Sunturai
Back to results
InformationalSplunk security contentNasreddine Bencherchali +1

Cisco Secure Firewall - Blocked Connection

The following analytic detects a blocked connection event by identifying a "Block" value in the action field. It leverages logs from Cisco Secure Firewall Threat Defense devices. This activity is significant as it…

Description

The following analytic detects a blocked connection event by identifying a "Block" value in the action field. It leverages logs from Cisco Secure Firewall Threat Defense devices. This activity is significant as it can identify attempts from users or applications initiating network connection to explicitly or implicitly blocked range or zones. If confirmed malicious, attackers could be attempting to perform a forbidden action on the network such as data exfiltration, lateral movement, or network disruption.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuitePRESaaSWindows

The rule states no platform. This is derived from the 5 ATT&CK techniques it maps to.

Log source category
cisco_secure_firewall_threat_defense_connection_event

Known benign triggers

  • Blocked connection events are generated via an Access Control policy on the Firewall management console. Hence no false positives should be present.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice