update analytics after review suggestions

Author: nasbench

detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml

@@ -75,6 +75,7 @@ tags:
   - Command And Control
   - Ransomware
   - Remote Monitoring and Management Software
+  - Cisco Secure Firewall Threat Defense Analytics
   asset_type: Network
   mitre_attack_id:
   - T1219

detections/network/detect_outbound_ldap_traffic.yml

@@ -37,6 +37,7 @@ references:
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
+  - Cisco Secure Firewall Threat Defense Analytics
   asset_type: Endpoint
   cve:
   - CVE-2021-44228

detections/network/detect_outbound_smb_traffic.yml

@@ -53,6 +53,7 @@ tags:
   - Hidden Cobra Malware
   - DHS Report TA18-074A
   - NOBELIUM Group
+  - Cisco Secure Firewall Threat Defense Analytics
   asset_type: Endpoint
   mitre_attack_id:
   - T1071.002

detections/network/internal_horizontal_port_scan.yml

@@ -50,13 +50,16 @@ rba:
   message: $src_ip$ has scanned for ports $dest_ports$ across $totalDestIPCount$ destination
     IPs
   risk_objects:
-  - field: src_ip
+  - field: dest_port
     type: system
     score: 64
-  threat_objects: []
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - Network Discovery
+  - Cisco Secure Firewall Threat Defense Analytics
   asset_type: Endpoint
   mitre_attack_id:
   - T1046

detections/network/internal_horizontal_port_scan_nmap_top_20.yml

@@ -52,13 +52,16 @@ rba:
   message: $src_ip$ has scanned for ports $dest_ports$ across $totalDestIPCount$ destination
     IPs
   risk_objects:
-  - field: src_ip
+  - field: dest_zone
     type: system
     score: 72
-  threat_objects: []
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - Network Discovery
+  - Cisco Secure Firewall Threat Defense Analytics
   asset_type: Endpoint
   mitre_attack_id:
   - T1046

detections/network/internal_vertical_port_scan.yml

@@ -50,13 +50,16 @@ drilldown_searches:
 rba:
   message: $src_ip$ has scanned $totalDestPortCount$ ports on $dest_ip$
   risk_objects:
-  - field: src_ip
+  - field: dest_ip
     type: system
-    score: 64
-  threat_objects: []
+    score: 60
+  threat_objects:
+  - field: src_ip
+    type: ip_address
 tags:
   analytic_story:
   - Network Discovery
+  - Cisco Secure Firewall Threat Defense Analytics
   asset_type: Endpoint
   mitre_attack_id:
   - T1046

detections/network/prohibited_network_traffic_allowed.yml

@@ -58,6 +58,7 @@ tags:
   - Prohibited Traffic Allowed or Protocol Mismatch
   - Ransomware
   - Command And Control
+  - Cisco Secure Firewall Threat Defense Analytics
   asset_type: Endpoint
   mitre_attack_id:
   - T1048

detections/network/protocol_or_port_mismatch.yml

@@ -56,6 +56,7 @@ tags:
   analytic_story:
   - Prohibited Traffic Allowed or Protocol Mismatch
   - Command And Control
+  - Cisco Secure Firewall Threat Defense Analytics
   asset_type: Endpoint
   mitre_attack_id:
   - T1048.003

detections/network/protocols_passing_authentication_in_cleartext.yml

@@ -45,7 +45,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: Potential Authentication in cleartext
+  message: Allowed Traffic from $src_ip$ to $dest_ip$ over port $dest_port$. Which might indicate a potential authentication attempts over a  cleartext protocol.
   risk_objects:
   - field: user
     type: user
@@ -59,6 +59,7 @@ rba:
 tags:
   analytic_story:
   - Use of Cleartext Protocols
+  - Cisco Secure Firewall Threat Defense Analytics
   asset_type: Endpoint
   product:
   - Splunk Enterprise

detections/network/tor_traffic.yml

@@ -60,6 +60,7 @@ tags:
   - Ransomware
   - NOBELIUM Group
   - Command And Control
+  - Cisco Secure Firewall Threat Defense Analytics
   asset_type: Endpoint
   mitre_attack_id:
   - T1090.003