Skip to content

Commit fd93946

Browse files
patel-bhavinpatel-bhavin
committed
move to public
1 parent 264b758 commit fd93946

File tree

4 files changed

+276
-0
lines changed

4 files changed

+276
-0
lines changed

‎data_sources/cisco_asa_logs.yml‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
name: Cisco ASA Logs
2+
id: 3f2a9b6d-1c8e-4f7b-a2d3-8b7f1c2a9d4e
3+
version: 1
4+
date: '2025-09-23'
5+
author: Bhavin Patel, Splunk
6+
description: >
7+
Data source object for Cisco ASA system logs. Cisco ASA logs provide firewall
8+
operational and security telemetry (connection events, ACL denies, VPN events,
9+
NAT translations, and device health). Deploy the Splunk Add-on for Cisco ASA
10+
(TA-cisco_asa) on indexers/heavy forwarders and the Cisco ASA App on search
11+
heads for best parsing, CIM mapping, and dashboards. This data is ingested via SYSLOG.
12+
source: cisco:asa
13+
sourcetype: cisco:asa
14+
separator: null
15+
supported_TA:
16+
- name: Cisco Security Cloud
17+
url: https://splunkbase.splunk.com/app/7404
18+
version: 3.4.1
19+
fields:
20+
- Cisco_ASA_action
21+
- Cisco_ASA_message_id
22+
- Cisco_ASA_user
23+
- Cisco_ASA_vendor_action
24+
- IP
25+
- Username
26+
- _bkt
27+
- _cd
28+
- _eventtype_color
29+
- _indextime
30+
- _raw
31+
- _serial
32+
- _si
33+
- _sourcetype
34+
- _time
35+
- acl
36+
- action
37+
- app
38+
- assigned_ip
39+
- bytes
40+
- category
41+
- command
42+
- communication_protocol
43+
- connections_in_use
44+
- date_hour
45+
- date_mday
46+
- date_minute
47+
- date_month
48+
- date_second
49+
- date_wday
50+
- date_year
51+
- date_zone
52+
- dest
53+
- dest_host
54+
- dest_interface
55+
- dest_ip
56+
- dest_nt_domain
57+
- dest_port
58+
- dest_public_port
59+
- dest_translated_host
60+
- dest_translated_ip
61+
- dest_translated_port
62+
- dest_user
63+
- dest_zone
64+
- direction
65+
- duration
66+
- duration_day
67+
- duration_hour
68+
- duration_minute
69+
- duration_second
70+
- dvc
71+
- eventtype
72+
- group
73+
- host
74+
- ids_type
75+
- index
76+
- laction
77+
- linecount
78+
- most_used_connections
79+
- object
80+
- object_attrs
81+
- object_category
82+
- object_id
83+
- product
84+
- protocol
85+
- protocol_version
86+
- punct
87+
- reason
88+
- result
89+
- rule
90+
- rule_name
91+
- session_id
92+
- severity
93+
- signature
94+
- signature_id
95+
- source
96+
- sourcetype
97+
- splunk_server
98+
- splunk_server_group
99+
- src
100+
- src_host
101+
- src_interface
102+
- src_ip
103+
- src_nt_domain
104+
- src_port
105+
- src_public_port
106+
- src_translated_host
107+
- src_translated_ip
108+
- src_translated_port
109+
- src_user
110+
- src_zone
111+
- ssl_is_valid
112+
- status
113+
- tag
114+
- tag::action
115+
- tag::app
116+
- tag::eventtype
117+
- tag::object_category
118+
- teardown_initiator
119+
- timeendpos
120+
- timestartpos
121+
- transport
122+
- type
123+
- user
124+
- vendor
125+
- vendor_action
126+
- vendor_product
127+
- vendor_severity
128+
- zone
129+
example_log: >
130+
Sep 23 19:27:50 18.144.133.67 :2025-09-23T19:27:49Z: %ASA-session-7-609002: Teardown local-host management:54.245.234.201 duration 0:02:01
131+
Sep 23 18:07:00 18.144.133.67 :2025-09-23T18:07:00Z: %ASA-session-7-710005: TCP request discarded from 198.27.166.158/55508 to management:172.31.12.229/443

‎detections/application/cisco_asa___core_syslog_message_volume_drop.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: Cisco ASA - Core Syslog Message Volume Drop
2+
id: 4b4f8fdd-1f9e-45d8-9b0f-1f64c0b297a4
3+
version: 1
4+
date: '2025-09-23'
5+
author: Bhavin Patel, Micheal Haag, Splunk
6+
status: production
7+
type: Hunting
8+
description: |
9+
Adversaries may intentionally suppress or reduce the volume of core Cisco ASA syslog messages to evade detection or cover their tracks. This hunting search is recommended to proactively identify suspicious downward shifts or absences in key syslog message IDs, which may indicate tampering or malicious activity. Visualizing this data in Splunk dashboards enables security teams to quickly spot anomalies and investigate potential compromise.
10+
data_source:
11+
- Cisco ASA Logs
12+
search: |
13+
`cisco_asa`
14+
| rex "%ASA-[^-]+-\d+-(?<message_id>\d+):"
15+
| search message_id IN (710005)
16+
| eval msg_desc=case(
17+
message_id="302013","Built inbound TCP connection",
18+
message_id="302014","Teardown TCP connection",
19+
message_id="609002","Teardown local-host management",
20+
message_id="710005","TCP request discarded"
21+
)
22+
| bin _time span=15m
23+
| stats count values(msg_desc) as message_description values(host) as host by _time message_id
24+
| xyseries _time message_id count
25+
| `cisco_asa___core_syslog_message_volume_drop_filter`
26+
how_to_implement: |
27+
This search requires Cisco ASA syslog data to be ingested into Splunk.
28+
Ensure comprehensive syslog collection (including key connection-related messages)
29+
is configured for ASA/FTD devices. The search produces a time-series suitable for
30+
dashboards to visualize drops across message IDs 302013, 302014, 609002, and 710005.
31+
For alerting, consider pairing this with a baseline or anomaly detection approach
32+
(e.g., comparing rolling averages or historical medians) to identify statistically
33+
significant downward shifts.
34+
known_false_positives: |
35+
Planned maintenance, network outages, routing changes, or benign configuration
36+
updates may reduce log volume temporarily. Validate against change management
37+
records and corroborate with device health metrics.
38+
references:
39+
- https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
40+
- https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
41+
- https://ciscovulnmgmtprod.service-now.com/psirt?id=advisory_preview&sysparm_sys_id=bd8313cb47a7ea10f61dfa74116d43d8
42+
- https://ciscovulnmgmtprod.service-now.com/psirt?id=advisory_preview&sysparm_sys_id=cf28925747636e10f61dfa74116d43d9
43+
tags:
44+
analytic_story:
45+
- ArcaneDoor
46+
asset_type: Network
47+
mitre_attack_id:
48+
- T1562
49+
product:
50+
- Splunk Enterprise
51+
- Splunk Enterprise Security
52+
- Splunk Cloud
53+
security_domain: network
54+
cve:
55+
- CVE-2025-20333
56+
- CVE-2025-20362
57+
tests:
58+
- name: True Positive Test
59+
attack_data:
60+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_asa/arcane_door/cisco_asa.log
61+
source: syslog
62+
sourcetype: cisco:asa

‎detections/application/cisco_asa___logging_disabled_via_cli.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: Cisco ASA - Logging Disabled via CLI
2+
id: 7b4c9f3e-5a88-4b7b-9c4b-94d8e5d67201
3+
version: 1
4+
date: '2025-09-23'
5+
author: Bhavin Patel, Micheal Haag, Splunk
6+
status: production
7+
type: TTP
8+
description: |
9+
This analytic detects the disabling of logging functionality on a Cisco ASA device
10+
through CLI commands. Adversaries or malicious insiders may attempt to disable logging
11+
to evade detection and hide malicious activity. The detection looks for specific ASA
12+
syslog message IDs (111009, 111010, 111008) associated with command execution,
13+
combined with suspicious commands such as `no logging`, `logging disable`,
14+
`clear logging`, or `no logging host`. Disabling logging on a firewall or security device
15+
is a strong indicator of defense evasion.
16+
data_source:
17+
- Cisco ASA Logs
18+
search: |
19+
`cisco_asa`
20+
| rex "%ASA-[^-]+-\d+-(?<message_id>\d+):"
21+
| search message_id IN (111009,111010,111008)
22+
| rex field=_raw "executed (?:the command )?(?<asa_command>.+)$"
23+
| search asa_command IN ("*no logging*","*logging disable*","*clear logging*","*no logging host*","*no logging trap*")
24+
| stats earliest(_time) as firstTime latest(_time) as lastTime values(user) as user values(action) as action values(asa_command) as commands values(src_ip) as src_ip values(process_name) as process_name by host
25+
| `security_content_ctime(firstTime)`
26+
| `security_content_ctime(lastTime)`
27+
| `cisco_asa___logging_disabled_via_cli_filter`
28+
how_to_implement: |
29+
This search requires Cisco ASA syslog data to be ingested into Splunk.
30+
Ensure that syslog collection is configured correctly for ASA devices including all the debug logs.
31+
The search leverages syslog message IDs 111009, 111010, and 111008,
32+
which record executed commands. You may need to tune the search
33+
to your environment by updating the list of suspicious logging commands.
34+
known_false_positives: |
35+
Administrators may intentionally disable or modify logging during maintenance,
36+
troubleshooting, or device reconfiguration. These events should be verified
37+
against approved change management activities.
38+
references:
39+
- https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
40+
- https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
41+
- https://ciscovulnmgmtprod.service-now.com/psirt?id=advisory_preview&sysparm_sys_id=bd8313cb47a7ea10f61dfa74116d43d8
42+
- https://ciscovulnmgmtprod.service-now.com/psirt?id=advisory_preview&sysparm_sys_id=cf28925747636e10f61dfa74116d43d9
43+
drilldown_searches:
44+
- name: View the detection results for $host$
45+
search: '%original_detection_search% | search host = $host$'
46+
earliest_offset: $info_min_time$
47+
latest_offset: $info_max_time$
48+
- name: View risk events for the last 7 days for $host$
49+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
50+
earliest_offset: $info_min_time$
51+
latest_offset: $info_max_time$
52+
rba:
53+
message: User $user$ from executed commands to disable logging on the Cisco ASA host $host$.
54+
risk_objects:
55+
- field: host
56+
type: system
57+
score: 80
58+
threat_objects:
59+
- field: src_ip
60+
type: ip_address
61+
tags:
62+
analytic_story:
63+
- ArcaneDoor
64+
asset_type: Network
65+
mitre_attack_id:
66+
- T1562.002
67+
product:
68+
- Splunk Enterprise
69+
- Splunk Enterprise Security
70+
security_domain: network
71+
cve:
72+
- CVE-2025-20333
73+
- CVE-2025-20362
74+
tests:
75+
- name: True Positive Test
76+
attack_data:
77+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_asa/arcane_door/cisco_asa.log
78+
source: syslog
79+
sourcetype: cisco:asa

‎macros/cisco_asa.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
definition: sourcetype=cisco:asa
2+
description: customer specific splunk configurations(eg- index, source, sourcetype).
3+
Replace the macro definition with configurations for your Splunk Environment.
4+
name: cisco_asa

0 commit comments

Comments
 (0)