↳ GitHub sourceAnalytics ruleMedium

Cisco ASA - threat detection message fired

Description

'Identifies when the Cisco ASA Threat Detection engine fired an alert based on malicious activity occurring on the network inicated by DeviceEventClassID 733101-733105 Resources: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html Details on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html'

Rule type: Scheduled
Version: 1.0.3
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CiscoAsaAma

Data types

CommonSecurityLog

KQL query

Original query, unchanged.

CommonSecurityLog
| where isempty(CommunicationDirection)
| where DeviceEventClassID in ("733101","733102","733103","733104","733105")
| extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)

Declared entities

HostIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/CiscoASA/Analytic Rules/CiscoASA-ThreatDetectionMessage.yaml ↗
Commit: 9800e51 ↗
Source identifier: 795edf2d-cf3e-45b5-8452-fe6c9e6a582e

Additional source files 3

Solutions/CiscoASA/Analytic Rules/CiscoASA-ThreatDetectionMessage.yamlsource ↗Detections/CommonSecurityLog/CiscoASA-ThreatDetectionMessage.yamlmigration-note ↗Solutions/CiscoASA/Data/Solution_Cisco asa.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.