1+ name : Cisco Secure Application AppDynamics Alerts
2+ id : 5c963eb0-010e-4386-875f-5134879f14a7
3+ version : 1
4+ date : ' 2025-02-04'
5+ author : Bhavin Patel, Splunk
6+ description : Data source object for alerts from Cisco Secure Application
7+ source : AppDynamics Security
8+ sourcetype : appdynamics_security
9+ supported_TA :
10+ - name : Splunk Add-on for AppDynamics
11+ url : https://splunkbase.splunk.com/app/3471
12+ version : 3.0.0
13+ fields :
14+ - SourceType
15+ - apiServerExternal
16+ - app_name
17+ - application
18+ - attackEventTrigger
19+ - attackEvents{}.applicationName
20+ - attackEvents{}.attackOutcome
21+ - attackEvents{}.attackTypes
22+ - attackEvents{}.blocked
23+ - attackEvents{}.blockedReason
24+ - attackEvents{}.clientAddress
25+ - attackEvents{}.clientAddressType
26+ - attackEvents{}.clientPort
27+ - attackEvents{}.cveId
28+ - attackEvents{}.detailJson.apiServerExternal
29+ - attackEvents{}.detailJson.apiServerInUrl
30+ - attackEvents{}.detailJson.classname
31+ - attackEvents{}.detailJson.hostContext
32+ - attackEvents{}.detailJson.methodName
33+ - attackEvents{}.detailJson.ptype
34+ - attackEvents{}.detailJson.socketOut
35+ - attackEvents{}.eventType
36+ - attackEvents{}.jvmId
37+ - attackEvents{}.keyInfo
38+ - attackEvents{}.maliciousIpOut
39+ - attackEvents{}.maliciousIpSource
40+ - attackEvents{}.maliciousIpSourceOut
41+ - attackEvents{}.matchedCveName
42+ - attackEvents{}.serverAddress
43+ - attackEvents{}.serverName
44+ - attackEvents{}.serverPort
45+ - attackEvents{}.stackTrace
46+ - attackEvents{}.tierName
47+ - attackEvents{}.timestamp
48+ - attackEvents{}.vulnerabilityInfo.cveNvdUrl
49+ - attackEvents{}.vulnerabilityInfo.cvePublishDate
50+ - attackEvents{}.vulnerabilityInfo.cvssScore
51+ - attackEvents{}.vulnerabilityInfo.cvssSeverity
52+ - attackEvents{}.vulnerabilityInfo.incidentFirstDetected
53+ - attackEvents{}.vulnerabilityInfo.kennaActiveInternetBreach
54+ - attackEvents{}.vulnerabilityInfo.kennaEasilyExploitable
55+ - attackEvents{}.vulnerabilityInfo.kennaMalwareExploitable
56+ - attackEvents{}.vulnerabilityInfo.kennaPopularTarget
57+ - attackEvents{}.vulnerabilityInfo.kennaPredictedExploitable
58+ - attackEvents{}.vulnerabilityInfo.kennaScore
59+ - attackEvents{}.vulnerabilityInfo.library
60+ - attackEvents{}.vulnerabilityInfo.title
61+ - attackEvents{}.vulnerabilityInfo.type
62+ - attackEvents{}.vulnerableMethod
63+ - attackEvents{}.webTransactionUrl
64+ - attackId
65+ - attackLastDetected
66+ - attackOutcome
67+ - attackSource
68+ - attackStatus
69+ - attackTypes
70+ - blocked
71+ - blockedReason
72+ - businessTransaction
73+ - classname
74+ - clientAddressType
75+ - cveId
76+ - cveNvdUrl
77+ - cvePublishDate
78+ - cvssScore
79+ - cvssSeverity
80+ - dest_ip
81+ - dest_nt_host
82+ - dest_port
83+ - eventType
84+ - eventtype
85+ - host
86+ - incidentFirstDetected
87+ - index
88+ - jvmId
89+ - kennaActiveInternetBreach
90+ - kennaEasilyExploitable
91+ - kennaMalwareExploitable
92+ - kennaPopularTarget
93+ - kennaPredictedExploitable
94+ - kennaScore
95+ - keyInfo
96+ - linecount
97+ - maliciousIpOut
98+ - maliciousIpSource
99+ - maliciousIpSourceOut
100+ - matchedCveName
101+ - methodName
102+ - ptype
103+ - punct
104+ - signature
105+ - socketAddr
106+ - socketFromLog4j
107+ - socketOut
108+ - source
109+ - sourcetype
110+ - splunk_server
111+ - splunk_server_group
112+ - src_category
113+ - src_ip
114+ - src_port
115+ - stackTrace
116+ - status
117+ - tag
118+ - tag::eventtype
119+ - tier
120+ - tierName
121+ - timestamp
122+ - vulnLibrary
123+ - vulnTitle
124+ - vulnType
125+ - vulnerableMethod
126+ - webTransactionUrl
127+ - _bkt
128+ - _cd
129+ - _eventtype_color
130+ - _indextime
131+ - _raw
132+ - _serial
133+ - _si
134+ - _sourcetype
135+ - _time
136+ example_log: '{ "SourceType": "secure_app_attacks", "attackId": "24815279", "attackSource": "EXTERNAL", "attackOutcome": "EXPLOITED", "attackTypes": "{SSRF}", "attackEventTrigger": "", "application": "AD-Ecommerce", "tier": "Order-Processing-Services", "businessTransaction": "Checkout", "attackStatus": "OPEN", "attackLastDetected": "2025-01-31 12:30:22 +0000 UTC", "attackEvents": [{"attackOutcome":"EXPLOITED","eventType":"SOCKET_RESOLVE","attackTypes":"SSRF","timestamp":"2025-01-31T12:30:22Z","applicationName":"AD-Ecommerce","tierName":"Order-Processing-Services","maliciousIpOut":"","maliciousIpSourceOut":"","detailJson":{"classname":"java.net.SocketPermission","ptype":"SOCKET","socketOut":"www.cisco.com","hostContext":"www.cisco.com","methodName":"sun.net.www.http.HttpClient.openServer","apiServerExternal":true,"apiServerInUrl":true},"blocked":false,"blockedReason":"","vulnerableMethod":"org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)","matchedCveName":"CVE-2020-13934","keyInfo":"","cveId":"a21931cd-52fa-11ec-a8b2-8e3051145156","stackTrace":"java.lang.SecurityManager.checkConnect(SecurityManager.java:1051)\nsun.net.www.http.HttpClient.openServer(HttpClient.java:510)\nsun.net.www.protocol.https.HttpsClient.\u003cinit\u003e(HttpsClient.java:264)\nsun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:367)\nsun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191)\norg.apache.activemq.artemis.spi.core.security.jaas.LDAPLoginModule.login(SomeFile.java:12)\nsun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1138)\nsun.net.www.protocol.http.HttpURLConnection$6.run(HttpURLConnection.java:1022)\nsun.net.www.protocol.http.HttpURLConnection$6.run(HttpURLConnection.java:1020)\njava.security.AccessController.doPrivileged(Native Method)\njava.security.AccessController.doPrivilegedWithCombiner(AccessController.java:782)\nsun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1019)\nsun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177)\nsun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1546)\nsun.net.www.protocol.http.HttpURLConnection.access$200(HttpURLConnection.java:91)\nsun.net.www.protocol.http.HttpURLConnection$9.run(HttpURLConnection.java:1466)\nsun.net.www.protocol.http.HttpURLConnection$9.run(HttpURLConnection.java:1464)\njava.security.AccessController.doPrivileged(Native Method)\njava.security.AccessController.doPrivilegedWithCombiner(AccessController.java:782)\nsun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1463)\nsun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254)\nservlet.ArgentoDemoApp$GenericExecution._executeServletCommand(ArgentoDemoApp.java:850)\nservlet.ArgentoDemoApp$GenericExecution.executeServletCommand(ArgentoDemoApp.java:778)\nservlet.ArgentoDemoApp$MyApplicationExecution.executeServletCommand(ArgentoDemoApp.java:718)\nservlet.ArgentoDemoApp._doGet(ArgentoDemoApp.java:441)\nservlet.ArgentoDemoApp.doGet(ArgentoDemoApp.java:376)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:634)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:741)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)\norg.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)\norg.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)\norg.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)\norg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)\norg.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)\norg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)\norg.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:690)\norg.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)\norg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)\norg.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)\norg.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)\norg.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)\norg.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)\norg.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\njava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\njava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\norg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\njava.lang.Thread.run(Thread.java:745)\n","jvmId":"EEcommerce_MS_NODE","maliciousIpSource":"","webTransactionUrl":"https://localhost:8088/argentoDemoApp/execute?upload=https://www.cisco.com/c/dam/cdc/t/ctm-core.js","clientAddressType":4,"clientAddress":"218.132.217.179","serverPort":"1047","serverAddress":"75.155.150.130","clientPort":"68389","serverName":"/usr/src/argento/prod/demo-run/tomcat-demo-app/webapps/argentoDemoApp/","vulnerabilityInfo":{"cvePublishDate":"2020-07-15T16:40:14.601976Z","cvssScore":5.3,"cvssSeverity":"MEDIUM","cveNvdUrl":"https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCATEMBED-584427","incidentFirstDetected":"2020-07-15T16:40:14.601976Z","kennaScore":53.0971,"library":"org.apache.tomcat.embed:tomcat-embed-core","title":"Denial of Service (DoS)","type":"java","kennaActiveInternetBreach":false,"kennaEasilyExploitable":false,"kennaMalwareExploitable":false,"kennaPredictedExploitable":true,"kennaPopularTarget":false}}]}'
0 commit comments