-
Notifications
You must be signed in to change notification settings - Fork 35
/
cisco-pixasa.rules
501 lines (492 loc) · 153 KB
/
cisco-pixasa.rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
# Sagan cisco-pixasa.rules
# Copyright (c) 2009-2020. Quadrant Information Security <www.quadrantsec.com>
# All rights reserved.
#
# Please submit any custom rules or ideas to [email protected] or the sagan-sigs mailing list
#
#*************************************************************
# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
# following conditions are met:
#
# * Redistributions of source code must retain the above copyright notice, this list of conditions and the following
# disclaimer.
# * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
# following disclaimer in the documentation and/or other materials provided with the distribution.
# * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES,
# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
# USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
# Iman Khosravi updated many of these rules to support the Cisco FWSM (firewall service modules).
# 06/25/2012.
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to initialize 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+1-114001/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000416; sid: 5000416; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to initialize SFP in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+1-114002/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000417; sid: 5000417; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to run cached commands in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+1-114003/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000418; sid: 5000418; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function"; append_program; content: "%ASA"; pcre: "/%ASA[-]+1-216001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000419; sid: 5000419; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] AAA Marking protocol server ip-addr in server group tag as FAILED"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+2-113022|%FWSM[-]+2-113022; parse_src_ip: 1/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000420; sid: 5000420; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in - function message"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+2-216001|%FWSM[-]+2-216001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000421; sid: 5000421; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot locate AK47 instance"; append_program; content: "%ASA"; pcre: "/%ASA[-]+2-716500/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000422; sid: 5000422; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot attach AK47 instance"; append_program; content: "%ASA"; pcre: "/%ASA[-]+2-716501/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000423; sid: 5000423; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot allocate default arena"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+2-716502|%FWSM[-]+2-716502/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000424; sid: 5000424; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot allocate fiber descriptors pool"; append_program; content: "%ASA"; pcre: "/%ASA[-]+2-716503/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000425; sid: 5000425; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot allocate fiber stacks pool"; append_program; content: "%ASA"; pcre: "/%ASA[-]+2-716504/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000426; sid: 5000426; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber has joined fiber in unfinished state"; append_program; content: "%ASA"; pcre: "/%ASA[-]+2-716505/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000427; sid: 5000427; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber scheduler has reached unreachable code. Cannot continue terminating"; append_program; content: "%ASA"; pcre: "/%ASA[-]+2-716507/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000428; sid: 5000428; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber scheduler is scheduling rotten fiber. Cannot continuing terminating"; append_program; content: "%ASA"; pcre: "/%ASA[-]+2-716508/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000429; sid: 5000429; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber scheduler is scheduling alien fiber. Cannot continue terminating"; append_program; content: "%ASA"; pcre: "/%ASA[-]+2-716509/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000430; sid: 5000430; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber scheduler is scheduling finished fiber. Cannot continue terminating"; append_program; content: "%ASA"; pcre: "/%ASA[-]+2-716510/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000431; sid: 5000431; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber has joined fiber waited upon by someone else"; append_program; content: "%ASA"; pcre: "/%ASA[-]+2-716512/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000432; sid: 5000432; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber in callback blocked on other channel"; append_program; content: "%ASA"; pcre: "/%ASA[-]+2-716513/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000433; sid: 5000433; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM failed to allocate memory for AK47 instance"; append_program; content: "%ASA"; pcre: "/%ASA[-]+2-716515/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000434; sid: 5000434; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM has corrupted ROL array. Cannot continue terminating"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+2-716516|%FWSM[-]+2-716516/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000435; sid: 5000435; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM cached block has no associated arena"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+2-716517|%FWSM[-]+2-716517/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000436; sid: 5000436; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM pool has no associated arena"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+2-716518|%FWSM[-]+2-716518/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000437; sid: 5000437; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM has corrupted pool list. Cannot continue terminating"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+2-716519|%FWSM[-]+2-716519/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000438; sid: 5000438; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM pool has no block list"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+2-716520|%FWSM[-]+2-716520/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000439; sid: 5000439; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM no realloc allowed in named pool"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+2-716521|%FWSM[-]+2-716521/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000440; sid: 5000440; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM corrupted standalone block"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+2-716522|%FWSM[-]+2-716522/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000441; sid: 5000441; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] UNICORN_SYSLOGID_PERM_STORAGE_SERVER_LOAD_FAIL"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+2-716526|%FWSM[-]+2-716526/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000442; sid: 5000442; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] UNICORN_SYSLOGID_PERM_STORAGE_SERVER_STORE_FAIL"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+2-716527|%FWSM[-]+2-716527/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000443; sid: 5000443; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unexpected fiber scheduler error - possible out-of-memory condition"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+2-716528|%FWSM[-]+2-716528/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000444; sid: 5000444; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to get port statistics in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114006/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000445; sid: 5000445; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to get current msr in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114007/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000446; sid: 5000446; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to enable port after link is up in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114008/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000447; sid: 5000447; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set multicast address in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114009/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000448; sid: 5000448; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set multicast hardware address in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114010/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000449; sid: 5000449; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to delete multicast address in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114011/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000450; sid: 5000450; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to delete multicast hardware address in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114012/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000451; sid: 5000451; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set mac address table in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114013/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000452; sid: 5000452; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set mac address in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114014/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000453; sid: 5000453; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set mode in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114015/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000454; sid: 5000454; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set multicast mode in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114016/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000455; sid: 5000455; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to get link status in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114017/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000456; sid: 5000456; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set port speed in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114018/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000457; sid: 5000457; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set media type in 4GE SSM I/O card"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-114019/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000458; sid: 5000458; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function message"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+3-216001|%FWSM[-]+3-216001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000459; sid: 5000459; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] I2C_API_name error"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+3-219002|%FWSM[-]+3-219002/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000460; sid: 5000460; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPN Handle error protocol"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-316002/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000461; sid: 5000461; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot experienced a control channel communications failure"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-323001/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000462; sid: 5000462; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot failed to write software. Hw-module reset is required before further use"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-323004/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000463; sid: 5000463; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot can not be powered on completely"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-323005/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000464; sid: 5000464; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Type Module in slot experienced a data channel communication failure, data channel is DOWN"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-323006/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000465; sid: 5000465; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPS card not up and fail-close mode used, dropping ICMP packet [1]"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-420001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000466; sid: 5000466; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPS card not up and fail-close mode used, dropping ICMP packet [2]"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-420001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000467; sid: 5000467; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] TCP|UDP flow from interface is dropped because application has failed"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+3-421001|%FWSM[-]+3-421001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000468; sid: 5000468; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] TCP|UDP flow from interface is skipped because application has failed"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+3-421007|%FWSM[-]+3-421007/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000469; sid: 5000469; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authentication to SSO server failed"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+3-716056|%FWSM[-]+3-716056/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000470; sid: 5000470; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Email Proxy session pointer has terminated due to reason error"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-719002/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000471; sid: 5000471; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Message ERROR message [1]"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+3-722007|%FWSM[-]+3-722007/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000472; sid: 5000472; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Message ERROR message [2]"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+3-722008|%FWSM[-]+3-722008/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000473; sid: 5000473; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Message ERROR message [3]"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+3-722009|%FWSM[-]+3-722009/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000474; sid: 5000474; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot is not able to shut down. Module Error"; append_program; content: "%ASA"; pcre: "/%ASA[-]+4-413001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000475; sid: 5000475; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot is not able to reload. Module Error"; append_program; content: "%ASA"; pcre: "/%ASA[-]+4-413002/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000476; sid: 5000476; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot failed to write software. Trying again"; append_program; content: "%ASA"; pcre: "/%ASA[-]+4-413004/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000477; sid: 5000477; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPS requested to drop ICMP packets"; append_program; content: "%ASA"; pcre: "/%ASA[-]+4-420002; default_proto: icmp; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000478; sid: 5000478; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} invalid NBNS pkt"; append_program; content: "%ASA"; pcre: "/%ASA[-]+4-423001|%FWSM[-]+4-423001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000479; sid: 5000479; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} mismatched NBNS pkt"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-423002|%FWSM[-]+4-423002/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000480; sid: 5000480; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} invalid NBDGM pkt"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-423003|%FWSM[-]+4-423003/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000481; sid: 5000481; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} mismatched NBDGM pkt"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-423004|%FWSM[-]+4-423004/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000482; sid: 5000482; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} NBDGM pkt"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-423005|%FWSM[-]+4-423005/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000483; sid: 5000483; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Packet denied. [Ingress|Egress] interface is in a backup state"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-424001|%FWSM[-]+4-424001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000484; sid: 5000484; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Connection to the backup interface is denied"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-424002|%FWSM[-]+4-424002/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000485; sid: 5000485; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny traffic, licensed host limit exceeded."; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-450001|%FWSM[-]+4-450001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000486; sid: 5000486; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Received DH key with bad length"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-713240|%FWSM[-]+4-713240/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000487; sid: 5000487; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] META-DATA Unexpected error in Next Card Code mode while not doing SDI"; append_program; content: "%ASA"; pcre: "/%ASA[-]+4-713247/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000488; sid: 5000488; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] META-DATA Received authentication failure message"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-713251|%FWSM[-]+4-713251/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000489; sid: 5000489; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to initialize with Chunk Manager"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720001|%FWSM[-]+4-720001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000490; sid: 5000490; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to allocate chunk from Chunk Manager"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720007|%FWSM[-]+4-720007/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000491; sid: 5000491; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to register to High Availability Framework"; append_program; content: "%ASA"; pcre: "/%ASA[-]+4-720008/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000492; sid: 5000492; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to create version control block"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720009|%FWSM[-]+4-720009/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000493; sid: 5000493; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to allocate memory"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720011|%FWSM[-]+4-720011/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000494; sid: 5000494; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to insert certificate in trust point"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720013|%FWSM[-]+4-720013/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000495; sid: 5000495; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to queue add to message queue"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720033|%FWSM[-]+4-720033/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000496; sid: 5000496; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to send type message id to standby unit"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720043|%FWSM[-]+4-720043/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000497; sid: 5000497; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to receive message from active unit"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720044|%FWSM[-]+4-720044/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000498; sid: 5000498; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to sync SDI node secret file for server on the standby unit"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720047|%FWSM[-]+4-720047/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000499; sid: 5000499; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to add new SDI node secret file for server id on the standby unit"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720051|%FWSM[-]+4-720051/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000500; sid: 5000500; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to delete SDI node secret file for server id on the standby unit"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720052|%FWSM[-]+4-720052/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000501; sid: 5000501; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to add cTCP IKE rule during bulk sync"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720053|%FWSM[-]+4-720053/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000502; sid: 5000502; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to add new cTCP record"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720054|%FWSM[-]+4-720054/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000503; sid: 5000503; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN Stateful failover can only be run in single/non-transparent mode"; append_program; content: "%ASA"; pcre: "/%ASA[-]+4-720055/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000504; sid: 5000504; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update cTCP database"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720064|%FWSM[-]+4-720064/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000505; sid: 5000505; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to add new cTCP IKE rule"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720065|%FWSM[-]+4-720065/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000506; sid: 5000506; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to activate IKE database"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720066|%FWSM[-]+4-720066/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000507; sid: 5000507; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to deactivate IKE database"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720067|%FWSM[-]+4-720067/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000508; sid: 5000508; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to parse peer message"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720068|%FWSM[-]+4-720068/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000509; sid: 5000509; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to activate cTCP database"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720069/"; classtype|%FWSM[-]+4-720069: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000510; sid: 5000510; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to deactivate cTCP database"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720070|%FWSM[-]+4-720070/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000511; sid: 5000511; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Fail to insert certificate in trust point on the standby unit"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-720073|%FWSM[-]+4-720073/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000512; sid: 5000512; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error parsing SVC connect request"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-722001|%FWSM[-]+4-722001; parse_src_ip: 1/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000513; sid: 5000513; rev: 7;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error consolidating SVC connect request."; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-722002|%FWSM[-]+4-722002/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000514; sid: 5000514; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error authenticating SVC connect request"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-722003|%FWSM[-]+4-722003/"; parse_src_ip: 1/"; classtype: unsuccessful-admin; reference: url, wiki.quadrantsec.com/bin/view/Main/5000515; sid: 5000515; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error responding to SVC connect request"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-722004|%FWSM[-]+4-722004/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000516; sid: 5000516; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad SVC frame length length expected"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-722016|%FWSM[-]+4-722016/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000517; sid: 5000517; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad SVC framing 525446, reserved 0"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-722017|%FWSM[-]+4-722017/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000518; sid: 5000518; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad SVC protocol version"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+4-722018|%FWSM[-]+4-722018/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000519; sid: 5000519; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] CRYPTO An attempt to allocate a large memory block failed"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+5-402128|%FWSM[-]+5-402128/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000520; sid: 5000520; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] META-DATA Rekey initiation is being disabled during CRACK authentication"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+5-713248|%FWSM[-]+5-713248/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000521; sid: 5000521; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Integrity Firewall Server is not available. VPN Tunnel creation rejected for client"; append_program; content: "%ASA"; pcre: "/%ASA[-]+5-713252/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000522; sid: 5000522; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Integrity Firewall Server is not available. Entering ALLOW mode. VPN Tunnel created for client"; append_program; content: "%ASA"; pcre: "/%ASA[-]+5-713253/"; classtype: successful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000523; sid: 5000523; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to initialize default timer"; append_program; content: "%ASA"; pcre: "/%ASA[-]+5-720016/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000525; sid: 5000525; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update LB runtime data"; append_program; content: "%ASA"; pcre: "/%ASA[-]+5-720017/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000526; sid: 5000526; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to get a buffer from the underlying core high availability subsystem"; append_program; content: "%ASA"; pcre: "/%ASA[-]+5-720018/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000527; sid: 5000527; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update cTCP statistics"; append_program; content: "%ASA"; pcre: "/%ASA[-]+5-720019/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000528; sid: 5000528; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to send type timer message"; append_program; content: "%ASA"; pcre: "/%ASA[-]+5-720020/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000529; sid: 5000529; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] HA non-block send failed for peer msg. HA error code."; append_program; content: "%ASA"; pcre: "/%ASA[-]+5-720021/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000530; sid: 5000530; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Fail to look up CTCP flow handle"; append_program; content: "%ASA"; pcre: "/%ASA[-]+5-720035/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000531; sid: 5000531; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to process state update message from the active peer"; append_program; content: "%ASA"; pcre: "/%ASA[-]+5-720036/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000532; sid: 5000532; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update cTCP dynamic data"; append_program; content: "%ASA"; pcre: "/%ASA[-]+5-720071/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000533; sid: 5000533; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Timeout waiting for Integrity Firewall Server to become available"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+5-720072|%FWSM[-]+5-720072/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000534; sid: 5000534; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] CRYPTO An attempt to release a DMA memory block failed, location address"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+6-402129|%FWSM[-]+6-402129/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000535; sid: 5000535; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN access DENIED to specified location url"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-716004/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000536; sid: 5000536; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN ACL Parse Error"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-716005/"; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000537; sid: 5000537; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN session not allowed. WebVPN ACL parse error"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-716009/"; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000538; sid: 5000538; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Reboot pending, new sessions disabled. Denied user login"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+6-716040|%FWSM[-]+6-716040/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000539; sid: 5000539; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error adding to ACL"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+6-716050|%FWSM[-]+6-716050/"; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000540; sid: 5000540; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error adding dynamic ACL for user"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+6-716051|%FWSM[-]+6-716051/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000541; sid: 5000541; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Email Proxy feature is disabled on interface"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+6-719010|%FWSM[-]+6-719010/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000542; sid: 5000542; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN authorization failed"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-719019/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000543; sid: 5000543; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN authorization completed successfully"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-719020/"; classtype: successful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000544; sid: 5000544; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN has not been successfully authenticated. Access denied"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-719023/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000545; sid: 5000545; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Email Proxy piggyback auth fail session"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-719024/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000546; sid: 5000546; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Email Proxy DNS name resolution failed for hostname"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-719025/"; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000547; sid: 5000547; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Starting VPN Stateful Failover Subsystem"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-720002/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000548; sid: 5000548; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Initialization of VPN Stateful Failover Component completed successfully"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-720003/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000549; sid: 5000549; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover main thread started"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-720004/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000550; sid: 5000550; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover timer thread started"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-720005/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000551; sid: 5000551; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover sync thread started"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-720006/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000552; sid: 5000552; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover client is being disabled"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-720010/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000553; sid: 5000553; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update IPSec failover runtime data on the standby unit"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-720012/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000554; sid: 5000554; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover client is transitioning to active state"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-720039/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000555; sid: 5000555; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover client is transitioning to standby state"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-720040/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000556; sid: 5000556; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN Stateful failover Message Thread is being disabled"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-720056/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000557; sid: 5000557; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN Stateful failover Timer Thread is disabled"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-720058/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000559; sid: 5000559; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN Stateful failover Sync Thread is disabled."; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-720060/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000561; sid: 5000561; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Global Compression Disabled"; append_program; content: "%ASA"; pcre: "/%ASA[-]+6-722025|%FWSM[-]+6-722025/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000563; sid: 5000563; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Device failed SSL handshake"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+6-725006|%FWSM[-]+6-725006/"; classtype: network-event; parse_src_ip: 1; reference: url, wiki.quadrantsec.com/bin/view/Main/5000564; sid: 5000564; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to inject {TCP|UDP} packet"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-421004|%FWSM[-]+7-421004/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000565; sid: 5000565; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] File access DENIED, filename"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-716021|%FWSM[-]+7-716021/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000566; sid: 5000566; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to browse the network"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-716024|%FWSM[-]+7-716024/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000567; sid: 5000567; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to browse domain domain"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-716025|%FWSM[-]+7-716025/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000568; sid: 5000568; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to browse directory"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-716026|%FWSM[-]+7-716026/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000569; sid: 5000569; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to view file"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-716027|%FWSM[-]+7-716027/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000570; sid: 5000570; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to remove file"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-716028|%FWSM[-]+7-716028/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000571; sid: 5000571; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to rename file"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-716029|%FWSM[-]+7-716029/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000572; sid: 5000572; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to modify file"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-716030|%FWSM[-]+7-716030/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000573; sid: 5000573; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to create file"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-716031|%FWSM[-]+7-716031/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000574; sid: 5000574; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to create folder"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-716032|%FWSM[-]+7-716032/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000575; sid: 5000575; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to remove folder"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-716033|%FWSM[-]+7-716033/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000576; sid: 5000576; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] File Access User failed to login into the server"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-716037|%FWSM[-]+7-716037/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000577; sid: 5000577; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Session Termination"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-722030|%FWSM[-]+7-722030/"; classtype: not-suspicious; reference: url, wiki.quadrantsec.com/bin/view/Main/5000579; sid: 5000579; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Session Termination Out"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-722031|%FWSM[-]+7-722031; parse_src_ip: 1/"; classtype: not-suspicious; reference: url, wiki.quadrantsec.com/bin/view/Main/5000580; sid: 5000580; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN Citrix encountered bad flow control flow"; append_program; content: "%ASA"; pcre: "/%ASA[-]+7-723004/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000581; sid: 5000581; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN Citrix SOCKS errors"; append_program; content: "%ASA"; pcre: "/%ASA[-]+7-723006/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000582; sid: 5000582; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN Citrix receives bad SOCKS socks message length"; append_program; content: "%ASA"; pcre: "/%ASA[-]+7-723011/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000583; sid: 5000583; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN Citrix received bad SOCKS socks message format"; append_program; content: "%ASA"; pcre: "/%ASA[-]+7-723012/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000584; sid: 5000584; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SSL lib error"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+7-725014|%FWSM[-]+7-725014 ; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000585; sid: 5000585; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dynamic DNS Update failed"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+3-331001|%PIX[-]+3-331001|%FWSM[-]+3-331001 ; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000586; sid: 5000586; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Switching to ACTIVE"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+1-104001|%FWSM[-]+1-104001/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000587; sid: 5000587; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to STNDBY [cause string]."; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+1-104002|%FWSM[-]+1-104002/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000588; sid: 5000588; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to FAILED"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+1-104003|%FWSM[-]+1-104003/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000589; sid: 5000589; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to OK."; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+1-104004|%FWSM[-]+1-104004/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000590; sid: 5000590; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] The primary and standby units are switching back and forth as the active unit"; append_program; meta_content: ""%sagan%", %ASA,%FWSM; pcre: "/%ASA[-]+1-105037|%FWSM[-]+1-105037/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000591; sid: 5000591; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed Identification Test"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-218004|%PIX[-]+2-218004|%FWSM[-]+2-218004/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000592; sid: 5000592; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover cable OK"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-101001|%PIX[-]+1-101001/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000595; sid: 5000595; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Bad failover cable"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-101002|%PIX[-]+1-101002/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000596; sid: 5000596; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover cable not connected [this unit]"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-101003|%PIX[-]+1-101003/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000597; sid: 5000597; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover cable not connected [other unit]"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-101004|%PIX[-]+1-101004/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000598; sid: 5000598; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Error reading failover cable status"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-101005|%PIX[-]+1-101005/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000599; sid: 5000599; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Power failure/System reload other side"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-102001|%PIX[-]+1-102001|%FWSM[-]+1-102001/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000600; sid: 5000600; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] No response from other firewall"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-103001|%PIX[-]+1-103001|%FWSM[-]+1-103001/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000601; sid: 5000601; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Other firewall network interface OK"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-103002|%PIX[-]+-1-103002|%FWSM[-]+1-103002/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000602; sid: 5000602; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Other firewall network interface failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-103003|%PIX[-]+1-103003|%FWSM[-]+1-103003/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000603; sid: 5000603; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Other firewall reports this firewall failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-103004|%PIX[-]+1-103004|%FWSM[-]+1-103004/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000604; sid: 5000604; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Other firewall reporting failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-103005|%PIX[-]+1-103005|%FWSM[-]+1-103005/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000605; sid: 5000605; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to ACTIVE"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-104001|%PIX[-]+1-104001|%FWSM[-]+1-104001/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000606; sid: 5000606; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to STNDBY"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-104002|%PIX[-]+1-104002|%FWSM[-]+1-104002/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000607; sid: 5000607; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to FAILED"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-104003|%PIX[-]+1-104003|%FWSM[-]+1-104003/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000608; sid: 5000608; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to OK"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-104004|%PIX[-]+1-104004|%FWSM[-]+1-104004/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000609; sid: 5000609; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Disabling failover"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-105001|%PIX[-]+1-105001|%FWSM[-]+1-105001/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000610; sid: 5000610; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Enabling failover"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-105002|%PIX[-]+1-105002|%FWSM[-]+1-105002/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000611; sid: 5000611; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Lost Failover communications with mate on interface"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-105005|%PIX[-]+1-105005|%FWSM[-]+1-105005/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000612; sid: 5000612; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover cable communication failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-105011|%PIX[-]+1-105011; pcre: "/%PIX[-]+|%ASA[-]+/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000614; sid: 5000614; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [failover_unit] Standby unit failed to sync due to a locked config"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-105021|%PIX[-]+1-105021|%FWSM[-]+1-105021/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000615; sid: 5000615; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failover LAN interface is up"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-105031|%PIX[-]+1-105031/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000616; sid: 5000616; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LAN Failover interface is down"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-105032|%PIX[-]+1-105032/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000617; sid: 5000617; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Receive a LAN_FAILOVER_UP message from peer"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-105034|%PIX[-]+1-105034/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000618; sid: 5000618; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Receive a LAN failover interface down msg from peer"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-105035|%PIX[-]+1-105035/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000619; sid: 5000619; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] dropped a LAN Failover command message"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-105036|%PIX[-]+1-105036/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000620; sid: 5000620; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Unable to verify the Interface count with mate. Failover may be disabled in mate"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-105039|%PIX[-]+1-105039/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000621; sid: 5000621; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Mate failover version is not compatible"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-105040|%PIX[-]+1-105040/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000622; sid: 5000622; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover interface OK"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-105042|%PIX[-]+1-105042/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000623; sid: 5000623; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover interface failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-105043|%PIX[-]+1-105043/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000624; sid: 5000624; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny protocol reverse path check"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+1-106021|%PIX[-]+1-106021|%FWSM[-]+1-106021/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000625; sid: 5000625; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny protocol connection spoof"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-106022|%PIX[-]+1-106022|%FWSM[-]+1-106022/"; classtype: suspicious-traffic; reference: url, wiki.quadrantsec.com/bin/view/Main/5000626; sid: 5000626; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] The number of ACL log deny-flows has reached limit"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-106101|%PIX[-]+1-106101|%FWSM[-]+1-106101/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000627; sid: 5000627; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RIP auth failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-107001|%PIX[-]+1-107001|%FWSM[-]+1-107001/"; classtype: unsuccessful-admin; reference: url, wiki.quadrantsec.com/bin/view/Main/5000628; sid: 5000628; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RIP pkt failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+1-107002|%PIX[-]+1-107002|%FWSM[-]+1-107002/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000629; sid: 5000629; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Inbound TCP connection denied"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-106001|%PIX[-]+2-106001|%FWSM[-]+2-106001; default_proto: tcp; classtype: suspicious-traffic; reference: url, wiki.quadrantsec.com/bin/view/Main/5000631; sid: 5000631; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Connection denied by outbound ACL"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-106002|%PIX[-]+2-106002|%FWSM[-]+2-106002/"; classtype: suspicious-traffic; reference: url, wiki.quadrantsec.com/bin/view/Main/5000632; sid: 5000632; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny inbound UDP"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-106006|%PIX[-]+2-106006|%FWSM[-]+2-106006; default_proto: udp; classtype: suspicious-traffic; normalize; reference: url, wiki.quadrantsec.com/bin/view/Main/5000633; sid: 5000633; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny inbound UDP from outside due to DNS {Response|Query}"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-106007|%PIX[-]+2-106007|%FWSM[-]+2-106007; default_proto: udp; default_dst_port: $DNS_PORT; classtype: suspicious-traffic; reference: url, wiki.quadrantsec.com/bin/view/Main/5000634; sid: 5000634; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping echo request"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-106013|%PIX[-]+2-106013|%FWSM[-]+2-106013; default_proto: icmp; classtype: suspicious-traffic; reference: url, wiki.quadrantsec.com/bin/view/Main/5000635; sid: 5000635; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny IP spoof [0/1]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-106016|%PIX[-]+2-106016|%FWSM[-]+2-106016/"; classtype: suspicious-traffic; threshold: type suppress, track by_src, count 1, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5000636; sid: 5000636; rev: 9;)
# Land attacks (1997) are typically cause by configurations and are noisy. This rule has been disabled by default
# Champ Clark - 2017/05/25
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny IP due to Land Attack [0/1]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-106017|%PIX[-]+2-106017|%FWSM[-]+2-106017; default_proto: tcp; classtype: suspicious-traffic; threshold: type suppress, track by_src, count 1, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5000637; sid: 5000637; rev: 7;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ICMP denied by outbound ACL"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-106018|%PIX[-]+2-106018|%FWSM[-]+2-106018; default_proto: icmp; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000638; sid: 5000638; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny IP teardrop fragment [0/1]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-106020|%PIX[-]+2-106020|%FWSM[-]+2-106020/"; classtype: network-event; threshold: type suppress, track by_src, count 1, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5000639; parse_src_ip: 1; sid: 5000639; rev: 8;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad route_compress"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-215001|%PIX[-]+2-215001|%FWSM[-]+2-215001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000640; sid: 5000640; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed Identification Test in slot"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-218001|%PIX[-]+2-218001|%FWSM[-]+2-218001/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000641; sid: 5000641; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropped DNS responses with mis-matched id"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-410002|%PIX[-]+2-410002|%FWSM[-]+2-410002/"; default_proto: udp; default_dst_port: $DNS_PORT; classtype: suspicious-traffic; reference: url, wiki.quadrantsec.com/bin/view/Main/5000642; sid: 5000642; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Configuration replication failed for command"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-709007|%PIX[-]+2-709007|%FWSM[-]+2-709007/"; classtype: configuration-error ; reference: url, wiki.quadrantsec.com/bin/view/Main/5000643; sid: 5000643; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unexpected event"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+2-717011|%PIX[-]+2-717011|%FWSM[-]+2-717011/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000644; sid: 5000644; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover message block alloc failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-105010|%PIX[-]+3-105010|%FWSM[-]+3-105010/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000645; sid: 5000645; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny inbound protocol"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-106010|%PIX[-]+3-106010|%FWSM[-]+3-106010/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000646; sid: 5000646; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny inbound [No xlate]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-106011|%PIX[-]+3-106011|%FWSM[-]+3-106011/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000647; sid: 5000647; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny inbound ICMP"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-106014|%PIX[-]+3-106014|%FWSM[-]+3-106014; default_proto: icmp; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000648; sid: 5000648; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auth from inside to outside failed [too many pending auths]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-109010|%PIX[-]+3-109010|%FWSM[-]+3-109010/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000649; sid: 5000649; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Can't find authorization ACL for user"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-109016|%PIX[-]+3-109016|%FWSM[-]+3-109016/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000650; sid: 5000650; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Downloaded ACL has parsing error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-109019|%PIX[-]+3-109019|%FWSM[-]+3-109019/"; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000651; sid: 5000651; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Downloaded ACL has config error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-109020|%PIX[-]+3-109020|%FWSM[-]+3-109020/"; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000652; sid: 5000652; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to install ACL, downloaded for user"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-109032|%PIX[-]+3-109032|%FWSM[-]+3-109032/"; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000653; sid: 5000653; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Kerberos error. Clock skew with server greater than 300 seconds"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-113020|%PIX[-]+3-113020|%FWSM[-]+3-109020/"; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000654; sid: 5000654; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] FTP data connection failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-201005|%PIX[-]+3-201005|%FWSM[-]+3-201005; default_proto: tcp; default_dst_port: $FTP_PORT; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000655; sid: 5000655; rev: 6;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RCMD backconnection failed "; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-201006|%PIX[-]+3-201006|%FWSM[-]+3-201006/"; default_proto: tcp; default_dst_port: 514/"; classtype: suspicious-traffic; reference: url, wiki.quadrantsec.com/bin/view/Main/5000656; sid: 5000656; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU sw_module_name error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-210001|%PIX[-]+3-210001|%FWSM[-]+3-210001/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000657; sid: 5000657; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU allocate block [bytes] failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-210002|%PIX[-]+3-210002|%FWSM[-]+3-210002/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000658; sid: 5000658; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU allocate connection failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-210005|%PIX[-]+3-210005|%FWSM[-]+3-210005/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000659; sid: 5000659; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU look NAT failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-210006|%PIX[-]+3-210006|%FWSM[-]+3-210006/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000660; sid: 5000660; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU allocate xlate failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-210007|%PIX[-]+3-210007|%FWSM[-]+3-210007/"; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000661; sid: 5000661; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU make UDP connection for outside to inside failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-210010|%PIX[-]+3-210010|%FWSM[-]+3-210010/"; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000662; sid: 5000662; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU PAT port reserve failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-210020|%PIX[-]+3-210020|%FWSM[-]+3-210020/"; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000663; sid: 5000663; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU create static xlate interface failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-210021|%PIX[-]+3-210021|%FWSM[-]+3-210021/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000664; sid: 5000664; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Memory allocation Error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-211001|%PIX[-]+3-211001|%FWSM[-]+3-211001/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000665; sid: 5000665; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to open SNMP channel"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-212001|%PIX[-]+3-212001|%FWSM[-]+3-212001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000666; sid: 5000666; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to open SNMP trap channel"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-212002|%PIX[-]+3-212002|%FWSM[-]+3-212002/"; classtype: system-errorn; reference: url, wiki.quadrantsec.com/bin/view/Main/5000667; sid: 5000667; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to receive an SNMP request on interface"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-212003|%PIX[-]+3-212003|%FWSM[-]+3-212003; default_proto: udp; default_dst_port: $SNMP_PORT; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000668; sid: 5000668; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to send an SNMP response"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-212004|%PIX[-]+3-212004|%FWSM[-]+3-212004; default_proto: udp; default_dst_port: $SNMP_PORT; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000669; sid: 5000669; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping SNMP request"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-212006|%PIX[-]+3-212006|%FWSM[-]+3-212006; default_proto: udp; default_dst_port: $SNMP_PORT; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000670; sid: 5000670; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPTP tunnel hashtable insert failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-213002|%PIX[-]+3-213002|%FWSM[-]+3-213002/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000671; sid: 5000671; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPP virtual interface client ip allocation failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-213004|%PIX[-]+3-213004|%FWSM[-]+3-213004/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000672; sid: 5000672; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] H.323 library_name ASN Library failed to initialize"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-302019|%PIX[-]+3-302019|%FWSM[-]+3-302019/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000673; sid: 5000673; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ACL = deny no sa created"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-302302|%PIX[-]+3-302302|%FWSM[-]+3-302302/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000674; sid: 5000674; rev: 6;)
# Disabled on 04/12/2014 - Considered to noisy & of little value (Champ Clark III)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {outbound static|identity|portmap|regular] translation creation failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-305006|%PIX[-]+3-305006|%FWSM[-]+3-305006/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000675; sid: 5000675; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Denied ICMP"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-313001|%PIX[-]+3-313001|%FWSM[-]+3-313001; default_proto: icmp; classtype: network-event; normalize; reference: url, wiki.quadrantsec.com/bin/view/Main/5000676; sid: 5000676; rev: 7;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Denied ICMPv6"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-313008|%PIX[-]+3-313008|%FWSM[-]+3-313008; default_proto: icmp; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000677; sid: 5000677; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to establish SSH session because RSA host key retrieval failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-315004|%PIX[-]+3-315004|%FWSM[-]+3-315004/"; default_proto: tcp; default_dst_port: $SSH_PORT; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000678; sid: 5000678; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Denied new tunnel limit exceeded"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-316001|%PIX[-]+3-316001|%FWSM[-]+3-316001/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000679; sid: 5000679; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IP routing table creation failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-317003|%PIX[-]+3-317003|%FWSM[-]+3-317003/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000681; sid: 5000681; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-318001|%PIX[-]+3-318001|%FWSM[-]+3-318001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000682; sid: 5000682; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Arp update for IP address address to NPn failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-319003|%PIX[-]+3-319003|%FWSM[-]+3-319003/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000683; sid: 5000683; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Route update for IP address failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-319004|%PIX[-]+3-319004|%FWSM[-]+3-319004/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000684; sid: 5000684; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny MAC address possible spoof attempt"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-322001|%PIX[-]+3-322001|%FWSM[-]+3-322001/"; classtype: suspicious-traffic; reference: url, wiki.quadrantsec.com/bin/view/Main/5000685; sid: 5000685; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ARP inspection check failed [1]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-322002|%PIX[-]+3-322002|%FWSM[-]+3-322002/"; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000686; sid: 5000686; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ARP inspection check failed [2]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-322003|%PIX[-]+3-322003|%FWSM[-]+3-322003/"; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000687; sid: 5000687; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] GSN tunnel limit exceeded"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-324006|%PIX[-]+3-324006|%FWSM[-]+3-324006/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000690; sid: 5000690; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Radius Accounting Request has a bad header length"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-324301|%PIX[-]+3-324301|%FWSM[-]+3-324301/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000691; sid: 5000691; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unexpected error in the timer library"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326001|%PIX[-]+3-326001|%FWSM[-]+3-326001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000692; sid: 5000692; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326002|%PIX[-]+3-326002|%FWSM[-]+3-326002/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000693; sid: 5000693; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] An internal error occurred while processing a packet queue"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326004|%PIX[-]+3-326004|%FWSM[-]+3-326004/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000694; sid: 5000694; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Mrib notification failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326005|%PIX[-]+3-326005|%FWSM[-]+3-326005/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000695; sid: 5000695; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Entry-creation failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326006|%PIX[-]+3-326006|%FWSM[-]+3-326006/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000696; sid: 5000696; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Entry-update failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326007|%PIX[-]+3-326007|%FWSM[-]+3-326007/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000697; sid: 5000697; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] MRIB registration failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326008|%PIX[-]+3-326008|%FWSM[-]+3-326008/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000698; sid: 5000698; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] MRIB connection-open failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326009|%PIX[-]+3-326009|%FWSM[-]+3-326009/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000699; sid: 5000699; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] MRIB unbind failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326010|%PIX[-]+3-326010|%FWSM[-]+3-326010/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000700; sid: 5000700; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] MRIB table deletion failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326011|%PIX[-]+3-326011|%FWSM[-]+3-326011/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000701; sid: 5000701; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Initialization of string functionality failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326012|%PIX[-]+3-326012|%FWSM[-]+3-326012/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000702; sid: 5000702; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326013|%PIX[-]+3-326013|%FWSM[-]+3-326013/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000703; sid: 5000703; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Initialization failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326014|%PIX[-]+3-326014|%FWSM[-]+3-326014/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000704; sid: 5000704; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Communication error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326015|%PIX[-]+3-326015|%FWSM[-]+3-326015/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000705; sid: 5000705; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set un-numbered interface"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326016|%PIX[-]+3-326016|%FWSM[-]+3-326016/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000706; sid: 5000706; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Interface Manager error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326017|%PIX[-]+3-326017|%FWSM[-]+3-326017/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000707; sid: 5000707; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] List error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326020|%PIX[-]+3-326020|%FWSM[-]+3-326020/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000708; sid: 5000708; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326021|%PIX[-]+3-326021|%FWSM[-]+3-326021/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000709; sid: 5000709; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326022|%PIX[-]+3-326022|%FWSM[-]+3-326022/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000710; sid: 5000710; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] An internal error occurred while processing a packet queue"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326024|%PIX[-]+3-326024|%FWSM[-]+3-326024/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000711; sid: 5000711; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Server unexpected error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326026|%PIX[-]+3-326026|%FWSM[-]+3-326026/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000712; sid: 5000712; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Corrupted update"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326027|%PIX[-]+3-326027|%FWSM[-]+3-326027/"; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000713; sid: 5000713; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Asynchronous error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-326028|%PIX[-]+3-326028|%FWSM[-]+3-326028/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000714; sid: 5000714; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IP SLA Monitor Failed to initialize, will not work"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-327002|%PIX[-]+3-327002|%FWSM[-]+3-327002/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000715; sid: 5000715; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IP SLA Monitor Generic Timer wheel timer functionality failed to initialize"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-327003|%PIX[-]+3-327003|%FWSM[-]+3-327003/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000716; sid: 5000716; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPPoE - Bad host-unique in PADO - packet dropped"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-403501|%PIX[-]+3-403501|%FWSM[-]+3-403501/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000717; sid: 5000717; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPPoE - Bad host-unique in PADS - dropping packet"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-403502|%PIX[-]+3-403502|%FWSM[-]+3-403502/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000718; sid: 5000718; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPPoEPPPoE client on interface failed to locate PPPoE vpdn group"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-403507|%PIX[-]+3-403507|%FWSM[-]+3-403507/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000719; sid: 5000719; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to save logging buffer using filename to FTP server"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-414001|%PIX[-]+3-414001|%FWSM[-]+3-414001; default_proto: tcp; default_dst_port: $FTP_PORT; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000720; sid: 5000720; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to save logging buffer to flash or syslog directory using file name filename"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-414002|%PIX[-]+3-414002|%FWSM[-]+3-414002/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000721; sid: 5000721; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NTP daemon Packet denied"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-610001|%PIX[-]+3-610001/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000722; sid: 5000722; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NTP daemon Authentication failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-610002|%PIX[-]+3-610002|%FWSM[-]+3-610002/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000723; sid: 5000723; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient Backup Server List Error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-611313|%PIX[-]+3-611313/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000724; sid: 5000724; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error processing payload"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-713048|%PIX[-]+3-713048|%FWSM[-]+3-713048; parse_src_ip: 1; parse_dst_ip: 2/"; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000725; sid: 5000725; rev: 7;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Tunnel Rejected User matched with group name, check failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713059|%PIX[-]+3-713059/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000726; sid: 5000726; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Tunnel Rejected User not member of group, check failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713060|%PIX[-]+3-713060/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000727; sid: 5000727; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to retrieve identity certificate"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713082|%PIX[-]+3-713082/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000728; sid: 5000728; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Set Cert filehandle failure no IPSec SA in group"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713088|%PIX[-]+3-713088/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000729; sid: 5000729; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Request attempt failed!"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713107|%PIX[-]+3-713107/"; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000730; sid: 5000730; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to process CONNECTED notify!"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713112|%PIX[-]+3-713112/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000731; sid: 5000731; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Client-reported firewall does not match configured firewall action tunnel"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713141|%PIX[-]+3-713141/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000732; sid: 5000732; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Client did not report firewall in use, but there is a configured firewall action tunnel"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713142|%PIX[-]+-3-713142/"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000733; sid: 5000733; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] TCP Connection to Firewall Server has been lost, restricted tunnels are now allowed full network access"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713159|%PIX[-]+3-713159/"; default_proto: tcp; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000734; sid: 5000734; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote user network access has been restricted by the Firewall Server"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713161|%PIX[-]+3-713161/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000735; sid: 5000735; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote user has been rejected by the Firewall Server"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713162|%PIX[-]+3-713162/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000736; sid: 5000736; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote user has been terminated by the Firewall Server"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713163|%PIX[-]+3-713163/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000737; sid: 5000737; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Headend security gateway has failed our user authentication attempt - check configured username and password"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713166|%PIX[-]+3-713166/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000738; sid: 5000738; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote peer has failed user authentication - check configured username and password [10/5]"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713167|%PIX[-]+3-713167/"; after: track by_src, count 10, seconds 300; threshold: type suppress, track by_src, count 5, seconds 300; parse_src_ip: 1/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000739; sid: 5000739; rev: 7;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error Username too long - connection aborted"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713185|%PIX[-]+3-713185/"; classtype: attempted-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000740; sid: 5000740; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] User Authorization failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-713198|%PIX[-]+3-713198|%FWSM[-]+3-713198/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000741; sid: 5000741; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IKE Receiver Error reading from socket"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713203|%PIX[-]+3-713203/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000742; sid: 5000742; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Connection failed with peer, no trust-point defined"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-713226|%PIX[-]+3-713226/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000743; sid: 5000743; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal Error, ike_lock trying to lock bit that is already locked"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-713230|%PIX[-]+3-713230|%FWSM[-]+3-713230; parse_src_ip: 1; parse_dst_ip: 2/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000744; sid: 5000744; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal Error, ike_lock trying to unlock bit that is not locked"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+3-713231|%PIX[-]+3-713231|%FWSM[-]+3-713231; parse_src_ip: 1; parse_dst_ip: 2/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000745; sid: 5000745; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Querying keypair failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-717001|%PIX[-]+3-717001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000746; sid: 5000746; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Certificate enrollment failed for trustpoint"; append_program; pcre: "/%ASA[-]+3-717002|%PIX[-]+3-717002/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000747; sid: 5000747; rev: 3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Certificate validation failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-717009|%PIX[-]+3-717009/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000748; sid: 5000748; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] CRL polling failed for trustpoint"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-717010|%PIX[-]+3-717010/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000749; sid: 5000749; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to refresh CRL cache entry from the server for trustpoint"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-717012|%PIX[-]+3-717012/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000750; sid: 5000750; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to query CA certificate for trustpoint"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-717017|%PIX[-]+3-717017/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000751; sid: 5000751; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to insert CRL for trustpoint"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-717019|%PIX[-]+3-717019/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000752; sid: 5000752; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SSL failed to set device certificate for trustpoint"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-717023|%PIX[-]+3-717023/"; classtype: sytem-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000753; sid: 5000753; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Certificate chain failed validation"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+3-717027|%PIX[-]+3-717027/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000754; sid: 5000754; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny protocol"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+4-106023|%PIX[-]+4-106023|%FWSM[-]+4-106023/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000755; sid: 5000755; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to determine the security context for the packetvlansource Vlan"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-106027|%PIX[-]+4-106027|%FWSM[-]+4-106027/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000756; sid: 5000756; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NT Domain Authentication Failed rejecting guest login for username."; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-109031|%PIX[-]+4-109031|%FWSM[-]+4-109031/"; classtype: misc-attack; reference: url, wiki.quadrantsec.com/bin/view/Main/5000757; sid: 5000757; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authentication failed for admin user"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-109033|%PIX[-]+4-109033|%FWSM[-]+4-109033/"; classtype: unsuccessful-admin; reference: url, wiki.quadrantsec.com/bin/view/Main/5000758; sid: 5000758; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authentication failed for network user"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-109034|%PIX[-]+4-109034|%FWSM[-]+4-109034/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000759; sid: 5000759; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Denied ICMP"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-313004|%PIX[-]+4-313004|%FWSM[-]+4-313004; default_proto: icmp; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000760; sid: 5000760; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] No matching connection for ICMP error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-313005|%PIX[-]+4-313005|%FWSM[-]+4-313005; default_proto: icmp; classtype: network-event; parse_src_ip: 1; reference: url, wiki.quadrantsec.com/bin/view/Main/5000761; sid: 5000761; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NAC Downloaded ACL parse failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-335005|%PIX[-]+4-335005|%FWSM[-]+4-335005/"; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000762; sid: 5000762; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Shun add failed unable to allocate resources"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-401005|%PIX[-]+4-401005|%FWSM[-]+4-401005/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000763; sid: 5000763; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPSEC Received an protocol packet from remote IP to local IP that failed anti-replay checking [0/5]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-402119|%PIX[-]+4-402119|%FWSM[-]+4-402119; threshold: type suppress, track by_src, count 5, seconds 300; parse_src_ip: 1; parse_dst_ip: 2/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000764; sid: 5000764; rev: 7;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPSEC Received an ESP packet from remote IP to local IP that failed authentication [0/5]"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+4-402120|%PIX[-]+4-402120/"; classtype: unsuccessful-user; threshold: type suppress, track by_src, count 5, seconds 300; parse_src_ip: 1; parse_dst_ip: 3; reference: url, wiki.quadrantsec.com/bin/view/Main/5000765; sid: 5000765; rev: 9;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] CRYPTO The hardware accelerator encountered an error while executing crypto command"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-402123|%PIX[-]+4-402123|%FWSM[-]+4-402123/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000766; sid: 5000766; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPPoE failed to assign PPP IP address"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-403506|%PIX[-]+4-403506|%FWSM[-]+4-403506/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000767; sid: 5000767; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ISAKMP Failed to allocate address for client from pool string"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-404101|%PIX[-]+4-404101|%FWSM[-]+4-404101; default_proto: udp; default_dst_port: 500/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000768; sid: 5000768; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] H225 message contains bad protocol discriminator hex"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-405103|%PIX[-]+4-405103|%FWSM[-]+4-405103/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000769; sid: 5000769; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny traffic for local-host, license limit of number exceeded"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-407001|%PIX[-]+4-407001|%FWSM[-]+4-407001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000770; sid: 5000770; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropped UDP SNMP packet"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-416001|%PIX[-]+4-416001|%FWSM[-]+4-416001; default_proto: udp; default_dst_port: $SNMP_PORT; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000771; sid: 5000771; rev: 7;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Filter violation error conn number"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-417004|%PIX[-]+4-417004|%FWSM[-]+4-417004/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000772; sid: 5000772; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Through-the-device packet to/from management-only network is denied"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-418001|%PIX[-]+4-418001|%FWSM[-]+4-418001/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000773; sid: 5000773; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping TCP packet, MSS exceeded/size - possible network scan."; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-419001|%PIX[-]+4-419001|%FWSM[-]+4-419001/"; parse_src_ip: 1; parse_dst_ip: 2; default_proto: tcp; classtype: network-scan; reference: url, wiki.quadrantsec.com/bin/view/Main/5000774; sid: 5000774; rev: 7;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RTP conformance Dropping RTP packet"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-431001|%PIX[-]+4-431001|%FWSM[-]+4-431001/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000775; sid: 5000775; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RTCP conformance Dropping RTCP packet"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-431002|%PIX[-]+4-431002|%FWSM[-]+4-431002/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000776; sid: 5000776; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping Skinny message length value too small"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-608002|%PIX[-]+4-608002|%FWSM[-]+4-608002/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000777; sid: 5000777; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping Skinny message length value too large"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-608003|%PIX[-]+4-608003|%FWSM[-]+4-608003/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000778; sid: 5000778; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping Skinny message id value not allowed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-608004|%PIX[-]+4-608004|%FWSM[-]+4-608004/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000779; sid: 5000779; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping Skinny message id value registration not complete"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-608005|%PIX[-]+4-608005|%FWSM[-]+4-608005/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000780; sid: 5000780; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auto Update failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-612002|%PIX[-]+4-612002|%FWSM[-]+4-612002/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000781; sid: 5000781; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auto Update failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-612003|%PIX[-]+4-612003|%FWSM[-]+4-612003/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000782; sid: 5000782; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] DNS lookup for Server failed!"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-713154|%PIX[-]+4-713154|%FWSM[-]+4-713154; default_proto: udp; default_dst_port: $DNS_PORT; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000783; sid: 5000783; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Name lookup failed for hostname during PKI operation"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-717026|%PIX[-]+4-717026|%FWSM[-]+4-717026/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000784; sid: 5000784; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to find a suitable trustpoint for issuer"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+4-717031|%PIX[-]+4-717031|%FWSM[-]+4-717031/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000785; sid: 5000785; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Tunnel group search using certificate maps failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+4-717037|%PIX[-]+4-717037/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000786; sid: 5000786; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IP address end configuration {FAILED|OK}"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-111004|%PIX[-]+5-111004|%FWSM[-]+5-111004/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000787; sid: 5000787; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] FTP cmd_string command unsupported - failed strict inspection"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-303004|%PIX[-]+5-303004|%FWSM[-]+5-303004/"; default_proto: tcp; default_dst_port: $FTP_PORT; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000788; sid: 5000788; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Access denied URL chars"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-304002|%PIX[-]+5-304002|%FWSM[-]+5-304002; content: "http://"; default_proto: tcp; default_dst_port: $HTTP_PORT; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000789; sid: 5000789; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Asymmetric NAT rules matched for forward and reverse flows [0/1]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-305013|%PIX[-]+5-305013|%FWSM[-]+5-305013; threshold: type suppress, track by_src, count 1, seconds 900/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000790; sid: 5000790; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] EAPoUDP association failed to establish"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-334003|%PIX[-]+5-334003|%FWSM[-]+5-334003/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000791; sid: 5000791; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] EAPoUDP failed to get a response from host"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-334006|%PIX[-]+5-334006|%FWSM[-]+5-334006/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000792; sid: 5000792; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] HTTP - matched string in policy-map verification failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-415004|%PIX[-]+5-415004|%FWSM[-]+5-415004/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000793; sid: 5000793; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad TCP hdr length - Possible network scan"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-500003|%PIX[-]+5-500003|%FWSM[-]+5-500003/"; parse_src_ip: 1; parse_dst_ip: 2; default_proto: tcp; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000794; sid: 5000794; rev: 7;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IKE area failed to find centry for message"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-713010|%PIX[-]+5-713010/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000796; sid: 5000796; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failure during phase 1 rekeying attempt due to collision"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-713092|%PIX[-]+5-713092; parse_src_ip: 1/"; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000797; sid: 5000797; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Ignoring received malformed firewall record"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-713144|%PIX[-]+5-713144|%FWSM[-]+5-713144/"; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000798; sid: 5000798; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Create peer failure, already at maximum of number of peers"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-718002|%PIX[-]+5-718002/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000800; sid: 5000800; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to send to IP"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-718005|%PIX[-]+5-718005|%FWSM[-]+5-718005/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000801; sid: 5000801; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Socket open failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-718007|%PIX[-]+5-718007|%FWSM[-]+5-718007/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000802; sid: 5000802; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Socket bind failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-718008|%PIX[-]+5-718008|%FWSM[-]+5-718008/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000803; sid: 5000803; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send HELLO response failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-718009|%PIX[-]+5-718008|%FWSM[-]+5-718008/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000804; sid: 5000804; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send HELLO request failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-718011|%PIX[-]+5-718011|%FWSM[-]+5-718011/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000805; sid: 5000805; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send CFG UPDATE failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-718024|%PIX[-]+5-718024|%FWSM[-]+5-718024/"; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000806; sid: 5000806; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send OOS indicator failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-718028|%PIX[-]+5-718028|%FWSM[-]+5-718028/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000807; sid: 5000807; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send TOPOLOGY indicator failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-718033|%PIX[-]+5-718033|%FWSM[-]+5-718033/"; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000808; sid: 5000808; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Create of secure tunnel failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-718048|%PIX[-]+5-718048/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000809; sid: 5000809; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Delete of secure tunnel failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-718050|%PIX[-]+5-718050/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000810; sid: 5000810; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Queue send failure from ISR"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-718057|%PIX[-]+5-718057/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000811; sid: 5000811; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Inbound socket select fail"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSMpcre: "/%ASA[-]+5-718060|%PIX[-]+5-718060|%FWSM[-]+5-718060/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000812; sid: 5000812; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Inbound socket read fail"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-718061|%PIX[-]+5-718061|%FWSM[-]+5-718061/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000813; sid: 5000813; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Cannot continue to run"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-718065|%PIX[-]+5-718065|%FWSM[-]+5-718065/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000814; sid: 5000814; rev: 6;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create access list for peer"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-718074|%PIX[-]+5-718074|%FWSM[-]+5-718074/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000815; sid: 5000815; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create tunnel group for peer"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-718076|%PIX[-]+5-718076/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000816; sid: 5000816; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to delete tunnel group for peer"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-718077|%PIX[-]+5-718077/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000817; sid: 5000817; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create crypto map for peer"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-718078|%PIX[-]+5-718078/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000818; sid: 5000818; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to delete crypto map for peer"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-718079|%PIX[-]+5-718079/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000819; sid: 5000819; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create crypto policy for peer"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-718080|%PIX[-]+5-718080/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000820; sid: 5000820; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to delete crypto policy for peer"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-718081|%PIX[-]+5-718081/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000821; sid: 5000821; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to install LB NP rules"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-718086|%PIX[-]+5-718086/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000822; sid: 5000822; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to delete LB NP rules"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+5-718087|%PIX[-]+5-718087/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000823; sid: 5000823; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny IP [0/5]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-106012|%PIX[-]+6-106012|%FWSM[-]+6-106012/"; classtype: network-event; threshold: type suppress, track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5000824; sid: 5000824; rev: 7;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny TCP [no connection]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-106015|%PIX[-]+6-106015|%FWSM[-]+6-106015; normalize; default_proto: tcp; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000825; sid: 5000825; rev: 7;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to determine the security context"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-106025|%PIX[-]+6-106025|%FWSM[-]+6-106025/"; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000826; sid: 5000826; rev: 7;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to determine the security context"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-106026|%PIX[-]+6-106026|%FWSM[-]+6-106026/"; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000827; sid: 5000827; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] access-list ACL {permitted | denied | est-allowed} protocol"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-106100|%PIX[-]+6-106100|%FWSM[-]+6-106100/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000828; sid: 5000828; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auth from inside to outside failed [server failed] on interface"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-109002|%PIX[-]+6-109002|%FWSM[-]+6-109002/"; parse_src_ip: 1; parse_dst_ip: 2/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000829; sid: 5000829; rev: 6;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auth from inside to outside failed [all servers failed] on interface"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-109003|%PIX[-]+6-109003|%FWSM[-]+6-109002/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000830; sid: 5000830; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authentication failed for user [0/5]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-109006|%PIX[-]+6-109006|%FWSM[-]+6-109006/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000831; threshold: type suppress, track by_src, count 5, seconds 300; sid: 5000831; rev: 7;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization permitted for user"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-109007|%PIX[-]+6-109007|%FWSM[-]+6-109007/"; classtype: successful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000832; sid: 5000832; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization denied for user from outside to inside on interface"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-109008|%PIX[-]+6-109008|%FWSM[-]+6-109008/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000833; sid: 5000833; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization denied [not authenticated]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-109024|%PIX[-]+6-109024|%FWSM[-]+6-109024/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000834; sid: 5000834; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization denied for user"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-109025|%PIX[-]+6-109025|%FWSM[-]+6-109025/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000835; sid: 5000835; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] User user locked out on exceeding number successive failed authentication attempts"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-113006|%PIX[-]+6-113006|%FWSM[-]+6-113006/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000836; sid: 5000836; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] AAA unable to complete the request"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-113013|%PIX[-]+6-113013|%FWSM[-]+6-113013/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000837; sid: 5000837; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] URL Server request failed URL"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-304004|%PIX[-]+6-304004|%FWSM[-]+6-304004/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000838; sid: 5000838; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RIP hdr failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-312001|%PIX[-]+6-312001|%FWSM[-]+6-312001/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000839; sid: 5000839; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] No management IP address configured for transparent firewall"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-322004|%PIX[-]+6-322004|%FWSM[-]+6-322004/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000840; sid: 5000840; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NAC is disabled for host"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-335004|%PIX[-]+6-335004|%FWSM[-]+6-335004/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000841; sid: 5000841; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Login denied [Brute Force] [10/1]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-605004|%PIX[-]+6-605004|%FWSM[-]+6-605004/"; parse_src_ip: 1; parse_port; after: track by_src, count 10, seconds 300; threshold: type suppress, track by_src, count 1, seconds 86400/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000842; xbits: set,brute_force,track ip_src,expire 21600; sid: 5000842; rev: 12;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-610101|%PIX[-]+6-610101|%FWSM[-]+6-610101/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000843; sid: 5000843; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] User authentication failed [0/5]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-611102|%PIX[-]+6-611102|%FWSM[-]+6-610102/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000844; threshold: type suppress, track by_src, count 5, seconds 300; sid: 5000844; rev: 7;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VNPClient XAUTH Failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+6-611311|%PIX[-]+6-611311/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000845; sid: 5000845; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient Secure Unit Authentication Disabled"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+6-611317|%PIX[-]+6-611317/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000846; sid: 5000846; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient User Authentication Disabled"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+6-611319|%PIX[-]+6-611319/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000847; sid: 5000847; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient Device Pass Thru Disabled"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+6-611321|%PIX[-]+6-611321/"; classtype: system-eventn; reference: url, wiki.quadrantsec.com/bin/view/Main/5000848; sid: 5000848; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient Extended XAUTH conversation initiated when SUA disabled"; append_program; meta_content: ""%sagan%", %ASA,%PIX; pcre: "/%ASA[-]+6-611322|%PIX[-]+6-611322/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000849; sid: 5000849; rev: 4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Checksum Failure in database"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-613001|%PIX[-]+6-613001|%FWSM[-]+6-613001/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000850; sid: 5000850; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] vlan number not available for firewall interface"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-615001|%PIX[-]+6-615001|%FWSM[-]+6-615001/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000851; sid: 5000851; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] vlan number available for firewall interface"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-615002|%PIX[-]+6-615002|%FWSM[-]+6-615002/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000852; sid: 5000852; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad register"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-621007|%PIX[-]+6-621007|%FWSM[-]+6-621007/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000853; sid: 5000853; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Attempt to send an IKE packet from standby unit. Dropping the packet! [0/1]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-713235|%PIX[-]+6-713235|%FWSM[-]+6-713235; type limit, track by_src, count 1, seconds 900/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000854; sid: 5000854; rev: 7;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Certificate received from Certificate Authority for trustpoint"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-717003|%PIX[-]+6-717003|%FWSM[-]+6-717003/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000855; sid: 5000855; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PKCS 12 export failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-717004|%PIX[-]+6-717004|%FWSM[-]+6-717004/"; classtype: system-event reference: url, wiki.quadrantsec.com/bin/view/Main/5000856; sid: 5000856; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PKCS 12 import failed"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-717006|%PIX[-]+6-717006|%FWSM[-]+6-717006/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000857; sid: 5000857; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] uauth_lookup_net fail for uauth_in"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-109014|%PIX[-]+7-109014|%FWSM[-]+7-109014/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000858; sid: 5000858; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Uauth null proxy error"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-109021|%PIX[-]+7-109021|%FWSM[-]+7-109021/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000859; sid: 5000859; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-713039|%PIX[-]+7-713039|%FWSM[-]+7-713039/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000861; sid: 5000861; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Cert validation failure handle invalid for Main/Aggressive Mode Initiator/Responder!"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-713094|%PIX[-]+7-713094|%FWSM[-]+7-713094/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000862; sid: 5000862; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Attempt to get Phase 1 ID data failed while hash computation"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-713104|%PIX[-]+7-713104/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000863; sid: 5000863; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Processing firewall record"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-713143|%PIX[-]+7-713143|%FWSM[-]+7-713143/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000864; sid: 5000864; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote user has been granted access by the Firewall Server [Brute Force] [10/1]"; after: track by_src, count 10, seconds 300; threshold: type suppress, track by_src, count 5, seconds 300; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-713160|%PIX[-]+7-713160|%FWSM[-]+7-713160/"; classtype: successful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000865; xbits: set,brute_force,track ip_src,expire 21600; sid: 5000865; rev: 9;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] The Firewall Server has requested a list of active user sessions"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-713164|%PIX[-]+7-713164|%FWSM[-]+7-713164/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000866; sid: 5000866; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Got bad refCnt assigning"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-713190|%PIX[-]+7-713190|%FWSM[-]+7-713190/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000867; sid: 5000867; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] subroutine Q Send failure RetCode"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-715004|%PIX[-]+7-715004|%FWSM[-]+7-715004/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000868; sid: 5000868; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] subroutine name Bad message code Cod"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-715005|%PIX[-]+7-715005|%FWSM[-]+7-715005/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000869; sid: 5000869; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IKE received response to a request from the utility"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-715042|%PIX[-]+7-715042/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000870; sid: 5000870; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ERROR malformed Keepalive payload"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-715045|%PIX[-]+7-715045|%FWSM[-]+7-715045/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000871; sid: 5000871; rev: 4;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Claims to be IOS but failed authentication"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-715050|%PIX[-]+7-715050|%FWSM[-]+7-715050/"; classtype: misc-attack; reference: url, wiki.quadrantsec.com/bin/view/Main/5000872; sid: 5000872; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropped received IKE fragment"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-715060|%PIX[-]+7-715060|%FWSM[-]+7-715060/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000873; sid: 5000873; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error assembling fragments! Fragment numbers are non-continuous"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-715062|%PIX[-]+7-715062|%FWSM[-]+7-715062/"; classtype: network-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000874; sid: 5000874; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IKE state_machine subtype FSM error history"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-715065|%PIX[-]+7-715065|%FWSM[-]+7-715065/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000875; sid: 5000875; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal interprocess communication queue send failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-718001|%PIX[-]+7-718001|%FWSM[-]+7-718001/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000876; sid: 5000876; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send KEEPALIVE request failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-718018|%PIX[-]+7-718018|%FWSM[-]+7-718018/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000877; sid: 5000877; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send KEEPALIVE response failure"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-718020|%PIX[-]+7-718020|%FWSM[-]+7-718020/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000878; sid: 5000878; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create group"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+7-718047|%PIX[-]+7-718047|%FWSM[-]+7-718047/"; classtype: system-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000879; sid: 5000879; rev: 5;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Creation of group policy"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM;pcre: "/%ASA[-]+7-718046|%PIX[-]+7-718046|%FWSM[-]+7-718046/"; classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000880; sid: 5000880; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Access denied URL"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-304002|%PIX[-]+5-304002|%FWSM[-]+7-304002; content: "http://"; default_proto: tcp; default_dst_port: $HTTP_PORT; classtype: policy-violation; normalize; reference: url, wiki.quadrantsec.com/bin/view/Main/5001086; sid: 5001086; rev: 7;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] AAA user authentication successful [0/5]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-113004|%PIX[-]+6-113004|%FWSM[-]+6-113004; default_proto: tcp; classtype: successful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5001087; threshold: type suppress, track by_src, count 5, seconds 300; parse_src_ip: 1; sid: 5001087; rev: 8;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] AAA user authentication Reject [0/5]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-113005|%PIX[-]+6-113005|%FWSM[-]+6-113005; default_proto: tcp; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5001092; threshold: type suppress, track by_src, count 5, seconds 300; parse_src_ip: 1; sid: 5001092; rev: 8;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] AAA user authentication Reject - Brute force [10/1]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-113005|%PIX[-]+6-113005|%FWSM[-]+6-113005/"; default_proto: tcp; classtype: unsuccessful-user; normalize; reference: url, wiki.quadrantsec.com/bin/view/Main/5001593; after: track by_src, count 10, seconds 300; threshold: type suppress, track by_src, count 1, seconds 86400; xbits: set,brute_force,track ip_src,expire 21600; sid: 5001593; rev:12;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Disconnect by SSH server"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-315011|%PIX[-]+6-315011|%FWSM[-]+6-315011; default_proto: tcp; classtype: not-suspicious; normalize; reference: url, wiki.quadrantsec.com/bin/view/Main/5001088; sid: 5001088; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Access denied URL chars - HTTPS"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-304002|%PIX[-]+5-304002|%FWSM[-]+5-304002; content: "https://"; default_proto: tcp; default_dst_port: $HTTPS_PORT; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5001089; sid: 5001089; rev: 5;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Access denied URL - HTTPS"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+5-304002|%PIX[-]+5-304002|%FWSM[-]+5-304002; content: "https://"; default_proto: tcp; default_dst_port: $HTTPS_PORT; classtype: policy-violation; normalize; reference: url, wiki.quadrantsec.com/bin/view/Main/5001091; sid: 5001091; rev: 6;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] User authentication failed - Brute force [5/1]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-611102|%PIX[-]+6-611102|%FWSM[-]+6-610102/"; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5001654; threshold: type suppress, track by_src, count 1, seconds 86400; after: track by_src, count 5, seconds 300; xbits: set,brute_force,track ip_src,expire 21600; sid: 5001654; rev: 8;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] TCP access denied by ACL - Brute force [25/1]"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-710003/"; default_proto: tcp; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5001714; normalize; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 1, seconds 86400; after: track by_src, count 25, seconds 300; xbits: set,brute_force,track ip_src,expire 21600; sid: 5001714; rev: 10;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] TCP access denied by ACL"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-710003/"; default_proto: tcp; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5001715; parse_src_ip: 1; parse_dst_ip: 2; parse_port; sid: 5001715; rev: 3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN console/admin failed"; append_program; content: "%ASA"; pcre: "/%ASA[-]+3-113021/"; default_proto: tcp; default_dst_port: $HTTPS_PORT; classtype: unsuccessful-admin; reference: url, wiki.quadrantsec.com/bin/view/Main/5001963; sid: 5001963; rev: 3;)