Merge branch 'develop' into mcptasearches

patel-bhavin · web-flow · commit f7475ad488f3 · 2026-02-12T20:36:11.000+05:30
diff --git a/contentctl.yml b/contentctl.yml
@@ -49,9 +49,9 @@ apps:
 - uid: 7404
   title: Cisco Security Cloud
   appid: CiscoSecurityCloud
-  version: 3.5.3
+  version: 3.6.1
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-security-cloud_353.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-security-cloud_361.tgz
 - uid: 6652
   title: Add-on for Linux Sysmon
   appid: Splunk_TA_linux_sysmon
diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml
@@ -10,5 +10,5 @@ separator: null
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.5.3
+  version: 3.6.1
 fields: null
diff --git a/data_sources/cisco_asa_logs.yml b/data_sources/cisco_asa_logs.yml
@@ -21,7 +21,7 @@ separator: null
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.5.3
+  version: 3.6.1
 fields:
 - Cisco_ASA_action
 - Cisco_ASA_message_id
diff --git a/data_sources/cisco_duo_activity.yml b/data_sources/cisco_duo_activity.yml
@@ -10,7 +10,7 @@ separator: null
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.5.3
+  version: 3.6.1
 fields:
 - access_device.browser
 - access_device.browser_version
diff --git a/data_sources/cisco_duo_administrator.yml b/data_sources/cisco_duo_administrator.yml
@@ -10,7 +10,7 @@ separator: null
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.5.3
+  version: 3.6.1
 fields:
 - action
 - actionlabel
diff --git a/data_sources/cisco_isovalent_process_connect.yml b/data_sources/cisco_isovalent_process_connect.yml
@@ -13,7 +13,7 @@ sourcetype: cisco:isovalent:processConnect
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.5.3
+  version: 3.6.1
 fields:
 - _time
 - app
diff --git a/data_sources/cisco_isovalent_process_exec.yml b/data_sources/cisco_isovalent_process_exec.yml
@@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processExec
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.5.3
+  version: 3.6.1
 fields:
 - _time
 - cluster_name
diff --git a/data_sources/cisco_isovalent_process_kprobe.yml b/data_sources/cisco_isovalent_process_kprobe.yml
@@ -12,7 +12,7 @@ sourcetype: cisco:isovalent
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.5.3
+  version: 3.6.1
 fields:
 - _time
 - app
diff --git a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml
@@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.5.3
+  version: 3.6.1
 fields:
 - AC_RuleAction
 - action
diff --git a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml
@@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.5.3
+  version: 3.6.1
 fields:
 - app
 - Application
diff --git a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml
@@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.5.3
+  version: 3.6.1
 fields:
 - Application
 - Classification
diff --git a/detections/deprecated/linux_apt_get_privilege_escalation.yml b/detections/deprecated/linux_apt_get_privilege_escalation.yml
@@ -1,9 +1,9 @@
 name: Linux apt-get Privilege Escalation
 id: d870ce3b-e796-402f-b2af-cab4da1223f2
-version: 10
-date: '2025-11-18'
+version: 11
+date: '2026-02-10'
 author: Gowthamaraj Rajendran, Bhavin Patel, Splunk
-status: production
+status: deprecated
 type: Anomaly
 description: The following analytic detects the execution of the 'apt-get' command
   with elevated privileges using 'sudo' on a Linux system. It leverages data from
diff --git a/detections/endpoint/linux_apt_privilege_escalation.yml b/detections/endpoint/linux_apt_privilege_escalation.yml
@@ -1,11 +1,11 @@
 name: Linux APT Privilege Escalation
 id: 4d5a05fa-77d9-4fd0-af9c-05704f9f9a88
-version: 9
-date: '2025-05-02'
-author: Gowthamaraj Rajendran, Splunk
+version: 10
+date: '2026-02-10'
+author: Gowthamaraj Rajendran, Bhavin Patel, Splunk
 status: production
 type: Anomaly
-description: The following analytic detects the use of the Advanced Package Tool (APT)
+description: The following analytic detects the use of the Advanced Package Tool (APT) or apt-get
   with elevated privileges via sudo on Linux systems. It leverages Endpoint Detection
   and Response (EDR) telemetry to identify processes where APT commands are executed
   with sudo rights. This activity is significant because it indicates a user can run
@@ -15,6 +15,7 @@ description: The following analytic detects the use of the Advanced Package Tool
   security risk.
 data_source:
 - Sysmon for Linux EventID 1
+- Cisco Isovalent Process Exec
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process="*apt*" AND
   Processes.process="*APT::Update::Pre-Invoke::*" AND Processes.process="*sudo*" by
@@ -82,3 +83,8 @@ tests:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux
+- name: True Positive Test - Cisco Isovalent
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt_get/cisco_isovalent.log
+    source: not_applicable
+    sourcetype: cisco:isovalent:processExec
diff --git a/removed/deprecation_mapping.YML b/removed/deprecation_mapping.YML
@@ -1,4 +1,9 @@
 detections:
+  - content: Linux apt-get Privilege Escalation
+    removed_in_version: 5.24.0
+    reason: Detection has been deprecated in favor of a more broad and generic logic that aims to reduce overhead and increase coverage.
+    replacement_content:
+      - Linux APT Privilege Escalation
   - content: HTTP Suspicious Tool User Agent
     removed_in_version: 5.22.0
     reason: Detection has been renamed for clarity
