|
| 1 | +INSERT INTO public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) VALUES (1179, 'Meraki Client VPN Brute Force Attempts', 3, 2, 1, 'Credential Access', 'T1110 - Brute Force', e'Detects multiple failed client VPN authentication attempts from the same source IP on Meraki MX appliances, indicating potential brute force attacks against VPN credentials. |
| 2 | +
|
| 3 | +Next Steps: |
| 4 | +1. Review the source IP address and check geographic location |
| 5 | +2. Verify if the targeted user account exists and is active |
| 6 | +3. Check for any successful VPN connections from the same IP |
| 7 | +4. Consider blocking the source IP at the MX appliance |
| 8 | +5. Review VPN authentication settings and ensure MFA is enabled |
| 9 | +6. Notify the targeted user if the account is legitimate |
| 10 | +', '["https://documentation.meraki.com/MX/Client_VPN/Client_VPN_Overview","https://attack.mitre.org/techniques/T1110/"]', e'(oneOf("log.eventType", ["vpn_auth_failure", "client_vpn_auth_failure"]) || |
| 11 | + (contains("log.message", "VPN") && contains("log.message", ["auth fail", "authentication failed", "invalid credentials"]))) && |
| 12 | +exists("origin.ip") |
| 13 | +', '2026-03-02 16:46:57.549445', true, true, 'origin', null, '[{"indexPattern":"v11-log-firewall-meraki-*","with":[{"field":"origin.ip","operator":"filter_term","value":"{{.origin.ip}}"}],"or":null,"within":"now-15m","count":10}]', '["adversary.ip","adversary.user"]'); |
| 14 | +INSERT INTO public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) VALUES (1180, 'Wireless Intrusion Attempts', 3, 3, 2, 'Reconnaissance', 'T1595.002 - Active Scanning: Vulnerability Scanning', e'Detects wireless intrusion attempts including deauthentication attacks, association floods, and other wireless-specific attack patterns that could compromise the wireless network integrity. |
| 15 | +
|
| 16 | +Next Steps: |
| 17 | +1. Review the wireless access point logs for the affected device |
| 18 | +2. Identify the source MAC address and physical location if possible |
| 19 | +3. Check for unauthorized devices or rogue access points in the vicinity |
| 20 | +4. Verify wireless security configurations and update if necessary |
| 21 | +5. Consider implementing additional wireless monitoring and detection capabilities |
| 22 | +6. Document the incident and update security policies if needed |
| 23 | +', '["https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Event_Types_and_Log_Samples","https://attack.mitre.org/techniques/T1595/002/"]', e'equals("log.eventType", "wids_alerted") || |
| 24 | +(equals("log.type", "airmarshal_events") && |
| 25 | + (contains("log.subtype", "attack") || |
| 26 | + contains("log.subtype", "flood") || |
| 27 | + contains("log.subtype", "deauth"))) || |
| 28 | +(contains("log.message", "deauthentication attack") || |
| 29 | + contains("log.message", "association flood") || |
| 30 | + contains("log.message", "wireless intrusion")) |
| 31 | +', '2026-03-02 16:46:59.169784', true, true, 'origin', '["adversary.ip","target.mac"]', '[]', null); |
| 32 | +INSERT INTO public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) VALUES (1181, 'Rogue SSID Detection', 3, 3, 2, 'Initial Access', 'T1200 - Hardware Additions', e'Detects when a rogue SSID is identified in the wireless environment. This could indicate an evil twin attack or unauthorized access point deployment attempting to intercept wireless traffic or credentials. |
| 33 | +
|
| 34 | +Next Steps: |
| 35 | +1. Immediately investigate the rogue access point\'s physical location using the MAC address |
| 36 | +2. Check if the rogue SSID name matches legitimate corporate SSIDs (potential evil twin attack) |
| 37 | +3. Verify if the rogue AP is broadcasting from an unauthorized location |
| 38 | +4. Review wireless client connection logs for any devices that may have connected to the rogue SSID |
| 39 | +5. Consider performing a physical sweep of the area to locate and remove the unauthorized device |
| 40 | +6. Update wireless intrusion detection policies if needed |
| 41 | +7. Notify security team and facilities management for potential physical security breach |
| 42 | +', '["https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Event_Types_and_Log_Samples","https://attack.mitre.org/techniques/T1200/"]', e'equals("log.eventType", "rogue_ssid_detected") || |
| 43 | +(equals("log.type", "airmarshal_events") && |
| 44 | + equals("log.subtype", "rogue_ssid_detected")) || |
| 45 | +(contains("log.message", "rogue") && |
| 46 | + contains("log.message", "SSID")) |
| 47 | +', '2026-03-02 16:47:00.736696', true, true, 'origin', null, '[]', '["adversary.mac"]'); |
| 48 | +INSERT INTO public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) VALUES (1182, 'Meraki IDS High Priority Intrusion Alert', 3, 3, 2, 'Initial Access', 'T1190 - Exploit Public-Facing Application', e'Detects high and medium priority intrusion detection alerts from Meraki IDS/IPS system. These alerts indicate potential exploitation attempts, malicious traffic patterns, or known attack signatures detected by the Snort engine. |
| 49 | +
|
| 50 | +Next Steps: |
| 51 | +1. Review the specific signature that triggered the alert and assess its severity |
| 52 | +2. Investigate the source IP for additional malicious activity or reputation |
| 53 | +3. Check if the destination system shows signs of compromise |
| 54 | +4. Verify if this is part of a larger attack campaign by correlating with other security events |
| 55 | +5. Consider blocking the source IP if confirmed malicious |
| 56 | +6. Review firewall rules and IPS signatures for potential tuning |
| 57 | +7. Document the incident and update threat intelligence feeds if applicable |
| 58 | +', '["https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Event_Types_and_Log_Samples","https://attack.mitre.org/techniques/T1190/"]', e'equals("log.eventType", "security_event") && |
| 59 | +equals("log.alertType", "ids_alerted") && |
| 60 | +lessOrEqual("log.priority", 2) && |
| 61 | +exists("origin.ip") && |
| 62 | +exists("target.ip") |
| 63 | +', '2026-03-02 16:47:02.274134', true, true, 'origin', null, '[]', '["lastEvent.log.signature","adversary.ip"]'); |
| 64 | +INSERT INTO public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) VALUES (1183, 'Evil Twin Access Point Detection', 3, 3, 1, 'Wireless Security', 'T1557 - Adversary-in-the-Middle', e'Detects evil twin attacks where a rogue access point mimics a legitimate corporate SSID to intercept wireless traffic. Meraki Air Marshal identifies spoofed SSIDs that match corporate network names but originate from unauthorized hardware. |
| 65 | +
|
| 66 | +Next Steps: |
| 67 | +1. Verify the detected SSID against authorized access point inventory |
| 68 | +2. Check the BSSID (MAC address) against known Meraki access points |
| 69 | +3. Use Air Marshal containment features to prevent client connections |
| 70 | +4. Physically locate the rogue AP using signal strength triangulation |
| 71 | +5. Check if any clients have connected to the rogue AP |
| 72 | +6. Review network traffic from affected clients for signs of credential theft |
| 73 | +', '["https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal","https://attack.mitre.org/techniques/T1557/"]', e'equals("log.eventType", "airmarshal_events") && |
| 74 | +(equals("log.type", "ssid_spoofing") || |
| 75 | + equals("log.type", "rogue_ssid_detected") || |
| 76 | + (contains("log.message", "SSID Spoofing") || contains("log.message", "Evil Twin"))) && |
| 77 | +exists("log.bssid") |
| 78 | +', '2026-03-02 16:47:03.654329', true, true, 'origin', null, '[]', '["lastEvent.log.bssid","adversary.host"]'); |
| 79 | +INSERT INTO public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) VALUES (1184, 'Air Marshal Rogue Access Point Detection', 3, 3, 2, 'Initial Access', 'T1200 - Hardware Additions', e'Detects when Meraki Air Marshal identifies rogue access points or unauthorized SSIDs in the wireless environment. This could indicate malicious wireless infrastructure attempting to intercept traffic or perform man-in-the-middle attacks. |
| 80 | +
|
| 81 | +Next Steps: |
| 82 | +1. Verify if the detected BSSID and SSID are known legitimate access points that may not be properly registered |
| 83 | +2. Check the RSSI value to determine proximity - higher values indicate the rogue AP is closer to your infrastructure |
| 84 | +3. Use wireless scanning tools to physically locate the rogue access point using the BSSID |
| 85 | +4. Review network traffic logs for any suspicious connections to unknown wireless networks |
| 86 | +5. Check if any sensitive data might have been exposed through connections to the rogue AP |
| 87 | +6. Consider implementing MAC address filtering or 802.1X authentication to prevent unauthorized connections |
| 88 | +7. Document the incident and update the wireless security policy if needed |
| 89 | +', '["https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal","https://attack.mitre.org/techniques/T1200/"]', e'equals("log.eventType", "airmarshal_events") && |
| 90 | +equals("log.type", "rogue_ssid_detected") && |
| 91 | +exists("log.bssid") && |
| 92 | +greaterOrEqual("log.rssi", -50) |
| 93 | +', '2026-03-02 16:47:05.132607', true, true, 'origin', null, '[]', '["adversary.host"]'); |
| 94 | +INSERT INTO public.utm_correlation_rules (id, rule_name, rule_confidentiality, rule_integrity, rule_availability, rule_category, rule_technique, rule_description, rule_references_def, rule_definition_def, rule_last_update, rule_active, system_owner, rule_adversary, rule_deduplicate_by_def, rule_after_events_def, rule_group_by_def) VALUES (1185, 'Meraki Advanced Malware Protection Alert', 3, 3, 2, 'Execution', 'T1204.002 - User Execution: Malicious File', e'Detects when Meraki Advanced Malware Protection (AMP) identifies malicious files being downloaded or executed on the network. This includes retrospective alerts where files previously considered safe are later identified as malicious. |
| 95 | +
|
| 96 | +Next Steps: |
| 97 | +1. Immediately isolate the affected system(s) from the network to prevent lateral movement |
| 98 | +2. Review the malware details including file hash, name, and threat severity in the Meraki dashboard |
| 99 | +3. Check if the malicious file was executed or only downloaded |
| 100 | +4. Scan other systems for the same file hash to identify additional infections |
| 101 | +5. Review network traffic logs from the affected IP for suspicious communications |
| 102 | +6. If file was executed, perform full system scan and consider reimaging the affected device |
| 103 | +7. Update endpoint protection signatures and ensure all systems are patched |
| 104 | +8. Document the incident and update security policies if needed |
| 105 | +', '["https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Advanced_Malware_Protection_(AMP)","https://attack.mitre.org/techniques/T1204/002/"]', e'equals("log.eventType", "security_event") && |
| 106 | +(contains("log.message", "malware") || |
| 107 | + contains("log.message", "AMP") || |
| 108 | + contains("log.message", "malicious") || |
| 109 | + equals("log.action", "malware_blocked") || |
| 110 | + contains("log.eventName", "Advanced Malware Protection")) && |
| 111 | +exists("origin.ip") |
| 112 | +', '2026-03-02 16:47:06.658050', true, true, 'origin', null, '[]', '["adversary.hostname","adversary.ip"]'); |
0 commit comments