Sagan low stable other

[CISCO-SECUREENDPOINT] Cloud Recall Quarantine Attempt Failed

[CISCO-SECUREENDPOINT] Cloud Recall Quarantine Attempt Failed

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[CISCO-SECUREENDPOINT] Cloud Recall Quarantine Attempt Failed"; program: CISCO-AMP; content: "
| 22
| event_type_id
| 22 3A
| 2164260893"; parse_src_ip: 2; parse_dst_ip: 1; threshold: type suppress, track by_src, count 5, seconds 3600; classtype: system-error; sid:5003893; rev:3; metadata: updated_on 2026_04_23;)

Field Validations

Loading…

Comments (0)

Loading comments...