You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -15,7 +15,7 @@ description: "Data source object for Cisco ASA system logs. Cisco ASA logs provi
15
15
\ enabled, as it relies on the presence of specific message IDs. You can find specific\
16
16
\ instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880.\
description: 'Ollama server logs (HTTP access logs via GIN framework and system logs including GPU/CPU utilization, model loading, memory allocation, errors, and warnings) via Splunk TA-ollama add-on by configuring file monitoring inputs to your log directories (sourcetype: ollama:server), or enable HEC for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). This TA is not available on Splunkbase and must be installed manually via the GitHub repository - https://github.com/rosplk/ta-ollama'
6
+
description: 'Ollama server logs (HTTP access logs via GIN framework and system logs
7
+
including GPU/CPU utilization, model loading, memory allocation, errors, and warnings)
8
+
via Splunk TA-ollama add-on by configuring file monitoring inputs to your log directories
9
+
(sourcetype: ollama:server), or enable HEC for real-time API telemetry and prompt
10
+
analytics (sourcetypes: ollama:api, ollama:prompts). This TA is not available on
11
+
Splunkbase and must be installed manually via the GitHub repository - https://github.com/rosplk/ta-ollama'
This analytic detects modifications to authentication and authorization (AAA) security policies on Cisco ASA devices via CLI or ASDM.
10
+
AAA policies control critical security mechanisms including authentication attempts, lockout thresholds, password policies, and access control settings that protect administrative access to network infrastructure.
11
+
Adversaries or malicious insiders may weaken authentication policies to facilitate brute force attacks, disable account lockouts to enable unlimited password attempts, reduce password complexity requirements, or modify authorization settings to elevate privileges and maintain persistent access.
12
+
The detection monitors for command execution events containing AAA-related commands such as `aaa authentication`, `aaa authorization`, or `aaa local authentication`, focusing on changes to authentication attempts, lockout policies, and access control configurations.
13
+
Investigate any unauthorized modifications to AAA policies, especially changes that weaken security posture (increasing max-fail attempts, disabling lockouts, reducing password requirements), and verify these changes against approved change management processes and security policies.
14
+
data_source:
15
+
- Cisco ASA Logs
16
+
search: |
17
+
`cisco_asa`
18
+
message_id IN (111008, 111010)
19
+
command IN (
20
+
"aaa authentication*",
21
+
"aaa authorization*",
22
+
"aaa local authentication*",
23
+
"aaa-server*",
24
+
"no aaa*"
25
+
)
26
+
| fillnull
27
+
| stats count
28
+
earliest(_time) as firstTime
29
+
latest(_time) as lastTime
30
+
values(user) as user
31
+
values(action) as action
32
+
values(message_id) as message_id
33
+
values(command) as command
34
+
values(src_ip) as src_ip
35
+
values(process_name) as process_name
36
+
by host
37
+
| `security_content_ctime(firstTime)`
38
+
| `security_content_ctime(lastTime)`
39
+
| `cisco_asa___aaa_policy_tampering_filter`
40
+
how_to_implement: |
41
+
This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
42
+
To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
43
+
If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
44
+
You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
45
+
You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
46
+
known_false_positives: |
47
+
Legitimate AAA configuration modifications may occur during normal administrative activities such as implementing new security policies, adjusting lockout thresholds or troubleshooting authentication issues. These events should be verified and investigated. Consider filtering modifications performed by known administrative accounts where necessary.
- name: View risk events for the last 7 days for $host$
56
+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
57
+
earliest_offset: $info_min_time$
58
+
latest_offset: $info_max_time$
59
+
rba:
60
+
message: User $user$ executed command $command$ to modify AAA configuration on Cisco ASA host $host$.
This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward both debug and informational level syslog messages before they are sent to Splunk. This analytic is designed to be used with comprehensive logging enabled, as it relies on the presence of specific message IDs. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880. The search produces a time-series suitable for dashboards to visualize drops across message IDs 302013, 302014, 609002, and 710005.
28
+
This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward both debug and informational level syslog messages before they are sent to Splunk.
29
+
This analytic is designed to be used with comprehensive logging enabled, as it relies on the presence of specific message IDs. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880.
30
+
The search produces a time-series suitable for dashboards to visualize drops across message IDs 302013, 302014, 609002, and 710005.
31
+
You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
28
32
known_false_positives: |
29
-
Planned maintenance, network outages, routing changes, or benign configuration
30
-
updates may reduce log volume temporarily. Validate against change management
31
-
records and corroborate with device health metrics.
33
+
Planned maintenance, network outages, routing changes, or benign configuration updates may reduce log volume temporarily.
34
+
Validate against change management records and corroborate with device health metrics.
0 commit comments