Update cisco_secure_application_alerts.yml

patel-bhavin · web-flow · commit 2ba144b9591a · 2025-02-14T12:06:20.000-08:00
diff --git a/detections/application/cisco_secure_application_alerts.yml b/detections/application/cisco_secure_application_alerts.yml
@@ -44,7 +44,7 @@ search: |-
     )
   | `cisco_secure_application_alerts_filter`
 how_to_implement: In order to properly run this search, you need to ingest alerts data from AppD SecureApp, specifically ingesting data via HEC. You will also need to ensure that the data is going to sourcetype - `appdynamics_security`. You will need to install the Splunk Add-on for AppDynamics.
-known_false_positives: None known at this time but if there are false positives, please reach filter out these using the filter macro to reduce alert fatigue
+known_false_positives: None known false postive for this detection search. If the alerts are noisy, consider tuning this detection by using the _filter macro in this search and/or by updating the tool this alert originates from.
 references:
 - https://docs.appdynamics.com/appd/24.x/latest/en/application-security-monitoring/integrate-cisco-secure-application-with-splunk
 drilldown_searches:

Original file line number	Diff line number	Diff line change
`@@ -44,7 +44,7 @@ search: \|-`
`44`	`44`	`)`
`45`	`45`	\| `cisco_secure_application_alerts_filter`
`46`	`46`	how_to_implement: In order to properly run this search, you need to ingest alerts data from AppD SecureApp, specifically ingesting data via HEC. You will also need to ensure that the data is going to sourcetype - `appdynamics_security`. You will need to install the Splunk Add-on for AppDynamics.
`47`		`-known_false_positives: None known at this time but if there are false positives, please reach filter out these using the filter macro to reduce alert fatigue`
	`47`	`+known_false_positives: None known false postive for this detection search. If the alerts are noisy, consider tuning this detection by using the _filter macro in this search and/or by updating the tool this alert originates from.`
`48`	`48`	`references:`
`49`	`49`	`- https://docs.appdynamics.com/appd/24.x/latest/en/application-security-monitoring/integrate-cisco-secure-application-with-splunk`
`50`	`50`	`drilldown_searches:`