Sagan medium stable other

[CISCO-SECUREENDPOINT] Endpoint Isolation Start Success

[CISCO-SECUREENDPOINT] Endpoint Isolation Start Success

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[CISCO-SECUREENDPOINT] Endpoint Isolation Start Success"; program:CISCO-AMP; content:"
| 22
| event_type_id
| 22 3A
| 553648202"; parse_src_ip: 2; parse_dst_ip: 1; reference:url,https://www.cisco.com/c/en/us/td/docs/security/firepower/610/api/db-access/Database_Access/Schema-System.html; classtype:suspicious-traffic; sid:5014545; rev:2; metadata: updated_on 2024_06_13;)

Field Validations

Loading…

Comments (0)

Loading comments...