.
threat_objects:
    - field: domain
      type: domain
    - field: src_ip
      type: ip_address
analytic_story:
    - Cisco Secure Access Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1595
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: threat