Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "Cisco ISE detected"; program: CISE_Passed_Authentications
| CISE_Failed_Attempts
| CSCOacs_Failed_Attempts; metadata: fingerprint_source logs, fingerprint_os ios, fingerprint_type server, fingerprint_expire 86400; threshold: type limit, track by_src, seconds 3600, count 1; classtype: fingerprint; sid:5100119; rev:1;)Field Validations
Loading…
Comments (0)
Loading comments...