Splunk unknown stable spl
Cisco Secure Firewall - Blocked Connection
The following analytic detects a blocked connection event by identifying a "Block" value in the action field. It leverages logs from Cisco Secure Firewall Threat Defense devices. This activity is significant as it can identify attempts from users or applications initiating network connection to explicitly or implicitly blocked range or zones. If confirmed malicious, attackers could be attempting to perform a forbidden action on the network such as data exfiltration, lateral movement, or network disruption.
Detection Logic
`cisco_secure_firewall` EventType=ConnectionEvent action IN ("Block with reset", "Block", "blocked")
| stats count min(_time) as firstTime max(_time) as lastTime by src, dest, dest_port, transport, rule, url, EVE_Process, action
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cisco_secure_firewall___blocked_connection_filter`False Positives
- ⚠ Blocked connection events are generated via an Access Control policy on the Firewall management console. Hence no false positives should be present.
Field Validations
Loading…
Comments (0)
Loading comments...