Add dual-signal Firepower analytic rules and Gate/Prove BlockIP (SnortML != signature TP)

[Ahmed Hassan (AAH20)]

Proposed Changes

Consolidates the Cisco Firepower EStreamer dual-signal work into one solution PR (was #14925 analytics + #14926 BlockIP) per Microsoft review.

Adds three dual-signal Analytic Rules so Microsoft Sentinel does not flatten SnortML probability into classic signature true positives, and gates existing BlockIP playbooks.

Rule	Severity	Intent
Cisco Firepower - SnortML GID 411 ML-only high alert	Medium	Escalate / corroborate - do not auto-contain
Cisco Firepower - IDS signature high priority classification	High	Stronger signature TP candidate -> gated remediation
Cisco Firepower - Signature and ML corroboration	High	Dual-signal stronger TP within +/-5 minutes

Playbooks

• CiscoFirepower-BlockIP-NetworkGroup: auto-contain is denied on ML-only (comment + cancel; no FMC BlockIP)
• CiscoFirepower-BlockIP-Teams: HITL warning on ML-only; Teams confirmation still required

Hard rule: ML confidence is not a signature true positive.

Solution metadata / ReleaseNotes: 3.0.3.

Review follow-up (this push)

• ASCII-only analytic YAML (NonAsciiValidations)
• GID 411 match uses (?!\d) so gid 4110 does not collide; ML-only requires GID 411 or is_ml_only
• Signature rule excludes is_ml_only (not only is_ml_only=true)
• Corroboration join is summarized per IP pair / 1m bin then arg_max (no raw many-to-many)
• Logic Apps action names no longer use :
• gid 4110 excluded from playbook ML-only contains() gates
• Manifest Version comma is valid JSON

Data

• Table: CommonSecurityLog (CEF via AMA / Firepower eStreamer)
• Connector: CefAma (Firepower solution dependency)

Portable sisters

• OCSF: Add is_ml_only and is_corroborated for dual-signal finding triage ocsf/ocsf-schema#1732
• Sigma: feat: dual-signal IDS triage (SnortML GID411 ≠ signature TP) SigmaHQ/sigma#6237
• Elastic: [New Rule] Dual-signal Suricata SnortML vs signature triage (GID 411) elastic/detection-rules#6662
• OpenCTI: feat(dual-signal-triage): add Gate/Prove dual-signal enrichment (#7297) OpenCTI-Platform/connectors#7298
• Splunk: feat: Dual-signal SnortML (GID 411) + signature/EVE corroboration analytics for Cisco Secure Firewall splunk/security_content#4220

Optional production consumer for Gate/Prove remediation (paid Continuous Trust, not unpaid R&D): https://github.com/AAH20/aegis-decision-fabric · https://a2zsoc.com/consultation

Checklist

• YAML includes entityMappings
• Unique GUIDs for each rule
• kind: Scheduled
• Consolidated into a single Firepower solution PR
• CLA: @microsoft-github-policy-service agree
• Package rebuild by maintainers if required for Content Hub publish

Test plan

• Validate DetectionTemplateStructureValidationTests / NonAsciiValidations
• Validate KQL against CommonSecurityLog sample Firepower CEF with GID 411 vs classic classifications
• Confirm ML-only rule does not fire on GID 1 signature classifications
• Confirm corroboration requires both legs within 5 minutes
• Confirm NetworkGroup playbook cancels on ML-only title/description

Made with Cursor

[Ahmed Hassan (AAH20)]

@microsoft-github-policy-service agree

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds new Cisco Firepower EStreamer analytic rules that separate SnortML (GID 411) ML probability signals from classic signature true positives, and bumps the solution version/release notes accordingly.

Changes:

• Added three scheduled analytic rules for ML-only (GID 411), high-priority signature classifications, and dual-signal corroboration.
• Updated solution package version to 3.0.2 and appended release notes entry.
• Registered the new analytic rule YAMLs in the solution’s content manifest.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
Solutions/Cisco Firepower EStreamer/ReleaseNotes.md	Adds a 3.0.2 release note entry for the new dual-signal rules.
Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json	Registers the new analytic rules and bumps the solution version to 3.0.2.
Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-SnortML-GID411-MLOnly.yaml	New ML-only detection rule intended to treat SnortML (GID 411) as non-signature TP.
Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-IDS-Signature-HighPriority.yaml	New signature-focused rule for high-priority IDS classifications excluding ML-only events.
Solutions/Cisco Firepower EStreamer/Analytic Rules/CiscoFirepower-Signature-And-ML-Corroboration.yaml	New join-based rule to alert only when signature + ML signals corroborate within ±5 minutes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-atulyadav]

Hi Ahmed Hassan (@AAH20),
Please review the suggestions above and make the necessary changes accordingly. You have also opened one more PR for the same solution, so please incorporate or consolidate the changes from both PRs into a single PR for better tracking and easier review.

Once the review and updates are complete:

1. Consolidate the changes from both PRs into a single PR.
2. Once all checks are complete, click the Resolve conversation button.
3. Check for any failed validation and resolve all validation issues.
4. Repackage the solution with the final reviewed changes.
5. Verify that everything is complete and the solution is working as expected.

Thanks

[Ahmed Hassan (AAH20)]

v-atulyadav Consolidated #14926 into this PR as requested.

Follow-up in `c39915e`:

• ASCII-only analytic YAML (em dash was failing NonAsciiValidations)
• Stricter GID 411 matching (`(?!\d)` + `is_ml_only` alignment)
• Corroboration join summarized before inner join
• Colon-free Logic Apps action names; `gid 4110` excluded from ML-only contains()
• Single solution version 3.0.3 covering analytics + Gate/Prove BlockIP

Please re-run checks and I will resolve Copilot threads once they go stale on the new head.

[v-atulyadav]

Hi Ahmed Hassan (@AAH20),
Below are the requested changes for your commits:

1. The Playbook folder contains a total of five README files. In each README, the Azure Government button currently uses the following link:
   https://aka.ms/deploytoazuregovbutton

   Please replace it with:
   https://aka.ms/deploytoazuregovernbutton

2. After making the changes, please repackage the solution.

[Ahmed Hassan (AAH20)]

Fixed per the review comment — button link corrected to aka.ms/deploytoazuregovernbutton in all 5 Playbook READMEs, pushed in a1bda97. Let me know if the repackage step needs anything further on my end.

[v-atulyadav]

Hi Ahmed Hassan (@AAH20),
Please repackage the solution and update the release notes accordingly. Thanks

[v-atulyadav]

Hi Ahmed Hassan (@AAH20),
Please repackage the solution and update the release notes accordingly. Thanks