updating detection file

patel-bhavin · patel-bhavin · commit b4cd4142b6f3 · 2025-09-25T09:05:39.000-07:00
diff --git a/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml b/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml
@@ -1,7 +1,7 @@
 name: Cisco Secure Firewall - Intrusion Events by Threat Activity
 id: b71e57e8-c571-4ff1-ae13-bc4384a9e891
-version: 3  
-date: '2025-08-21'
+version: 4  
+date: '2025-09-25'
 author: Bhavin Patel, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
@@ -16,6 +16,7 @@ description: |
   events that occur in close temporal proximity.
 
   Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup:
+  * ArcaneDoor
   * Static Tundra
   * AgentTesla
   * Amadey
