Deny auto BlockIP on ML-only Firepower incidents (Gate/Prove)

[Ahmed Hassan (AAH20)]

Proposed Changes

Compounds #14925: the dual-signal analytic rules are not enough if CiscoFirepower-BlockIP-NetworkGroup still auto-contains on ML-only incidents.

Hard rule: ML confidence ≠ signature true positive.

Playbook	Gate/Prove behavior
CiscoFirepower-BlockIP-NetworkGroup (auto-contain)	If incident title/description is ML-only (SnortML / GID 411 / is_ml_only) without corroboration (is_corroborated / signature+ML), comment and Terminate/Cancelled — no FMC Network Group APIs
CiscoFirepower-BlockIP-Teams (HITL)	Same ML-only path: warning comment only. Teams Adaptive Card still requires analyst confirmation before BlockIP

Signature-high and signature+ML corroborated incidents are unchanged (NetworkGroup still blocks; Teams still HITL).

Solution metadata bumped to 3.0.3 (playbooks). If #14925 (3.0.2) is not merged yet, maintainers can collapse versions on merge. Playbook template version 1.0 → 1.1.

Wiring

• Attach auto-BlockIP (NetworkGroup) only to signature-high or corroboration analytics.
• Attach Teams HITL when an analyst must review ML-only (GID 411) alerts.
• Do not attach NetworkGroup auto-contain to ML-only analytics.

Portable sisters

• Analytics (this solution): Add dual-signal Firepower analytic rules and Gate/Prove BlockIP (SnortML != signature TP) #14925
• OCSF: Add is_ml_only and is_corroborated for dual-signal finding triage ocsf/ocsf-schema#1732
• Sigma: feat: dual-signal IDS triage (SnortML GID411 ≠ signature TP) SigmaHQ/sigma#6237
• Elastic: [New Rule] Dual-signal Suricata SnortML vs signature triage (GID 411) elastic/detection-rules#6662
• OpenCTI: feat(dual-signal-triage): add Gate/Prove dual-signal enrichment (#7297) OpenCTI-Platform/connectors#7298
• Splunk: feat: Dual-signal SnortML (GID 411) + signature/EVE corroboration analytics for Cisco Secure Firewall splunk/security_content#4220

Optional production Gate/Prove consumer (paid Continuous Trust, not unpaid R&D): https://github.com/AAH20/aegis-decision-fabric · https://a2zsoc.com/consultation

Checklist

• ARM JSON remains valid (json.loads)
• NetworkGroup: ML-only → comment + Terminate before Entities - Get IPs
• Teams: ML-only → warning comment; does not terminate; HITL continues
• Playbook hidden-SentinelTemplateVersion 1.1 + releaseNotes 1.1.0
• CLA signed if prompted (personal CLA already agreed on Add dual-signal Firepower analytic rules and Gate/Prove BlockIP (SnortML != signature TP) #14925)
• Package rebuild by maintainers if required for Content Hub publish

Test plan

• Deploy NetworkGroup playbook; trigger with incident title containing SnortML / GID 411 / is_ml_only and no corroboration markers → incident comment, run Cancelled, no FMC BlockIP
• Same playbook with signature-high or is_corroborated / signature and ml in the incident → BlockIP path unchanged
• Deploy Teams playbook; ML-only incident → warning comment and Adaptive Card still posted
• Confirm automation rules: NetworkGroup not bound to ML-only analytics

Made with Cursor

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Cisco Firepower BlockIP playbooks to add a Gate/Prove “ML-only” pre-check so ML-only (SnortML / GID 411) incidents don’t trigger automatic containment, while keeping Teams as HITL and updating solution versions/metadata accordingly.

Changes:

• Add ML-only detection based on incident title/description and either terminate auto-contain (NetworkGroup) or warn only (Teams).
• Bump playbook template versions to 1.1 and solution version to 3.0.3, plus release notes/readme guidance updates.
• Update ARM template metadata (release notes, lastUpdateTime, mainSteps, postDeployment, releaseNotes).

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
Solutions/Cisco Firepower EStreamer/ReleaseNotes.md	Adds 3.0.3 entry documenting Gate/Prove behavior for BlockIP playbooks.
Solutions/Cisco Firepower EStreamer/Playbooks/readme.md	Documents when to use auto-contain vs Teams HITL for ML-only scenarios.
Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/readme.md	Adds Gate/Prove ML-only warning guidance for HITL flow.
Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-Teams/azuredeploy.json	Implements ML-only warning comment and bumps template metadata/versioning.
Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/readme.md	Documents ML-only deny/cancel behavior for auto-contain playbook.
Solutions/Cisco Firepower EStreamer/Playbooks/CiscoFirepower-BlockIP-NetworkGroup/azuredeploy.json	Implements ML-only deny + terminate before any FMC operations and bumps template metadata/versioning.
Solutions/Cisco Firepower EStreamer/Data/Solution_Cisco Firepower EStreamer.json	Bumps solution version to 3.0.3.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-atulyadav]

Hi Ahmed Hassan (@AAH20),
Please review the suggestions above and make the necessary changes accordingly. You have also opened one more PR for the same solution, so please incorporate or consolidate the changes from both PRs into a single PR for better tracking and easier review.

Once the review and updates are complete:

1. Consolidate the changes from both PRs into a single PR.
2. Once all checks are complete, click the Resolve conversation button.
3. Repackage the solution with the final reviewed changes.
   Verify that everything is complete and the solution is working as expected.
   Thanks

[Ahmed Hassan (AAH20)]

Consolidated into #14925 per v-atulyadav (single Firepower solution version with analytics + Gate/Prove BlockIP). Closing this duplicate.