Detection Logic
alert any $HOME_NET any -> $HOME_NET any (msg:"Cisco device detected"; pcre:"/\%[a-zA-Z]{3}-[0-9]-[0-9]{6}/"; reference:url,networklessons.com/cisco/ccie-routing-switching/cisco-ios-syslog-messages; reference:url,www.cisco.com/c/en/us/td/docs/security/firepower/Syslogs/b_fptd_syslog_guide.html; metadata: fingerprint_source logs, fingerprint_os Cisco-FW, fingerprint_expire 86400; threshold: type suppress, track by_src, seconds 43200, count 1; classtype:fingerprint; sid:5100136; rev:1;)Field Validations
Loading…
Comments (0)
Loading comments...