Merge pull request #1010 from splunk/cisco_ios

patel-bhavin · web-flow · commit d6b17d0358e0 · 2025-08-21T10:16:00.000-07:00
adding snort test events for static tundra
diff --git a/datasets/cisco_secure_firewall_threat_defense/static_tundra/static_tundra.log b/datasets/cisco_secure_firewall_threat_defense/static_tundra/static_tundra.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:37e5b7a2f14d0784ac0005bb6a71f446952e5552599d98bc2d47fcc9830bd45c
+size 4766
diff --git a/datasets/cisco_secure_firewall_threat_defense/static_tundra/static_tundra.yml b/datasets/cisco_secure_firewall_threat_defense/static_tundra/static_tundra.yml
@@ -0,0 +1,12 @@
+author: Bhavin Patel, Michael Haag, Splunk
+id: 8d843885-584d-43ef-926c-03d04ec22639
+date: '2025-08-21'
+description:  Synthetically generated datasets for testing Cisco Secure Firewall - Static Tundra Smart Install Abuse
+environment: manual simulations in a controlled lab environment
+mitre_technique: 
+- T1190
+datasets:
+- name: static_tundra_snort_events
+  path: /datasets/cisco_secure_firewall_threat_defense/static_tundra/static_tundra.log
+  sourcetype: cisco:sfw:estreamer
+  source: cisco:sfw:estreamer

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:37e5b7a2f14d0784ac0005bb6a71f446952e5552599d98bc2d47fcc9830bd45c`
	`3`	`+size 4766`