Merge pull request #3654 from splunk/fixes_5130

Remove Drilldown

Author: patel-bhavin

detections/network/cisco_configuration_archive_logging_analysis.yml

@@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count values(All_Changes.comm
   | rename dvc as dest 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
-  | `cisco_configuration_archive_logging_analysis_filter`'
+ | `cisco_configuration_archive_logging_analysis_filter`'
 how_to_implement: To implement this search, you need to be ingesting Cisco IOS logs with the sourcetype "cisco:ios" and have these logs mapped to the Change datamodel. Ensure that your Cisco IOS devices are configured to send logs to your Splunk environment, with configuration archive logging enabled. On Cisco devices, enable archive logging with the commands "archive" and "log config" in global configuration mode. Configure command logging with "archive log config logging enable" and ensure that the appropriate logging levels are set with "logging trap informational". The detection looks for patterns of suspicious configuration changes across sessions, focusing on account creation, SNMP modifications, and TFTP server configurations.
 known_false_positives: Legitimate configuration changes during routine maintenance or device setup may trigger this detection, especially when multiple related changes are made in a single session. Network administrators often make several configuration changes in sequence during maintenance windows. To reduce false positives, consider implementing a baseline of expected administrative activities, including approved administrative usernames and scheduled maintenance windows. The detection includes a threshold (count > 2) to filter out isolated configuration changes, but this threshold may need to be adjusted based on your environment's normal activity patterns.
 references:
@@ -33,10 +33,6 @@ drilldown_searches:
   search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
-- name: View session details for - "$session_id$"
-  search: '%original_detection_search% | search session_id = "$session_id$"'
-  earliest_offset: $info_min_time$
-  latest_offset: $info_max_time$
 - name: View risk events for the last 7 days for - "$dest$" and "$user$"
   search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
     "$user$") starthoursago=168  | stats count min(_time)