Skip to content

Commit 3da4f79

Browse files
tccontret-contreraspatel-bhavin
authored
anomaly_standard_init_score (#3946)
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com> Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
1 parent 2e2f6fc commit 3da4f79

File tree

730 files changed

+2324
-2324
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

730 files changed

+2324
-2324
lines changed

‎detections/application/cisco_ai_defense_security_alerts_by_application_name.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco AI Defense Security Alerts by Application Name
22
id: 105e4a69-ec55-49fc-be1f-902467435ea8
3-
version: 4
4-
date: '2026-02-25'
3+
version: 5
4+
date: '2026-03-10'
55
author: Bhavin Patel, Splunk
66
status: production
77
type: Anomaly
@@ -56,7 +56,7 @@ rba:
5656
risk_objects:
5757
- field: application_name
5858
type: other
59-
score: 10
59+
score: 20
6060
threat_objects: []
6161
tags:
6262
analytic_story:

‎detections/application/cisco_asa___aaa_policy_tampering.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco ASA - AAA Policy Tampering
22
id: 8f2c4e9a-5d3b-4c7e-9a1f-6e8d5b2c3a9f
3-
version: 2
4-
date: '2026-02-25'
3+
version: 3
4+
date: '2026-03-10'
55
author: Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
@@ -61,7 +61,7 @@ rba:
6161
risk_objects:
6262
- field: host
6363
type: system
64-
score: 40
64+
score: 20
6565
threat_objects:
6666
- field: command
6767
type: process

‎detections/application/cisco_asa___device_file_copy_activity.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco ASA - Device File Copy Activity
22
id: 4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
3-
version: 2
4-
date: '2026-02-25'
3+
version: 3
4+
date: '2026-03-10'
55
author: Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
@@ -61,7 +61,7 @@ rba:
6161
risk_objects:
6262
- field: host
6363
type: system
64-
score: 50
64+
score: 20
6565
threat_objects:
6666
- field: src_ip
6767
type: ip_address

‎detections/application/cisco_asa___device_file_copy_to_remote_location.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco ASA - Device File Copy to Remote Location
22
id: 8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
3-
version: 2
4-
date: '2026-02-25'
3+
version: 3
4+
date: '2026-03-10'
55
author: Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
@@ -82,10 +82,10 @@ rba:
8282
risk_objects:
8383
- field: host
8484
type: system
85-
score: 50
85+
score: 20
8686
- field: user
8787
type: user
88-
score: 50
88+
score: 20
8989
threat_objects:
9090
- field: dest
9191
type: ip_address

‎detections/application/cisco_asa___logging_filters_configuration_tampering.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco ASA - Logging Filters Configuration Tampering
22
id: b87b48a8-6d1a-4280-9cf1-16a950dbf901
3-
version: 2
4-
date: '2026-02-25'
3+
version: 3
4+
date: '2026-03-10'
55
author: Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
@@ -71,10 +71,10 @@ rba:
7171
risk_objects:
7272
- field: host
7373
type: system
74-
score: 60
74+
score: 20
7575
- field: user
7676
type: user
77-
score: 60
77+
score: 20
7878
threat_objects:
7979
- field: command
8080
type: process

‎detections/application/cisco_asa___logging_message_suppression.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco ASA - Logging Message Suppression
22
id: 4e6c9d2a-8f3b-4c7e-9a5f-2d8b6e1c4a9f
3-
version: 2
4-
date: '2026-02-25'
3+
version: 3
4+
date: '2026-03-10'
55
author: Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
@@ -56,10 +56,10 @@ rba:
5656
risk_objects:
5757
- field: host
5858
type: system
59-
score: 50
59+
score: 20
6060
- field: user
6161
type: user
62-
score: 50
62+
score: 20
6363
threat_objects:
6464
- field: command
6565
type: process

‎detections/application/cisco_asa___new_local_user_account_created.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco ASA - New Local User Account Created
22
id: 9c8e4f2a-7d3b-4e5c-8a9f-1b6d4e8c3f5a
3-
version: 2
4-
date: '2026-02-25'
3+
version: 3
4+
date: '2026-03-10'
55
author: Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
@@ -51,10 +51,10 @@ rba:
5151
risk_objects:
5252
- field: host
5353
type: system
54-
score: 40
54+
score: 20
5555
- field: user
5656
type: user
57-
score: 40
57+
score: 20
5858
threat_objects: []
5959
tags:
6060
analytic_story:

‎detections/application/cisco_asa___packet_capture_activity.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco ASA - Packet Capture Activity
22
id: 7e9c3f8a-4b2d-4c5e-9a1f-6d8e5b3c2a9f
3-
version: 2
4-
date: '2026-02-25'
3+
version: 3
4+
date: '2026-03-10'
55
author: Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
@@ -56,10 +56,10 @@ rba:
5656
risk_objects:
5757
- field: host
5858
type: system
59-
score: 50
59+
score: 20
6060
- field: user
6161
type: user
62-
score: 50
62+
score: 20
6363
threat_objects:
6464
- field: command
6565
type: process

‎detections/application/cisco_asa___reconnaissance_command_activity.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco ASA - Reconnaissance Command Activity
22
id: 6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
3-
version: 2
4-
date: '2026-02-25'
3+
version: 3
4+
date: '2026-03-10'
55
author: Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
@@ -112,10 +112,10 @@ rba:
112112
risk_objects:
113113
- field: host
114114
type: system
115-
score: 50
115+
score: 20
116116
- field: user
117117
type: user
118-
score: 40
118+
score: 20
119119
threat_objects:
120120
- field: src_ip
121121
type: ip_address

‎detections/application/cisco_asa___user_account_deleted_from_local_database.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco ASA - User Account Deleted From Local Database
22
id: 2d4b9e7f-5c3a-4d8e-9b1f-8a6c5e2d4f7a
3-
version: 2
4-
date: '2026-02-25'
3+
version: 3
4+
date: '2026-03-10'
55
author: Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
@@ -51,10 +51,10 @@ rba:
5151
risk_objects:
5252
- field: host
5353
type: system
54-
score: 40
54+
score: 20
5555
- field: user
5656
type: user
57-
score: 40
57+
score: 20
5858
threat_objects: []
5959
tags:
6060
analytic_story:

0 commit comments

Comments
 (0)