feat: SnortML GID411 and signature+EVE dual-signal CSF detections

detections/network/cisco_secure_firewall___signature_plus_eve_corroboration.yml

@@ -0,0 +1,98 @@
+name: Cisco Secure Firewall - Signature Plus EVE Corroboration
+id: 4b390334-5647-467b-a0f5-f31cd8a283a1
+version: 1
+creation_date: '2026-08-16'
+modification_date: '2026-08-16'
+author: Ahmed Hassan, Github Community
+status: experimental
+type: TTP
+description: |
+    This analytic identifies dual-signal corroboration on Cisco Secure Firewall Threat Defense:
+    a classic Snort intrusion event (GeneratorID != 411) on a connection that also carries a high
+    Encrypted Visibility Engine (EVE) threat confidence (>= 80).
+    Corroborated signature + ML signals are stronger FIX_NOW / high-priority candidates than ML-only
+    (SnortML GID 411 or EVE-only) paths, which should escalate rather than auto-contain.
+data_source:
+    - Cisco Secure Firewall Threat Defense Intrusion Event
+    - Cisco Secure Firewall Threat Defense Connection Event
+search: |
+    `cisco_secure_firewall` EventType=IntrusionEvent GeneratorID!=411
+    | eval dual_src=coalesce(src, InitiatorIP), dual_dest=coalesce(dest, ResponderIP), dual_cid=coalesce(connection_id, ConnectionID)
+    | join type=inner dual_cid
+        [
+            search `cisco_secure_firewall` EventType=ConnectionEvent EVE_ThreatConfidencePct >= 80
+            | eval dual_cid=coalesce(connection_id, ConnectionID),
+                   eve_pct=EVE_ThreatConfidencePct,
+                   eve_process=EVE_Process
+            | fields dual_cid, eve_pct, eve_process
+        ]
+    | fillnull
+    | stats count min(_time) as firstTime max(_time) as lastTime
+            values(signature_id) as signature_id
+            values(signature) as signature
+            values(class_desc) as class_desc
+            values(GeneratorID) as GeneratorID
+            values(eve_pct) as EVE_ThreatConfidencePct
+            values(eve_process) as EVE_Process
+            values(InlineResult) as InlineResult
+            values(dest_port) as dest_port
+            values(app) as app
+            by dual_src, dual_dest, dual_cid
+    | rename dual_src as src, dual_dest as dest, dual_cid as connection_id
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `cisco_secure_firewall___signature_plus_eve_corroboration_filter`
+how_to_implement: |
+    Requires Cisco Secure Firewall Threat Defense logs for both IntrusionEvent and ConnectionEvent,
+    with EVE enabled and classic Snort signatures (non-411 GeneratorID) logging.
+    Uses the `cisco_secure_firewall` input macro and a post-filter macro for FP tuning.
+    Ingest via Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
+    Prefer this corroboration path for higher finding scores; keep SnortML-only and EVE-only
+    detections as intermediate findings.
+known_false_positives: |
+    Busy hosts may coincidentally share ConnectionID reuse windows or produce noisy classic
+    signatures alongside elevated EVE scores. Validate signature classification and EVE process
+    context before containment. Tune with the filter macro for scanners and lab traffic.
+references:
+    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
+    - https://github.com/Cisco-Talos/EvidenceForge/pull/389
+drilldown_searches:
+    - name: View the detection results for - "$src$" and "$dest$"
+      search: '%original_detection_search% | search  src = "$src$" dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$src$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: Classic Snort intrusion on $src$ to $dest$ corroborated by high EVE threat confidence ($EVE_ThreatConfidencePct$%)
+    entity:
+        field: dest
+        type: system
+        score: 50
+threat_objects:
+    - field: signature
+      type: signature
+    - field: src
+      type: ip_address
+analytic_story:
+    - Cisco Secure Firewall Threat Defense Analytics
+asset_type: Network
+mitre_attack_id:
+    - T1071
+    - T1041
+    - T1203
+product:
+    - Splunk Enterprise
+    - Splunk Cloud
+    - Splunk Enterprise Security
+category: network
+security_domain: network
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://raw.githubusercontent.com/AAH20/attack_data/feat/dual-signal-snortml-samples/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log
+          source: not_applicable
+          sourcetype: cisco:sfw:estreamer
+      test_type: unit

detections/network/cisco_secure_firewall___snortml_high_confidence_ml_only.yml

@@ -0,0 +1,99 @@
+name: Cisco Secure Firewall - SnortML High Confidence ML-Only
+id: 39f9e5a2-9766-473b-b0a5-e28cfbe88b03
+version: 1
+creation_date: '2026-08-16'
+modification_date: '2026-08-16'
+author: Ahmed Hassan, Github Community
+status: experimental
+type: Anomaly
+description: |
+    This analytic detects Cisco Secure Firewall Threat Defense Intrusion Events generated by
+    SnortML (GeneratorID / GID 411) at elevated impact.
+    SnortML scores are machine-learning probability signals and must not be treated as equivalent
+    to a classic Snort signature true positive (GID typically 1). High ML-only confidence should
+    escalate for corroboration (signature hit, EVE, endpoint, or threat intel) — not auto-contain.
+    Pair with "Cisco Secure Firewall - High Priority Intrusion Classification" (signature path)
+    and "Cisco Secure Firewall - High EVE Threat Confidence" (encrypted ML path) for dual-signal triage.
+data_source:
+    - Cisco Secure Firewall Threat Defense Intrusion Event
+search: |
+    `cisco_secure_firewall` EventType=IntrusionEvent GeneratorID=411 Impact>=2
+    | fillnull
+    | stats count min(_time) as firstTime max(_time) as lastTime
+            values(signature_id) as signature_id
+            values(signature) as signature
+            values(class_desc) as class_desc
+            values(MitreAttackGroups) as MitreAttackGroups
+            values(InlineResult) as InlineResult
+            values(InlineResultReason) as InlineResultReason
+            values(dest_port) as dest_port
+            values(rule) as rule
+            values(transport) as transport
+            values(app) as app
+            values(Impact) as Impact
+            by src, dest, GeneratorID
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `cisco_secure_firewall___snortml_high_confidence_ml_only_filter`
+how_to_implement: |
+    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    includes the IntrusionEvent EventType with SnortML (GID 411) enabled in the intrusion policy.
+    This search uses an input macro named `cisco_secure_firewall`.
+    We strongly recommend that you specify your environment-specific configurations
+    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+    with configurations for your Splunk environment. The search also uses a post-filter
+    macro designed to filter out known false positives.
+    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
+    The intrusion access policy must also be configured with SnortML inspectors enabled.
+    Do not map this detection's risk/finding score equal to classic signature TTPs — keep it as an
+    intermediate finding that drives corroboration workflows.
+known_false_positives: |
+    SnortML can score benign traffic highly when models encounter uncommon protocols, custom
+    applications, or encrypted payloads that resemble training malware. Treat GeneratorID=411
+    events as escalate/corroborate, not auto-contain. Validate against classic Snort signatures
+    (GeneratorID!=411), EVE threat confidence, endpoint telemetry, and destination reputation
+    before containment.
+references:
+    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
+    - https://www.cisco.com/c/en/us/products/security/secure-firewall/index.html
+    - https://github.com/Cisco-Talos/EvidenceForge/pull/389
+drilldown_searches:
+    - name: View the detection results for - "$src$" and "$dest$"
+      search: '%original_detection_search% | search  src = "$src$" dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$src$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: src
+          type: system
+          score: 20
+          message: SnortML (GID 411) high-impact alert from $src$ to $dest$ — escalate/corroborate; do not equate to signature TP.
+threat_objects:
+    - field: signature
+      type: signature
+    - field: dest
+      type: ip_address
+analytic_story:
+    - Cisco Secure Firewall Threat Defense Analytics
+asset_type: Network
+mitre_attack_id:
+    - T1071
+    - T1041
+    - T1203
+product:
+    - Splunk Enterprise
+    - Splunk Cloud
+    - Splunk Enterprise Security
+category: network
+security_domain: network
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://raw.githubusercontent.com/AAH20/attack_data/feat/dual-signal-snortml-samples/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log
+          source: not_applicable
+          sourcetype: cisco:sfw:estreamer
+      test_type: unit