Is your feature request related to a problem? Please describe.
Cisco Secure Firewall Threat Defense analytics in ESCU already cover:
- High EVE threat confidence (ML-ish encrypted path) as an intermediate finding
- High-priority classic Snort intrusion classifications as stronger findings
Missing: an explicit SnortML (GeneratorID / GID 411) path that encodes the hard rule ML probability ≠ signature true positive, plus a signature + EVE corroboration analytic for dual-signal FIX_NOW-class triage.
Without that split, agentic / automated response consumers over-trust ML-only highs and under-train corroboration — inflating false containment.
Describe the solution you'd like
- Detection:
Cisco Secure Firewall - SnortML High Confidence ML-Only
EventType=IntrusionEvent GeneratorID=411 (elevated Impact)- Type: Anomaly / intermediate finding (escalate/corroborate — not auto-contain)
- Detection:
Cisco Secure Firewall - Signature Plus EVE Corroboration
- Classic Snort (
GeneratorID!=411) joined with ConnectionEvent EVE_ThreatConfidencePct >= 80
- Type: TTP / higher finding score
- Companion
attack_data samples for unit tests under
datasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/ and .../dual_signal_corroboration/
- Attach both detections to analytic story Cisco Secure Firewall Threat Defense Analytics
Describe alternatives you've considered
- Only tuning
known_false_positives on High EVE — helpful but does not surface GID 411 as a first-class signal class.
- Risk-rule-only correlation outside ESCU — weaker distribution to ES customers.
Additional context
CLA status: pending signature (will confirm in thread once completed).
Is your feature request related to a problem? Please describe.
Cisco Secure Firewall Threat Defense analytics in ESCU already cover:
Missing: an explicit SnortML (GeneratorID / GID 411) path that encodes the hard rule ML probability ≠ signature true positive, plus a signature + EVE corroboration analytic for dual-signal FIX_NOW-class triage.
Without that split, agentic / automated response consumers over-trust ML-only highs and under-train corroboration — inflating false containment.
Describe the solution you'd like
Cisco Secure Firewall - SnortML High Confidence ML-OnlyEventType=IntrusionEvent GeneratorID=411(elevated Impact)Cisco Secure Firewall - Signature Plus EVE CorroborationGeneratorID!=411) joined with ConnectionEventEVE_ThreatConfidencePct >= 80attack_datasamples for unit tests underdatasets/cisco_secure_firewall_threat_defense/intrusion_event_snortml/and.../dual_signal_corroboration/Describe alternatives you've considered
known_false_positiveson High EVE — helpful but does not surface GID 411 as a first-class signal class.Additional context
CLA status: pending signature (will confirm in thread once completed).