Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

feat: Dual-signal SnortML (GID 411) + signature/EVE corroboration analytics for Cisco Secure Firewall

Aperta
  • Qualcosa non va?
#4,220 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@AAH20 ci sta già lavorando.

Dal 16/8/2026.

  • #4221 di @AAH20 — aperta

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
python
Ambito
analytics, backend-api-design, security

Direzione di ricerca

The issue involves adding two new detections to the Cisco Secure Firewall Threat Defense analytics in the ESCU (Enterprise Security Content Updates) framework. Start by examining the existing detection YML files in the repository, likely under a directory like 'detections/'. Look for similar detections for Cisco Secure Firewall to understand the structure. The new detections require creating YML files for 'SnortML High Confidence ML-Only' and 'Signature Plus EVE Corroboration', and adding corresponding unit test data in the datasets/cisco_secure_firewall_threat_defense/ directories. Also, need to attach these detections to the existing analytic story. Review the sister PR in EvidenceForge for context on data formats. 'Done' means the YML detection files and test data are created and linked to the story, ready for PR.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Is your feature request related to a problem? Please describe.

Cisco Secure Firewall Threat Defense analytics in ESCU already cover:

  • High EVE threat confidence (ML-ish encrypted path) as an intermediate finding
  • High-priority classic Snort intrusion classifications as stronger findings

Missing: an explicit SnortML (GeneratorID / GID 411) path that encodes the hard rule ML probability ≠ signature true positive, plus a signature + EVE corroboration analytic for dual-signal FIX_NOW-class triage.

Without that split, agentic / automated response consumers over-trust ML-only highs and under-train corroboration — inflating false containment.

Describe the solution you'd like

  1. Detection: Cisco Secure Firewall - SnortML High Confidence ML-Only
    • EventType=IntrusionEvent GeneratorID=411 (elevated Impact)
    • Type: Anomaly / intermediate finding (escalate/corroborate — not auto-contain)
  2. Detection: Cisco Secure Firewall - Signature Plus EVE Corroboration
    • Classic Snort (GeneratorID!=411) joined with ConnectionEvent EVE_ThreatConfidencePct >= 80
    • Type: TTP / higher finding score
  3. Companion attack_data samples for unit tests under
    datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/ and .../dual_signal_corroboration/
  4. Attach both detections to analytic story Cisco Secure Firewall Threat Defense Analytics

Describe alternatives you've considered

  • Only tuning known_false_positives on High EVE — helpful but does not surface GID 411 as a first-class signal class.
  • Risk-rule-only correlation outside ESCU — weaker distribution to ES customers.

Additional context

CLA status: pending signature (will confirm in thread once completed).

Lingua principale
Python
Stelle
1.7k
Fork
503
Merge medio
2g 18h
PR unite (30g)
48

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di splunk/security_content

Tutte le issue di splunk/security_content

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.