From ba06f38b059f058ac08557d05c8a352351970873 Mon Sep 17 00:00:00 2001 From: aah20 Date: Sun, 16 Aug 2026 17:51:48 +0300 Subject: [PATCH 1/2] feat: Cisco Secure Firewall SnortML GID411 and dual-signal corroboration samples Add unit-test datasets for ML-only (GeneratorID=411) intrusion events and classic signature + high EVE pairs sharing ConnectionID. Co-authored-by: Cursor --- .../dual_signal_corroboration/README.md | 4 ++++ .../dual_signal_corroboration/dual_signal_events.log | 2 ++ .../intrusion_event_snortml/README.md | 5 +++++ .../intrusion_event_snortml/intrusion_events_snortml.log | 3 +++ 4 files changed, 14 insertions(+) create mode 100644 datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/README.md create mode 100644 datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log create mode 100644 datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/README.md create mode 100644 datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log diff --git a/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/README.md b/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/README.md new file mode 100644 index 000000000..c07f3a7fd --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/README.md @@ -0,0 +1,4 @@ +# Dual-signal corroboration (classic Snort + high EVE) + +Paired IntrusionEvent (`GeneratorID!=411`) and ConnectionEvent (`EVE_ThreatConfidencePct>=80`) +sharing `ConnectionID` for corroboration analytic unit tests. diff --git a/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log b/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log new file mode 100644 index 000000000..a3e071643 --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log @@ -0,0 +1,2 @@ +{"EventType": "IntrusionEvent", "EventSecond": 1744752800, "EventMicrosecond": 100, "DeviceUUID": "11bc8e94-f604-11ef-bcfe-eeb1de9c8a63", "InstanceID": 1, "FirstPacketSecond": 1744752800, "ConnectionID": 91001, "InitiatorIP": "198.51.100.7", "ResponderIP": "10.0.0.8", "InitiatorPort": 443, "ResponderPort": 51515, "Protocol": "tcp", "PriorityID": 1, "GeneratorID": 1, "SignatureID": 1000002, "SignatureRevision": 1, "Impact": 4, "IntrusionRuleMessage": "XSS variant (signature)", "Classification": "A Network Trojan was Detected", "Application": "HTTPS", "InlineResult": "Would block", "InlineResultReason": "Intrusion Policy in \"Detection\" Inspection Mode", "Device": "172.16.0.10", "DeviceIP": "172.16.0.10", "Hostname": "ftd-lab.example.test", "SnortVersionID": 3, "src": "198.51.100.7", "dest": "10.0.0.8", "dest_port": 51515, "signature_id": 1000002, "signature": "XSS variant (signature)", "class_desc": "A Network Trojan was Detected", "connection_id": 91001} +{"EventType": "ConnectionEvent", "FirstPacketSecond": 1744752800, "LastPacketSecond": 1744752801, "ConnectionDuration": 1, "DeviceUUID": "11bc8e94-f604-11ef-bcfe-eeb1de9c8a63", "InstanceID": 1, "ConnectionID": 91001, "AC_RuleAction": "Allow", "InitiatorIP": "198.51.100.7", "ResponderIP": "10.0.0.8", "InitiatorPort": 443, "ResponderPort": 51515, "Protocol": "tcp", "FirewallPolicy": "default", "FirewallRule": "Permit Outbound", "Application": "HTTPS", "EVE_Process": "chrome", "EVE_ProcessConfidencePct": 90, "EVE_ThreatConfidencePct": 91, "EVE_ThreatConfidenceIndex": 5, "ClientAppDetector": "Encrypted Visibility", "src": "198.51.100.7", "dest": "10.0.0.8", "connection_id": 91001} diff --git a/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/README.md b/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/README.md new file mode 100644 index 000000000..232515478 --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/README.md @@ -0,0 +1,5 @@ +# Cisco Secure Firewall — SnortML (GID 411) intrusion events + +Synthetic IntrusionEvent samples with `GeneratorID=411` for dual-signal triage tests. + +ML probability must not be equated to a classic Snort signature true positive. diff --git a/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log b/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log new file mode 100644 index 000000000..ba92d2213 --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log @@ -0,0 +1,3 @@ +{"EventType": "IntrusionEvent", "EventSecond": 1744752707, "EventMicrosecond": 709756, "DeviceUUID": "11bc8e94-f604-11ef-bcfe-eeb1de9c8a63", "InstanceID": 1, "FirstPacketSecond": 1744752707, "ConnectionID": 90001, "InitiatorIP": "203.0.113.11", "ResponderIP": "10.0.0.5", "InitiatorPort": 443, "ResponderPort": 49152, "Protocol": "tcp", "IngressInterface": "outside", "EgressInterface": "inside", "IngressZone": "outside", "EgressZone": "inside", "PriorityID": 1, "GeneratorID": 411, "SignatureID": 100001, "SignatureRevision": 1, "Impact": 3, "IntrusionRuleMessage": "SnortML possible SQLi (ML-only)", "Classification": "Attempted User Privilege Gain", "Application": "HTTPS", "IntrusionPolicy": "default", "FirewallPolicy": "default", "FirewallRule": "Permit Outbound", "NAP_Policy": "Balanced Security and Connectivity", "InlineResult": "Would block", "InlineResultReason": "Intrusion Policy in \"Detection\" Inspection Mode", "Device": "172.16.0.10", "DeviceIP": "172.16.0.10", "Hostname": "ftd-lab.example.test", "SnortVersionID": 3, "EventID": 1000, "src": "203.0.113.11", "dest": "10.0.0.5", "dest_port": 49152, "signature_id": 100001, "signature": "SnortML possible SQLi (ML-only)", "class_desc": "Attempted User Privilege Gain"} +{"EventType": "IntrusionEvent", "EventSecond": 1744752707, "EventMicrosecond": 709756, "DeviceUUID": "11bc8e94-f604-11ef-bcfe-eeb1de9c8a63", "InstanceID": 1, "FirstPacketSecond": 1744752707, "ConnectionID": 90002, "InitiatorIP": "203.0.113.11", "ResponderIP": "10.0.0.5", "InitiatorPort": 443, "ResponderPort": 49152, "Protocol": "tcp", "IngressInterface": "outside", "EgressInterface": "inside", "IngressZone": "outside", "EgressZone": "inside", "PriorityID": 1, "GeneratorID": 411, "SignatureID": 100001, "SignatureRevision": 1, "Impact": 3, "IntrusionRuleMessage": "SnortML possible SQLi (ML-only)", "Classification": "Attempted User Privilege Gain", "Application": "HTTPS", "IntrusionPolicy": "default", "FirewallPolicy": "default", "FirewallRule": "Permit Outbound", "NAP_Policy": "Balanced Security and Connectivity", "InlineResult": "Would block", "InlineResultReason": "Intrusion Policy in \"Detection\" Inspection Mode", "Device": "172.16.0.10", "DeviceIP": "172.16.0.10", "Hostname": "ftd-lab.example.test", "SnortVersionID": 3, "EventID": 1001, "src": "203.0.113.11", "dest": "10.0.0.5", "dest_port": 49152, "signature_id": 100001, "signature": "SnortML possible SQLi (ML-only)", "class_desc": "Attempted User Privilege Gain"} +{"EventType": "IntrusionEvent", "EventSecond": 1744752707, "EventMicrosecond": 709756, "DeviceUUID": "11bc8e94-f604-11ef-bcfe-eeb1de9c8a63", "InstanceID": 1, "FirstPacketSecond": 1744752707, "ConnectionID": 90003, "InitiatorIP": "203.0.113.11", "ResponderIP": "10.0.0.5", "InitiatorPort": 443, "ResponderPort": 49152, "Protocol": "tcp", "IngressInterface": "outside", "EgressInterface": "inside", "IngressZone": "outside", "EgressZone": "inside", "PriorityID": 1, "GeneratorID": 411, "SignatureID": 100001, "SignatureRevision": 1, "Impact": 3, "IntrusionRuleMessage": "SnortML possible SQLi (ML-only)", "Classification": "Attempted User Privilege Gain", "Application": "HTTPS", "IntrusionPolicy": "default", "FirewallPolicy": "default", "FirewallRule": "Permit Outbound", "NAP_Policy": "Balanced Security and Connectivity", "InlineResult": "Would block", "InlineResultReason": "Intrusion Policy in \"Detection\" Inspection Mode", "Device": "172.16.0.10", "DeviceIP": "172.16.0.10", "Hostname": "ftd-lab.example.test", "SnortVersionID": 3, "EventID": 1002, "src": "203.0.113.11", "dest": "10.0.0.5", "dest_port": 49152, "signature_id": 100001, "signature": "SnortML possible SQLi (ML-only)", "class_desc": "Attempted User Privilege Gain"} From 3449255728742b2f36e18b33fd3a10362d4cd1a2 Mon Sep 17 00:00:00 2001 From: aah20 Date: Tue, 18 Aug 2026 14:57:13 +0300 Subject: [PATCH 2/2] fix: correct dual-signal SnortML sample data per review feedback Addresses @nasbench's review on #1206 -- every specific technical point was correct, verified against this repo's own real connection_event/connection_events.log (same author) as ground truth: - InitiatorPort/ResponderPort were reversed on every entry. For client-to-server HTTPS, the initiator (client) uses a high ephemeral port and the responder (server) uses 443 -- these samples had it backwards, which is exactly the kind of tell that reveals unvalidated synthetic data. - The ConnectionEvent was missing EVE_Fingerprint (the TLS ClientHello fingerprint Encrypted Visibility Engine detection is actually keyed on) and URL, both present on every real EVE-tagged connection event in this repo. - Also added the SSL_* fields (CertFingerprint, CipherSuite, FlowStatus, Version, ServerCertStatus, ActualAction, ExpectedAction) and Ingress/EgressInterface+Zone that accompany EVE telemetry in the real reference file, rather than a partial fix. - Replaced README.md with a proper dataset .yml (author/id/date/ description/mitre_technique/datasets), matching the convention every other cisco_secure_firewall_threat_defense sibling dataset uses. - Re-added the .log files through Git LFS per .gitattributes (datasets/**/*.log is LFS-tracked; they were previously committed as plain blobs). Signed-off-by: aah20 --- .../dual_signal_corroboration/README.md | 4 ---- .../dual_signal_corroboration.yml | 13 +++++++++++++ .../dual_signal_events.log | 5 +++-- .../intrusion_event_snortml/README.md | 5 ----- .../intrusion_events_snortml.log | 6 +++--- .../intrusion_events_snortml.yml | 13 +++++++++++++ 6 files changed, 32 insertions(+), 14 deletions(-) delete mode 100644 datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/README.md create mode 100644 datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_corroboration.yml delete mode 100644 datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/README.md create mode 100644 datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.yml diff --git a/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/README.md b/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/README.md deleted file mode 100644 index c07f3a7fd..000000000 --- a/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/README.md +++ /dev/null @@ -1,4 +0,0 @@ -# Dual-signal corroboration (classic Snort + high EVE) - -Paired IntrusionEvent (`GeneratorID!=411`) and ConnectionEvent (`EVE_ThreatConfidencePct>=80`) -sharing `ConnectionID` for corroboration analytic unit tests. diff --git a/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_corroboration.yml b/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_corroboration.yml new file mode 100644 index 000000000..1e16fd9f7 --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_corroboration.yml @@ -0,0 +1,13 @@ +author: Ahmed Hassan +id: 98845775-b43a-4e2d-84b0-f8ba387a7e37 +date: '2026-08-18' +description: Synthetically generated dataset pairing a classic Snort signature IntrusionEvent (GeneratorID=1) with its corroborating ConnectionEvent (Encrypted Visibility Engine telemetry) sharing the same ConnectionID, for dual-signal corroboration analytic unit tests. +environment: manual simulations in a controlled lab environment +directory: dual_signal_corroboration +mitre_technique: +- T1190 +datasets: +- name: dual_signal_events + path: /datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log + sourcetype: cisco:sfw:estreamer + source: cisco:sfw:estreamer diff --git a/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log b/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log index a3e071643..2929825bb 100644 --- a/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log +++ b/datasets/cisco_secure_firewall_threat_defense/dual_signal_corroboration/dual_signal_events.log @@ -1,2 +1,3 @@ -{"EventType": "IntrusionEvent", "EventSecond": 1744752800, "EventMicrosecond": 100, "DeviceUUID": "11bc8e94-f604-11ef-bcfe-eeb1de9c8a63", "InstanceID": 1, "FirstPacketSecond": 1744752800, "ConnectionID": 91001, "InitiatorIP": "198.51.100.7", "ResponderIP": "10.0.0.8", "InitiatorPort": 443, "ResponderPort": 51515, "Protocol": "tcp", "PriorityID": 1, "GeneratorID": 1, "SignatureID": 1000002, "SignatureRevision": 1, "Impact": 4, "IntrusionRuleMessage": "XSS variant (signature)", "Classification": "A Network Trojan was Detected", "Application": "HTTPS", "InlineResult": "Would block", "InlineResultReason": "Intrusion Policy in \"Detection\" Inspection Mode", "Device": "172.16.0.10", "DeviceIP": "172.16.0.10", "Hostname": "ftd-lab.example.test", "SnortVersionID": 3, "src": "198.51.100.7", "dest": "10.0.0.8", "dest_port": 51515, "signature_id": 1000002, "signature": "XSS variant (signature)", "class_desc": "A Network Trojan was Detected", "connection_id": 91001} -{"EventType": "ConnectionEvent", "FirstPacketSecond": 1744752800, "LastPacketSecond": 1744752801, "ConnectionDuration": 1, "DeviceUUID": "11bc8e94-f604-11ef-bcfe-eeb1de9c8a63", "InstanceID": 1, "ConnectionID": 91001, "AC_RuleAction": "Allow", "InitiatorIP": "198.51.100.7", "ResponderIP": "10.0.0.8", "InitiatorPort": 443, "ResponderPort": 51515, "Protocol": "tcp", "FirewallPolicy": "default", "FirewallRule": "Permit Outbound", "Application": "HTTPS", "EVE_Process": "chrome", "EVE_ProcessConfidencePct": 90, "EVE_ThreatConfidencePct": 91, "EVE_ThreatConfidenceIndex": 5, "ClientAppDetector": "Encrypted Visibility", "src": "198.51.100.7", "dest": "10.0.0.8", "connection_id": 91001} +version https://git-lfs.github.com/spec/v1 +oid sha256:9e94d2868994de3277421f56535afe8743ed1ed736e6af6fd5bfde2d51f661d1 +size 2691 diff --git a/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/README.md b/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/README.md deleted file mode 100644 index 232515478..000000000 --- a/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/README.md +++ /dev/null @@ -1,5 +0,0 @@ -# Cisco Secure Firewall — SnortML (GID 411) intrusion events - -Synthetic IntrusionEvent samples with `GeneratorID=411` for dual-signal triage tests. - -ML probability must not be equated to a classic Snort signature true positive. diff --git a/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log b/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log index ba92d2213..25e100082 100644 --- a/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log +++ b/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log @@ -1,3 +1,3 @@ -{"EventType": "IntrusionEvent", "EventSecond": 1744752707, "EventMicrosecond": 709756, "DeviceUUID": "11bc8e94-f604-11ef-bcfe-eeb1de9c8a63", "InstanceID": 1, "FirstPacketSecond": 1744752707, "ConnectionID": 90001, "InitiatorIP": "203.0.113.11", "ResponderIP": "10.0.0.5", "InitiatorPort": 443, "ResponderPort": 49152, "Protocol": "tcp", "IngressInterface": "outside", "EgressInterface": "inside", "IngressZone": "outside", "EgressZone": "inside", "PriorityID": 1, "GeneratorID": 411, "SignatureID": 100001, "SignatureRevision": 1, "Impact": 3, "IntrusionRuleMessage": "SnortML possible SQLi (ML-only)", "Classification": "Attempted User Privilege Gain", "Application": "HTTPS", "IntrusionPolicy": "default", "FirewallPolicy": "default", "FirewallRule": "Permit Outbound", "NAP_Policy": "Balanced Security and Connectivity", "InlineResult": "Would block", "InlineResultReason": "Intrusion Policy in \"Detection\" Inspection Mode", "Device": "172.16.0.10", "DeviceIP": "172.16.0.10", "Hostname": "ftd-lab.example.test", "SnortVersionID": 3, "EventID": 1000, "src": "203.0.113.11", "dest": "10.0.0.5", "dest_port": 49152, "signature_id": 100001, "signature": "SnortML possible SQLi (ML-only)", "class_desc": "Attempted User Privilege Gain"} -{"EventType": "IntrusionEvent", "EventSecond": 1744752707, "EventMicrosecond": 709756, "DeviceUUID": "11bc8e94-f604-11ef-bcfe-eeb1de9c8a63", "InstanceID": 1, "FirstPacketSecond": 1744752707, "ConnectionID": 90002, "InitiatorIP": "203.0.113.11", "ResponderIP": "10.0.0.5", "InitiatorPort": 443, "ResponderPort": 49152, "Protocol": "tcp", "IngressInterface": "outside", "EgressInterface": "inside", "IngressZone": "outside", "EgressZone": "inside", "PriorityID": 1, "GeneratorID": 411, "SignatureID": 100001, "SignatureRevision": 1, "Impact": 3, "IntrusionRuleMessage": "SnortML possible SQLi (ML-only)", "Classification": "Attempted User Privilege Gain", "Application": "HTTPS", "IntrusionPolicy": "default", "FirewallPolicy": "default", "FirewallRule": "Permit Outbound", "NAP_Policy": "Balanced Security and Connectivity", "InlineResult": "Would block", "InlineResultReason": "Intrusion Policy in \"Detection\" Inspection Mode", "Device": "172.16.0.10", "DeviceIP": "172.16.0.10", "Hostname": "ftd-lab.example.test", "SnortVersionID": 3, "EventID": 1001, "src": "203.0.113.11", "dest": "10.0.0.5", "dest_port": 49152, "signature_id": 100001, "signature": "SnortML possible SQLi (ML-only)", "class_desc": "Attempted User Privilege Gain"} -{"EventType": "IntrusionEvent", "EventSecond": 1744752707, "EventMicrosecond": 709756, "DeviceUUID": "11bc8e94-f604-11ef-bcfe-eeb1de9c8a63", "InstanceID": 1, "FirstPacketSecond": 1744752707, "ConnectionID": 90003, "InitiatorIP": "203.0.113.11", "ResponderIP": "10.0.0.5", "InitiatorPort": 443, "ResponderPort": 49152, "Protocol": "tcp", "IngressInterface": "outside", "EgressInterface": "inside", "IngressZone": "outside", "EgressZone": "inside", "PriorityID": 1, "GeneratorID": 411, "SignatureID": 100001, "SignatureRevision": 1, "Impact": 3, "IntrusionRuleMessage": "SnortML possible SQLi (ML-only)", "Classification": "Attempted User Privilege Gain", "Application": "HTTPS", "IntrusionPolicy": "default", "FirewallPolicy": "default", "FirewallRule": "Permit Outbound", "NAP_Policy": "Balanced Security and Connectivity", "InlineResult": "Would block", "InlineResultReason": "Intrusion Policy in \"Detection\" Inspection Mode", "Device": "172.16.0.10", "DeviceIP": "172.16.0.10", "Hostname": "ftd-lab.example.test", "SnortVersionID": 3, "EventID": 1002, "src": "203.0.113.11", "dest": "10.0.0.5", "dest_port": 49152, "signature_id": 100001, "signature": "SnortML possible SQLi (ML-only)", "class_desc": "Attempted User Privilege Gain"} +version https://git-lfs.github.com/spec/v1 +oid sha256:96710c7a532a873468475f08673e1360c56c95c7ee0a5961021f60a71eda4b86 +size 3717 diff --git a/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.yml b/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.yml new file mode 100644 index 000000000..27ed38360 --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.yml @@ -0,0 +1,13 @@ +author: Ahmed Hassan +id: 68062594-f5df-4ac6-a928-c224a6c92c74 +date: '2026-08-18' +description: Synthetically generated IntrusionEvent samples with GeneratorID=411 (SnortML, ML-only detection with no corroborating classic signature) for dual-signal triage tests. ML probability must not be equated to a classic Snort signature true positive. +environment: manual simulations in a controlled lab environment +directory: intrusion_event_snortml +mitre_technique: +- T1190 +datasets: +- name: intrusion_events_snortml + path: /datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/intrusion_events_snortml.log + sourcetype: cisco:sfw:estreamer + source: cisco:sfw:estreamer