Sunturai
Back to results
InformationalSplunk security contentNasreddine Bencherchali +1

Cisco Secure Firewall - Repeated Blocked Connections

The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies…

Description

The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies connections where the action is set to Block, and the number of occurrences reaches or exceeds a threshold of ten within a one-minute span. This pattern may indicate a misconfigured application, unauthorized access attempts, or early stages of a brute-force or scanning operation. If confirmed malicious, this behavior may represent an attacker probing the network, attempting lateral movement, or testing firewall rules for weaknesses.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuitePRESaaSWindows

The rule states no platform. This is derived from the 5 ATT&CK techniques it maps to.

Log source category
cisco_secure_firewall_threat_defense_connection_event

Known benign triggers

  • Misconfigured applications or automated scripts may generate repeated blocked traffic, particularly if attempting to reach decommissioned or restricted resources. Vulnerability scanners or penetration testing tools running in authorized environments may trigger this alert. Tuning may be required to exclude known internal tools or scanner IPs from detection.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice