Skip to content

Cisco Secure Application Alerts #3306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
patel-bhavin merged 14 commits into from
Feb 18, 2025
Merged

Cisco Secure Application Alerts #3306

Changes from 1 commit
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
0544e80
adding draft detections
patel-bhavin Feb 4, 2025
90d0d3b
adding data source
patel-bhavin Feb 4, 2025
5e3991d
updating datasiource
patel-bhavin Feb 4, 2025
785fbd5
updating contetntctl
patel-bhavin Feb 4, 2025
3f04de5
updating TA
patel-bhavin Feb 4, 2025
c8aabc0
updating yaml
patel-bhavin Feb 5, 2025
af6077f
updating spl
patel-bhavin Feb 12, 2025
6908748
Merge branch 'develop' into app_dynamics_alerts
patel-bhavin Feb 13, 2025
0392bfe
Update cisco_secure_application_alerts.yml
patel-bhavin Feb 13, 2025
d5f3bf6
Add manual_test flag
patel-bhavin Feb 13, 2025
3bb8618
updating as per Lou's feedback
patel-bhavin Feb 13, 2025
2ba144b
Update cisco_secure_application_alerts.yml
patel-bhavin Feb 14, 2025
9ae1c7a
kfp
patel-bhavin Feb 18, 2025
3a5f6d6
Merge branch 'develop' into app_dynamics_alerts
patel-bhavin Feb 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion detections/application/cisco_secure_application_alerts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ search: |-
)
| `cisco_secure_application_alerts_filter`
how_to_implement: In order to properly run this search, you need to ingest alerts data from AppD SecureApp, specifically ingesting data via HEC. You will also need to ensure that the data is going to sourcetype - `appdynamics_security`. You will need to install the Splunk Add-on for AppDynamics.
known_false_positives: None known at this time but if there are false positives, please reach filter out these using the filter macro to reduce alert fatigue
known_false_positives: None known false postive for this detection search. If the alerts are noisy, consider tuning this detection by using the _filter macro in this search and/or by updating the tool this alert originates from.
references:
- https://docs.appdynamics.com/appd/24.x/latest/en/application-security-monitoring/integrate-cisco-secure-application-with-splunk
drilldown_searches:
Expand Down