sagan-rules 1:20160923-0.1 / etc / sagan-rules / cisco-pixasa.rules

This file is indexed.

/etc/sagan-rules/cisco-pixasa.rules is in sagan-rules 1:20160923-0.1.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below. 

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
# Sagan cisco-pixasa.rules
# Copyright (c) 2009-2016, Quadrant Information Security <www.quadrantsec.com>
# All rights reserved.
#
# Please submit any custom rules or ideas to sagan-submit@quadrantsec.com or the sagan-sigs mailing list
#
#*************************************************************
#  Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
#  following conditions are met:
#
#  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following
#    disclaimer.
#  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
#    following disclaimer in the documentation and/or other materials provided with the distribution.
#  * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived
#    from this software without specific prior written permission.
#
#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES,
#  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
#  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
#  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
#  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
# Iman Khosravi updated many of these rules to support the Cisco FWSM (firewall service modules).
# 06/25/2012. 

alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to initialize 4GE SSM I/O card"; program: %ASA*-1-114001; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000416; sid: 5000416; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to initialize SFP in 4GE SSM I/O card"; program: %ASA*-1-114002; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000417; sid: 5000417; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to run cached commands in 4GE SSM I/O card"; program: %ASA*-1-114003; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000418; sid: 5000418; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function"; program: %ASA*-1-216001; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000419; sid: 5000419; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] AAA Marking protocol server ip-addr in server group tag as FAILED"; program: %ASA*-2-113022|%FWSM-2-113022; parse_src_ip: 1; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000420; sid: 5000420; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in - function message"; program: %ASA*-2-216001|%FWSM-2-216001; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000421; sid: 5000421; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot locate AK47 instance"; program: %ASA*-2-716500; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000422; sid: 5000422; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot attach AK47 instance"; program: %ASA*-2-716501; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000423; sid: 5000423; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot allocate default arena"; program: %ASA*-2-716502|%FWSM-2-716502; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000424; sid: 5000424; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot allocate fiber descriptors pool"; program: %ASA*-2-716503; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000425; sid: 5000425; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot allocate fiber stacks pool"; program: %ASA*-2-716504; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000426; sid: 5000426; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber has joined fiber in unfinished state"; program: %ASA*-2-716505; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000427; sid: 5000427; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber scheduler has reached unreachable code. Cannot continue terminating"; program: %ASA*-2-716507; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000428; sid: 5000428; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber scheduler is scheduling rotten fiber. Cannot continuing terminating"; program: %ASA*-2-716508; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000429; sid: 5000429; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber scheduler is scheduling alien fiber. Cannot continue terminating"; program: %ASA*-2-716509; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000430; sid: 5000430; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber scheduler is scheduling finished fiber. Cannot continue terminating"; program: %ASA*-2-716510; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000431; sid: 5000431; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber has joined fiber waited upon by someone else"; program: %ASA*-2-716512; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000432; sid: 5000432; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber in callback blocked on other channel"; program: %ASA*-2-716513; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000433; sid: 5000433; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM failed to allocate memory for AK47 instance"; program: %ASA*-2-716515; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000434; sid: 5000434; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM has corrupted ROL array. Cannot continue terminating"; program: %ASA*-2-716516|%FWSM-2-716516; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000435; sid: 5000435; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM cached block has no associated arena"; program: %ASA*-2-716517|%FWSM-2-716517; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000436; sid: 5000436; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM pool has no associated arena"; program: %ASA*-2-716518|%FWSM-2-716518; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000437; sid: 5000437; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM has corrupted pool list. Cannot continue terminating"; program: %ASA*-2-716519|%FWSM-2-716519; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000438; sid: 5000438; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM pool has no block list"; program: %ASA*-2-716520|%FWSM-2-716520; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000439; sid: 5000439; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM no realloc allowed in named pool"; program: %ASA*-2-716521|%FWSM-2-716521; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000440; sid: 5000440; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM corrupted standalone block"; program: %ASA*-2-716522|%FWSM-2-716522; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000441; sid: 5000441; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] UNICORN_SYSLOGID_PERM_STORAGE_SERVER_LOAD_FAIL"; program: %ASA*-2-716526|%FWSM-2-716526; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000442; sid: 5000442; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] UNICORN_SYSLOGID_PERM_STORAGE_SERVER_STORE_FAIL"; program: %ASA*-2-716527|%FWSM-2-716527; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000443; sid: 5000443; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unexpected fiber scheduler error - possible out-of-memory condition"; program: %ASA*-2-716528|%FWSM-2-716528; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000444; sid: 5000444; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to get port statistics in 4GE SSM I/O card"; program: %ASA*-3-114006; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000445; sid: 5000445; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to get current msr in 4GE SSM I/O card"; program: %ASA*-3-114007; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000446; sid: 5000446; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to enable port after link is up in 4GE SSM I/O card"; program: %ASA*-3-114008; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000447; sid: 5000447; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set multicast address in 4GE SSM I/O card"; program: %ASA*-3-114009; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000448; sid: 5000448; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set multicast hardware address in 4GE SSM I/O card"; program: %ASA*-3-114010; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000449; sid: 5000449; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to delete multicast address in 4GE SSM I/O card"; program: %ASA*-3-114011; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000450; sid: 5000450; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to delete multicast hardware address in 4GE SSM I/O card"; program: %ASA*-3-114012; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000451; sid: 5000451; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set mac address table in 4GE SSM I/O card"; program: %ASA*-3-114013; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000452; sid: 5000452; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set mac address in 4GE SSM I/O card"; program: %ASA*-3-114014; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000453; sid: 5000453; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set mode in 4GE SSM I/O card"; program: %ASA*-3-114015; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000454; sid: 5000454; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set multicast mode in 4GE SSM I/O card"; program: %ASA*-3-114016; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000455; sid: 5000455; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to get link status in 4GE SSM I/O card"; program: %ASA*-3-114017; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000456; sid: 5000456; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set port speed in 4GE SSM I/O card"; program: %ASA*-3-114018; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000457; sid: 5000457; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set media type in 4GE SSM I/O card"; program: %ASA*-3-114019; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000458; sid: 5000458; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function message"; program: %ASA*-3-216001|%FWSM-3-216001; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000459; sid: 5000459; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] I2C_API_name error"; program: %ASA*-3-219002|%FWSM-3-219002; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000460; sid: 5000460; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPN Handle error protocol"; program: %ASA*-3-316002; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000461; sid: 5000461; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot experienced a control channel communications failure"; program: %ASA*-3-323001; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000462; sid: 5000462; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot failed to write software. Hw-module reset is required before further use"; program: %ASA*-3-323004; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000463; sid: 5000463; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot can not be powered on completely"; program: %ASA*-3-323005; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000464; sid: 5000464; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Type Module in slot experienced a data channel communication failure, data channel is DOWN"; program: %ASA*-3-323006; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000465; sid: 5000465; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPS card not up and fail-close mode used, dropping ICMP packet [1]"; program: %ASA*-3-420001; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000466; sid: 5000466; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPS card not up and fail-close mode used, dropping ICMP packet [2]"; program: %ASA*-3-420001; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000467; sid: 5000467; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] TCP|UDP flow from interface is dropped because application has failed"; program: %ASA*-3-421001|%FWSM-3-421001; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000468; sid: 5000468; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] TCP|UDP flow from interface  is skipped because application has failed"; program: %ASA*-3-421007|%FWSM-3-421007; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000469; sid: 5000469; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authentication to SSO server failed"; program: %ASA*-3-716056|%FWSM-3-716056; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000470; sid: 5000470; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Email Proxy session pointer has terminated due to reason error"; program: %ASA*-3-719002; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000471; sid: 5000471; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Message ERROR message [1]"; program: %ASA*-3-722007|%FWSM-3-722007; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000472; sid: 5000472; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Message ERROR message [2]"; program: %ASA*-3-722008|%FWSM-3-722008; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000473; sid: 5000473; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Message ERROR message [3]"; program: %ASA*-3-722009|%FWSM-3-722009; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000474; sid: 5000474; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot is not able to shut down. Module Error"; program: %ASA*-4-413001; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000475; sid: 5000475; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot is not able to reload. Module Error"; program: %ASA*-4-413002; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000476; sid: 5000476; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot failed to write software. Trying again"; program: %ASA*-4-413004; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000477; sid: 5000477; rev: 2;)
#alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPS requested to drop ICMP packets"; program: %ASA*-4-420002; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000478; sid: 5000478; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} invalid NBNS pkt"; program: %ASA*-4-423001|%FWSM-4-423001; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000479; sid: 5000479; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} mismatched NBNS pkt"; program: %ASA*-4-423002|%FWSM-4-423002; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000480; sid: 5000480; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} invalid NBDGM pkt"; program: %ASA*-4-423003|%FWSM-4-423003; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000481; sid: 5000481; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} mismatched NBDGM pkt"; program: %ASA*-4-423004|%FWSM-4-423004; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000482; sid: 5000482; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} NBDGM pkt"; program: %ASA*-4-423005|%FWSM-4-423005; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000483; sid: 5000483; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Packet denied. [Ingress|Egress] interface is in a backup state"; program: %ASA*-4-424001|%FWSM-4-424001; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000484; sid: 5000484; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Connection to the backup interface is denied"; program: %ASA*-4-424002|%FWSM-4-424002; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000485; sid: 5000485; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny traffic, licensed host limit exceeded."; program: %ASA*-4-450001|%FWSM-4-450001; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000486; sid: 5000486; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Received DH key with bad length"; program: %ASA*-4-713240|%FWSM-4-713240; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000487; sid: 5000487; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] META-DATA Unexpected error in Next Card Code mode while not doing SDI"; program: %ASA*-4-713247; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000488; sid: 5000488; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] META-DATA Received authentication failure message"; program: %ASA*-4-713251|%FWSM-4-713251; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000489; sid: 5000489; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to initialize with Chunk Manager"; program: %ASA*-4-720001|%FWSM-4-720001; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000490; sid: 5000490; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to allocate chunk from Chunk Manager"; program: %ASA*-4-720007|%FWSM-4-720007; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000491; sid: 5000491; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to register to High Availability Framework"; program: %ASA*-4-720008; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000492; sid: 5000492; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to create version control block"; program: %ASA*-4-720009|%FWSM-4-720009; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000493; sid: 5000493; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to allocate memory"; program: %ASA*-4-720011|%FWSM-4-720011; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000494; sid: 5000494; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to insert certificate in trust point"; program: %ASA*-4-720013|%FWSM-4-720013; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000495; sid: 5000495; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to queue add to message queue"; program: %ASA*-4-720033|%FWSM-4-720033; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000496; sid: 5000496; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to send type message id to standby unit"; program: %ASA*-4-720043|%FWSM-4-720043; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000497; sid: 5000497; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to receive message from active unit"; program: %ASA*-4-720044|%FWSM-4-720044; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000498; sid: 5000498; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to sync SDI node secret file for server on the standby unit"; program: %ASA*-4-720047|%FWSM-4-720047; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000499; sid: 5000499; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to add new SDI node secret file for server id on the standby unit"; program: %ASA*-4-720051|%FWSM-4-720051; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000500; sid: 5000500; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to delete SDI node secret file for server id on the standby unit"; program: %ASA*-4-720052|%FWSM-4-720052; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000501; sid: 5000501; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to add cTCP IKE rule during bulk sync"; program: %ASA*-4-720053|%FWSM-4-720053; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000502; sid: 5000502; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to add new cTCP record"; program: %ASA*-4-720054|%FWSM-4-720054; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000503; sid: 5000503; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN Stateful failover can only be run in single/non-transparent mode"; program: %ASA*-4-720055; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000504; sid: 5000504; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update cTCP database"; program: %ASA*-4-720064|%FWSM-4-720064; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000505; sid: 5000505; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to add new cTCP IKE rule"; program: %ASA*-4-720065|%FWSM-4-720065; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000506; sid: 5000506; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to activate IKE database"; program: %ASA*-4-720066|%FWSM-4-720066; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000507; sid: 5000507; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to deactivate IKE database"; program: %ASA*-4-720067|%FWSM-4-720067; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000508; sid: 5000508; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to parse peer message"; program: %ASA*-4-720068|%FWSM-4-720068; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000509; sid: 5000509; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to activate cTCP database"; program: %ASA*-4-720069; classtype|%FWSM-4-720069: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000510; sid: 5000510; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to deactivate cTCP database"; program: %ASA*-4-720070|%FWSM-4-720070; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000511; sid: 5000511; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Fail to insert certificate in trust point on the standby unit"; program: %ASA*-4-720073|%FWSM-4-720073; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000512; sid: 5000512; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error parsing SVC connect request"; program: %ASA*-4-722001|%FWSM-4-722001; parse_src_ip: 1; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000513; sid: 5000513; rev: 5;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error consolidating SVC connect request."; program: %ASA*-4-722002|%FWSM-4-722002; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000514; sid: 5000514; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error authenticating SVC connect request"; program: %ASA*-4-722003|%FWSM-4-722003; parse_src_ip: 1; classtype: unsuccessful-admin; reference: url, wiki.quadrantsec.com/bin/view/Main/5000515; sid: 5000515; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error responding to SVC connect request"; program: %ASA*-4-722004|%FWSM-4-722004; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000516; sid: 5000516; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad SVC frame length length expected"; program: %ASA*-4-722016|%FWSM-4-722016; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000517; sid: 5000517; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad SVC framing 525446, reserved 0"; program: %ASA*-4-722017|%FWSM-4-722017; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000518; sid: 5000518; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad SVC protocol version"; program: %ASA*-4-722018|%FWSM-4-722018; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000519; sid: 5000519; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] CRYPTO An attempt to allocate a large memory block failed"; program: %ASA*-5-402128|%FWSM-5-402128; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000520; sid: 5000520; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] META-DATA Rekey initiation is being disabled during CRACK authentication"; program: %ASA*-5-713248|%FWSM-5-713248; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000521; sid: 5000521; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Integrity Firewall Server is not available. VPN Tunnel creation rejected for client"; program: %ASA*-5-713252; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000522; sid: 5000522; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Integrity Firewall Server is not available. Entering ALLOW mode. VPN Tunnel created for client"; program: %ASA*-5-713253; classtype: successful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000523; sid: 5000523; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to initialize default timer"; program: %ASA*-5-720016; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000525; sid: 5000525; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update LB runtime data"; program: %ASA*-5-720017; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000526; sid: 5000526; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to get a buffer from the underlying core high availability subsystem"; program: %ASA*-5-720018; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000527; sid: 5000527; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update cTCP statistics"; program: %ASA*-5-720019; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000528; sid: 5000528; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to send type timer message"; program: %ASA*-5-720020; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000529; sid: 5000529; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] HA non-block send failed for peer msg. HA error code."; program: %ASA*-5-720021; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000530; sid: 5000530; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Fail to look up CTCP flow handle"; program: %ASA*-5-720035; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000531; sid: 5000531; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to process state update message from the active peer"; program: %ASA*-5-720036; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000532; sid: 5000532; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update cTCP dynamic data"; program: %ASA*-5-720071; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000533; sid: 5000533; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Timeout waiting for Integrity Firewall Server to become available"; program: %ASA*-5-720072|%FWSM-5-720072; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000534; sid: 5000534; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] CRYPTO An attempt to release a DMA memory block failed, location address"; program: %ASA*-6-402129|%FWSM-6-402129; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000535; sid: 5000535; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN access DENIED to specified location url"; program: %ASA*-6-716004; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000536; sid: 5000536; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN ACL Parse Error"; program: %ASA*-6-716005; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000537; sid: 5000537; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN session not allowed. WebVPN ACL parse error"; program: %ASA*-6-716009; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000538; sid: 5000538; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Reboot pending, new sessions disabled. Denied user login"; program: %ASA*-6-716040|%FWSM-6-716040; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000539; sid: 5000539; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error adding to ACL"; program: %ASA*-6-716050|%FWSM-6-716050; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000540; sid: 5000540; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error adding dynamic ACL for user"; program: %ASA*-6-716051|%FWSM-6-716051; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000541; sid: 5000541; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Email Proxy feature is disabled on interface"; program: %ASA*-6-719010|%FWSM-6-719010; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000542; sid: 5000542; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN authorization failed"; program: %ASA*-6-719019; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000543; sid: 5000543; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN authorization completed successfully"; program: %ASA*-6-719020; classtype: successful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000544; sid: 5000544; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN has not been successfully authenticated. Access denied"; program: %ASA*-6-719023; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000545; sid: 5000545; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Email Proxy piggyback auth fail session"; program: %ASA*-6-719024; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000546; sid: 5000546; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Email Proxy DNS name resolution failed for hostname"; program: %ASA*-6-719025; classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000547; sid: 5000547; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Starting VPN Stateful Failover Subsystem"; program: %ASA*-6-720002; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000548; sid: 5000548; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Initialization of VPN Stateful Failover Component completed successfully"; program: %ASA*-6-720003; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000549; sid: 5000549; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover main thread started"; program: %ASA*-6-720004; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000550; sid: 5000550; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover timer thread started"; program: %ASA*-6-720005; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000551; sid: 5000551; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover sync thread started"; program: %ASA*-6-720006; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000552; sid: 5000552; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover client is being disabled"; program: %ASA*-6-720010; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000553; sid: 5000553; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update IPSec failover runtime data on the standby unit"; program: %ASA*-6-720012; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000554; sid: 5000554; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover client is transitioning to active state"; program: %ASA*-6-720039; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000555; sid: 5000555; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover client is transitioning to standby state"; program: %ASA*-6-720040; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000556; sid: 5000556; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN Stateful failover Message Thread is being disabled"; program: %ASA*-6-720056; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000557; sid: 5000557; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN Stateful failover Timer Thread is disabled"; program: %ASA*-6-720058; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000559; sid: 5000559; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN Stateful failover Sync Thread is disabled."; program: %ASA*-6-720060; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000561; sid: 5000561; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Global Compression Disabled"; program: %ASA*-6-722025|%FWSM-6-722025; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000563; sid: 5000563; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Device failed SSL handshake"; program: %ASA*-6-725006|%FWSM-6-725006; classtype: bad-unknown; parse_src_ip: 1; reference: url, wiki.quadrantsec.com/bin/view/Main/5000564; sid: 5000564; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to inject {TCP|UDP} packet"; program: %ASA*-7-421004|%FWSM-7-421004; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000565; sid: 5000565; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] File access DENIED, filename"; program: %ASA*-7-716021|%FWSM-7-716021; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000566; sid: 5000566; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to browse the network"; program: %ASA*-7-716024|%FWSM-7-716024; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000567; sid: 5000567; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to browse domain domain"; program: %ASA*-7-716025|%FWSM-7-716025; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000568; sid: 5000568; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to browse directory"; program: %ASA*-7-716026|%FWSM-7-716026; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000569; sid: 5000569; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to view file"; program: %ASA*-7-716027|%FWSM-7-716027; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000570; sid: 5000570; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to remove file"; program: %ASA*-7-716028|%FWSM-7-716028; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000571; sid: 5000571; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to rename file"; program: %ASA*-7-716029|%FWSM-7-716029; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000572; sid: 5000572; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to modify file"; program: %ASA*-7-716030|%FWSM-7-716030; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000573; sid: 5000573; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to create file"; program: %ASA*-7-716031|%FWSM-7-716031; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000574; sid: 5000574; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to create folder"; program: %ASA*-7-716032|%FWSM-7-716032; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000575; sid: 5000575; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to remove folder"; program: %ASA*-7-716033|%FWSM-7-716033; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000576; sid: 5000576; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] File Access User failed to login into the server"; program: %ASA*-7-716037|%FWSM-7-716037; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000577; sid: 5000577; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Session Termination"; program: %ASA*-7-722030|%FWSM-7-722030; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000579; sid: 5000579; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Session Termination Out"; program: %ASA*-7-722031|%FWSM-7-722031; parse_src_ip: 1; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000580; sid: 5000580; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN Citrix encountered bad flow control flow"; program: %ASA*-7-723004; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000581; sid: 5000581; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN Citrix SOCKS errors"; program: %ASA*-7-723006; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000582; sid: 5000582; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN Citrix receives bad SOCKS socks message length"; program: %ASA*-7-723011; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000583; sid: 5000583; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN Citrix received bad SOCKS socks message format"; program: %ASA*-7-723012; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000584; sid: 5000584; rev: 2;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SSL lib error"; program: %ASA*-7-725014|%FWSM-7-725014 ; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000585; sid: 5000585; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dynamic DNS Update failed"; program: %ASA*-3-331001|%PIX-3-331001|%FWSM-3-331001 ; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000586; sid: 5000586; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Switching to ACTIVE";program: %ASA*-1-104001|%FWSM-1-104001; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000587; sid: 5000587; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA]%PIX|ASA-1-104002 [Primary] Switching to STNDBY [cause string]."; program: %ASA*-1-104002|%FWSM-1-104002; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000588; sid: 5000588; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA]%PIX|ASA-1-104003 [Primary] Switching to FAILED"; program: %ASA*-1-104003|%FWSM-1-104003; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000589; sid: 5000589; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA]%PIX|ASA-1-104004 [Primary] Switching to OK."; program: %ASA*-1-104004|%FWSM-1-104004; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000590; sid: 5000590; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA]%PIX|ASA-1-105037 The primary and standby units are switching back and forth as the active unit"; program: %ASA*-1-105037|%FWSM-1-105037; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000591; sid: 5000591; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed Identification Test"; program: %ASA*-2-218004|%PIX-2-218004|%FWSM-2-218004; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000592; sid: 5000592; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover cable OK"; program: %ASA*-1-101001|%PIX-1-101001; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000595; sid: 5000595; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Bad failover cable"; program: %ASA*-1-101002|%PIX-1-101002; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000596; sid: 5000596; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover cable not connected [this unit]"; program: %ASA*-1-101003|%PIX-1-101003; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000597; sid: 5000597; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover cable not connected [other unit]"; program: %ASA*-1-101004|%PIX-1-101004; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000598; sid: 5000598; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Error reading failover cable status"; program: %ASA*-1-101005|%PIX-1-101005; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000599; sid: 5000599; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Power failure/System reload other side"; program: %ASA*-1-102001|%PIX-1-102001|%FWSM-1-102001; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000600; sid: 5000600; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] No response from other firewall"; program: %ASA*-1-103001|%PIX-1-103001|%FWSM-1-103001; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000601; sid: 5000601; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Other firewall network interface OK"; program: %ASA*-1-103002|%PIX--1-103002|%FWSM-1-103002; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000602; sid: 5000602; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Other firewall network interface failed"; program: %ASA*-1-103003|%PIX-1-103003|%FWSM-1-103003; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000603; sid: 5000603; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Other firewall reports this firewall failed"; program: %ASA*-1-103004|%PIX-1-103004|%FWSM-1-103004; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000604; sid: 5000604; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Other firewall reporting failure"; program: %ASA*-1-103005|%PIX-1-103005|%FWSM-1-103005; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000605; sid: 5000605; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to ACTIVE"; program: %ASA*-1-104001|%PIX-1-104001|%FWSM-1-104001;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000606; sid: 5000606; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to STNDBY"; program: %ASA*-1-104002|%PIX-1-104002|%FWSM-1-104002;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000607; sid: 5000607; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to FAILED"; program: %ASA*-1-104003|%PIX-1-104003|%FWSM-1-104003;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000608; sid: 5000608; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to OK"; program: %ASA*-1-104004|%PIX-1-104004|%FWSM-1-104004;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000609; sid: 5000609; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Disabling failover"; program: %ASA*-1-105001|%PIX-1-105001|%FWSM-1-105001;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000610; sid: 5000610; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Enabling failover"; program: %ASA*-1-105002|%PIX-1-105002|%FWSM-1-105002;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000611; sid: 5000611; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Lost Failover communications with mate on interface"; program: %ASA*-1-105005|%PIX-1-105005|%FWSM-1-105005;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000612; sid: 5000612; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover cable communication failure"; program: %ASA*-1-105011|%PIX-1-105011; pcre: "/%PIX-|%ASA*-/"; classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000614; sid: 5000614; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [failover_unit] Standby unit failed to sync due to a locked config"; program: %ASA*-1-105021|%PIX-1-105021|%FWSM-1-105021;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000615; sid: 5000615; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failover LAN interface is up"; program: %ASA*-1-105031|%PIX-1-105031;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000616; sid: 5000616; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LAN Failover interface is down"; program: %ASA*-1-105032|%PIX-1-105032;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000617; sid: 5000617; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Receive a LAN_FAILOVER_UP message from peer"; program: %ASA*-1-105034|%PIX-1-105034;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000618; sid: 5000618; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Receive a LAN failover interface down msg from peer"; program: %ASA*-1-105035|%PIX-1-105035;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000619; sid: 5000619; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] dropped a LAN Failover command message"; program: %ASA*-1-105036|%PIX-1-105036;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000620; sid: 5000620; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Unable to verify the Interface count with mate. Failover may be disabled in mate"; program: %ASA*-1-105039|%PIX-1-105039;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000621; sid: 5000621; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Mate failover version is not compatible"; program: %ASA*-1-105040|%PIX-1-105040;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000622; sid: 5000622; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover interface OK"; program: %ASA*-1-105042|%PIX-1-105042;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000623; sid: 5000623; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover interface failed"; program: %ASA*-1-105043|%PIX-1-105043;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000624; sid: 5000624; rev: 2;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny protocol reverse path check"; program: %ASA*-1-106021|%PIX-1-106021|%FWSM-1-106021;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000625; sid: 5000625; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny protocol connection spoof"; program: %ASA*-1-106022|%PIX-1-106022|%FWSM-1-106022;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000626; sid: 5000626; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] The number of ACL log deny-flows has reached limit"; program: %ASA*-1-106101|%PIX-1-106101|%FWSM-1-106101;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000627; sid: 5000627; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RIP auth failed"; program: %ASA*-1-107001|%PIX-1-107001|%FWSM-1-107001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000628; sid: 5000628; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RIP pkt failed"; program: %ASA*-1-107002|%PIX-1-107002|%FWSM-1-107002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000629; sid: 5000629; rev: 3;)
#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Inbound TCP connection denied"; program: %ASA*-2-106001|%PIX-2-106001|%FWSM-2-106001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000631; sid: 5000631; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Connection denied by outbound ACL"; program: %ASA*-2-106002|%PIX-2-106002|%FWSM-2-106002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000632; sid: 5000632; rev: 3;)
#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny inbound UDP"; program: %ASA*-2-106006|%PIX-2-106006|%FWSM-2-106006;  classtype: bad-unknown; normalize; reference: url, wiki.quadrantsec.com/bin/view/Main/5000633; sid: 5000633; rev: 4;)
#alert udp $EXTERNAL_NET any -> $HOME_NET $DNS_PORT (msg: "[CISCO-PIXASA] Deny inbound UDP from outside due to DNS {Response|Query}"; program: %ASA*-2-106007|%PIX-2-106007|%FWSM-2-106007;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000634; sid: 5000634; rev: 4;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping echo request"; program: %ASA*-2-106013|%PIX-2-106013|%FWSM-2-106013;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000635; sid: 5000635; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny IP spoof [0/5]"; program: %ASA*-2-106016|%PIX-2-106016|%FWSM-2-106016;  classtype: bad-unknown; threshold: type limit, track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5000636; sid: 5000636; rev: 7;)
#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny IP due to Land Attack [0/5]"; program: %ASA*-2-106017|%PIX-2-106017|%FWSM-2-106017;  classtype: bad-unknown; threshold: type limit, track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5000637; sid: 5000637; rev: 5;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ICMP denied by outbound ACL"; program: %ASA*-2-106018|%PIX-2-106018|%FWSM-2-106018;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000638; sid: 5000638; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny IP teardrop fragment [0/5]"; program: %ASA*-2-106020|%PIX-2-106020|%FWSM-2-106020;  classtype: bad-unknown; threshold: type limit, track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5000639; parse_src_ip: 1; sid: 5000639; rev: 6;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad route_compress"; program: %ASA*-2-215001|%PIX-2-215001|%FWSM-2-215001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000640; sid: 5000640; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed Identification Test in slot"; program: %ASA*-2-218001|%PIX-2-218001|%FWSM-2-218001;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000641; sid: 5000641; rev: 3;)
alert udp $EXTERNAL_NET any -> $HOME_NET $DNS_PORT (msg: "[CISCO-PIXASA] Dropped DNS responses with mis-matched id"; program: %ASA*-2-410002|%PIX-2-410002|%FWSM-2-410002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000642; sid: 5000642; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Configuration replication failed for command"; program: %ASA*-2-709007|%PIX-2-709007|%FWSM-2-709007;  classtype: configuration-error ; reference: url, wiki.quadrantsec.com/bin/view/Main/5000643; sid: 5000643; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unexpected event"; program: %ASA*-2-717011|%PIX-2-717011|%FWSM-2-717011;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000644; sid: 5000644; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover message block alloc failed"; program: %ASA*-3-105010|%PIX-3-105010|%FWSM-3-105010;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000645; sid: 5000645; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny inbound protocol"; program: %ASA*-3-106010|%PIX-3-106010|%FWSM-3-106010;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000646; sid: 5000646; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny inbound [No xlate]"; program: %ASA*-3-106011|%PIX-3-106011|%FWSM-3-106011;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000647; sid: 5000647; rev: 3;)
#alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny inbound ICMP"; program: %ASA*-3-106014|%PIX-3-106014|%FWSM-3-106014;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000648; sid: 5000648; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auth from inside to outside failed [too many pending auths]"; program: %ASA*-3-109010|%PIX-3-109010|%FWSM-3-109010;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000649; sid: 5000649; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Can't find authorization ACL for user"; program: %ASA*-3-109016|%PIX-3-109016|%FWSM-3-109016;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000650; sid: 5000650; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Downloaded ACL has parsing error"; program: %ASA*-3-109019|%PIX-3-109019|%FWSM-3-109019;  classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000651; sid: 5000651; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Downloaded ACL has config error"; program: %ASA*-3-109020|%PIX-3-109020|%FWSM-3-109020;  classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000652; sid: 5000652; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to install ACL, downloaded for user"; program: %ASA*-3-109032|%PIX-3-109032|%FWSM-3-109032;  classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000653; sid: 5000653; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Kerberos error. Clock skew with server greater than 300 seconds"; program: %ASA*-3-113020|%PIX-3-113020|%FWSM-3-109020;  classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000654; sid: 5000654; rev: 3;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $FTP_PORT (msg: "[CISCO-PIXASA] FTP data connection failed"; program: %ASA*-3-201005|%PIX-3-201005|%FWSM-3-201005;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000655; sid: 5000655; rev: 4;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg: "[CISCO-PIXASA] RCMD backconnection failed "; program: %ASA*-3-201006|%PIX-3-201006|%FWSM-3-201006;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000656; sid: 5000656; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU sw_module_name error"; program: %ASA*-3-210001|%PIX-3-210001|%FWSM-3-210001;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000657; sid: 5000657; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU allocate block [bytes] failed"; program: %ASA*-3-210002|%PIX-3-210002|%FWSM-3-210002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000658; sid: 5000658; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU allocate connection failed"; program: %ASA*-3-210005|%PIX-3-210005|%FWSM-3-210005;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000659; sid: 5000659; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU look NAT  failed"; program: %ASA*-3-210006|%PIX-3-210006|%FWSM-3-210006;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000660; sid: 5000660; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU allocate xlate failed"; program: %ASA*-3-210007|%PIX-3-210007|%FWSM-3-210007;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000661; sid: 5000661; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU make UDP connection for outside to inside failed"; program: %ASA*-3-210010|%PIX-3-210010|%FWSM-3-210010;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000662; sid: 5000662; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU PAT port reserve failed"; program: %ASA*-3-210020|%PIX-3-210020|%FWSM-3-210020;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000663; sid: 5000663; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU create static xlate interface failed"; program: %ASA*-3-210021|%PIX-3-210021|%FWSM-3-210021;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000664; sid: 5000664; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Memory allocation Error"; program: %ASA*-3-211001|%PIX-3-211001|%FWSM-3-211001;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000665; sid: 5000665; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to open SNMP channel"; program: %ASA*-3-212001|%PIX-3-212001|%FWSM-3-212001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000666; sid: 5000666; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to open SNMP trap channel"; program: %ASA*-3-212002|%PIX-3-212002|%FWSM-3-212002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000667; sid: 5000667; rev: 3;)
alert udp $EXTERNAL_NET any -> $HOME_NET $SNMP_PORT (msg: "[CISCO-PIXASA] Unable to receive an SNMP request on interface"; program: %ASA*-3-212003|%PIX-3-212003|%FWSM-3-212003;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000668; sid: 5000668; rev: 4;)
alert udp $EXTERNAL_NET any -> $HOME_NET $SNMP_PORT (msg: "[CISCO-PIXASA] Unable to send an SNMP response"; program: %ASA*-3-212004|%PIX-3-212004|%FWSM-3-212004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000669; sid: 5000669; rev: 4;)
alert udp $EXTERNAL_NET any -> $HOME_NET $SNMP_PORT (msg: "[CISCO-PIXASA] Dropping SNMP request"; program: %ASA*-3-212006|%PIX-3-212006|%FWSM-3-212006;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000670; sid: 5000670; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPTP tunnel hashtable insert failed"; program: %ASA*-3-213002|%PIX-3-213002|%FWSM-3-213002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000671; sid: 5000671; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPP virtual interface client ip allocation failed"; program: %ASA*-3-213004|%PIX-3-213004|%FWSM-3-213004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000672; sid: 5000672; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] H.323 library_name ASN Library failed to initialize"; program: %ASA*-3-302019|%PIX-3-302019|%FWSM-3-302019;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000673; sid: 5000673; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ACL = deny no sa created"; program: %ASA*-3-302302|%PIX-3-302302|%FWSM-3-302302;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000674; sid: 5000674; rev: 4;)

# Disabled on 04/12/2014 - Considered to noisy & of little value (Champ Clark III)

#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {outbound static|identity|portmap|regular] translation creation failed"; program: %ASA*-3-305006|%PIX-3-305006|%FWSM-3-305006;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000675; sid: 5000675; rev: 3;)
#alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Denied ICMP"; program: %ASA*-3-313001|%PIX-3-313001|%FWSM-3-313001;  classtype: bad-unknown; normalize; reference: url, wiki.quadrantsec.com/bin/view/Main/5000676; sid: 5000676; rev: 5;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Denied ICMPv6"; program: %ASA*-3-313008|%PIX-3-313008|%FWSM-3-313008;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000677; sid: 5000677; rev: 3;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $SSH_PORT (msg: "[CISCO-PIXASA] Fail to establish SSH session because RSA host key retrieval failed"; program: %ASA*-3-315004|%PIX-3-315004|%FWSM-3-315004;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000678; sid: 5000678; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Denied new tunnel limit exceeded"; program: %ASA*-3-316001|%PIX-3-316001|%FWSM-3-316001;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000679; sid: 5000679; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IP routing table creation failure"; program: %ASA*-3-317003|%PIX-3-317003|%FWSM-3-317003;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000681; sid: 5000681; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error"; program: %ASA*-3-318001|%PIX-3-318001|%FWSM-3-318001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000682; sid: 5000682; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Arp update for IP address address to NPn failed"; program: %ASA*-3-319003|%PIX-3-319003|%FWSM-3-319003;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000683; sid: 5000683; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Route update for IP address failed"; program: %ASA*-3-319004|%PIX-3-319004|%FWSM-3-319004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000684; sid: 5000684; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny MAC address possible spoof attempt"; program: %ASA*-3-322001|%PIX-3-322001|%FWSM-3-322001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000685; sid: 5000685; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ARP inspection check failed [1]"; program: %ASA*-3-322002|%PIX-3-322002|%FWSM-3-322002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000686; sid: 5000686; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ARP inspection check failed [2]"; program: %ASA*-3-322003|%PIX-3-322003|%FWSM-3-322003;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000687; sid: 5000687; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] GSN tunnel limit exceeded"; program: %ASA*-3-324006|%PIX-3-324006|%FWSM-3-324006;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000690; sid: 5000690; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Radius Accounting Request has a bad header length"; program: %ASA*-3-324301|%PIX-3-324301|%FWSM-3-324301;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000691; sid: 5000691; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unexpected error in the timer library"; program: %ASA*-3-326001|%PIX-3-326001|%FWSM-3-326001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000692; sid: 5000692; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error"; program: %ASA*-3-326002|%PIX-3-326002|%FWSM-3-326002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000693; sid: 5000693; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] An internal error occurred while processing a packet queue"; program: %ASA*-3-326004|%PIX-3-326004|%FWSM-3-326004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000694; sid: 5000694; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Mrib notification failed"; program: %ASA*-3-326005|%PIX-3-326005|%FWSM-3-326005;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000695; sid: 5000695; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Entry-creation failed"; program: %ASA*-3-326006|%PIX-3-326006|%FWSM-3-326006;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000696; sid: 5000696; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Entry-update failed"; program: %ASA*-3-326007|%PIX-3-326007|%FWSM-3-326007;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000697; sid: 5000697; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] MRIB registration failed"; program: %ASA*-3-326008|%PIX-3-326008|%FWSM-3-326008;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000698; sid: 5000698; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] MRIB connection-open failed"; program: %ASA*-3-326009|%PIX-3-326009|%FWSM-3-326009;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000699; sid: 5000699; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] MRIB unbind failed"; program: %ASA*-3-326010|%PIX-3-326010|%FWSM-3-326010;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000700; sid: 5000700; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] MRIB table deletion failed"; program: %ASA*-3-326011|%PIX-3-326011|%FWSM-3-326011;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000701; sid: 5000701; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Initialization of string functionality failed"; program: %ASA*-3-326012|%PIX-3-326012|%FWSM-3-326012;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000702; sid: 5000702; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error"; program: %ASA*-3-326013|%PIX-3-326013|%FWSM-3-326013;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000703; sid: 5000703; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Initialization failed"; program: %ASA*-3-326014|%PIX-3-326014|%FWSM-3-326014;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000704; sid: 5000704; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Communication error"; program: %ASA*-3-326015|%PIX-3-326015|%FWSM-3-326015;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000705; sid: 5000705; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set un-numbered interface"; program: %ASA*-3-326016|%PIX-3-326016|%FWSM-3-326016;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000706; sid: 5000706; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Interface Manager error"; program: %ASA*-3-326017|%PIX-3-326017|%FWSM-3-326017;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000707; sid: 5000707; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] List error"; program: %ASA*-3-326020|%PIX-3-326020|%FWSM-3-326020;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000708; sid: 5000708; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error"; program: %ASA*-3-326021|%PIX-3-326021|%FWSM-3-326021;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000709; sid: 5000709; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error"; program: %ASA*-3-326022|%PIX-3-326022|%FWSM-3-326022;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000710; sid: 5000710; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] An internal error occurred while processing a packet queue"; program: %ASA*-3-326024|%PIX-3-326024|%FWSM-3-326024;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000711; sid: 5000711; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Server unexpected error"; program: %ASA*-3-326026|%PIX-3-326026|%FWSM-3-326026;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000712; sid: 5000712; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Corrupted update"; program: %ASA*-3-326027|%PIX-3-326027|%FWSM-3-326027;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000713; sid: 5000713; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Asynchronous error"; program: %ASA*-3-326028|%PIX-3-326028|%FWSM-3-326028;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000714; sid: 5000714; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IP SLA Monitor Failed to initialize, will not work"; program: %ASA*-3-327002|%PIX-3-327002|%FWSM-3-327002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000715; sid: 5000715; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IP SLA Monitor Generic Timer wheel timer functionality failed to initialize"; program: %ASA*-3-327003|%PIX-3-327003|%FWSM-3-327003;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000716; sid: 5000716; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPPoE - Bad host-unique in PADO - packet dropped"; program: %ASA*-3-403501|%PIX-3-403501|%FWSM-3-403501;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000717; sid: 5000717; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPPoE - Bad host-unique in PADS - dropping packet"; program: %ASA*-3-403502|%PIX-3-403502|%FWSM-3-403502;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000718; sid: 5000718; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPPoEPPPoE client on interface failed to locate PPPoE vpdn group"; program: %ASA*-3-403507|%PIX-3-403507|%FWSM-3-403507;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000719; sid: 5000719; rev: 3;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $FTP_PORT (msg: "[CISCO-PIXASA] Failed to save logging buffer using filename to FTP server"; program: %ASA*-3-414001|%PIX-3-414001|%FWSM-3-414001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000720; sid: 5000720; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to save logging buffer to flash or syslog directory using file name filename"; program: %ASA*-3-414002|%PIX-3-414002|%FWSM-3-414002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000721; sid: 5000721; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NTP daemon Packet denied"; program: %ASA*-3-610001|%PIX-3-610001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000722; sid: 5000722; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NTP daemon Authentication failed"; program: %ASA*-3-610002|%PIX-3-610002|%FWSM-3-610002;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000723; sid: 5000723; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient Backup Server List Error"; program: %ASA*-3-611313|%PIX-3-611313;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000724; sid: 5000724; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error processing payload"; program: %ASA*-3-713048|%PIX-3-713048|%FWSM-3-713048; parse_src_ip: 1; parse_dst_ip: 2; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000725; sid: 5000725; rev: 5;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Tunnel Rejected User matched with group name, check failed"; program: %ASA*-3-713059|%PIX-3-713059;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000726; sid: 5000726; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Tunnel Rejected User not member of group, check failed"; program: %ASA*-3-713060|%PIX-3-713060;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000727; sid: 5000727; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to retrieve identity certificate"; program: %ASA*-3-713082|%PIX-3-713082;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000728; sid: 5000728; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Set Cert filehandle failure no IPSec SA in group"; program: %ASA*-3-713088|%PIX-3-713088;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000729; sid: 5000729; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Request attempt failed!"; program: %ASA*-3-713107|%PIX-3-713107;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000730; sid: 5000730; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to process CONNECTED notify!"; program: %ASA*-3-713112|%PIX-3-713112;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000731; sid: 5000731; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Client-reported firewall does not match configured firewall action tunnel"; program: %ASA*-3-713141|%PIX-3-713141;  classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000732; sid: 5000732; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Client did not report firewall in use, but there is a configured firewall action tunnel"; program: %ASA*-3-713142|%PIX--3-713142;  classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000733; sid: 5000733; rev: 2;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] TCP Connection to Firewall Server has been lost, restricted tunnels are now allowed full network access"; program: %ASA*-3-713159|%PIX-3-713159;  classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000734; sid: 5000734; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote user network access has been restricted by the Firewall Server"; program: %ASA*-3-713161|%PIX-3-713161;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000735; sid: 5000735; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote user has been rejected by the Firewall Server"; program: %ASA*-3-713162|%PIX-3-713162;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000736; sid: 5000736; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote user has been terminated by the Firewall Server"; program: %ASA*-3-713163|%PIX-3-713163;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000737; sid: 5000737; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Headend security gateway has failed our user authentication attempt - check configured username and password"; program: %ASA*-3-713166|%PIX-3-713166;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000738; sid: 5000738; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote peer has failed user authentication - check configured username and password [10/5]"; program: %ASA*-3-713167|%PIX-3-713167; after: track by_src, count 10, seconds 300; threshold: type limit, track by_src, count 5, seconds 300; parse_src_ip: 1; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000739; sid: 5000739; rev: 5;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error Username too long - connection aborted"; program: %ASA*-3-713185|%PIX-3-713185;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000740; sid: 5000740; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] User Authorization failed"; program: %ASA*-3-713198|%PIX-3-713198|%FWSM-3-713198;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000741; sid: 5000741; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IKE Receiver Error reading from socket"; program: %ASA*-3-713203|%PIX-3-713203;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000742; sid: 5000742; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Connection failed with peer, no trust-point defined"; program: %ASA*-3-713226|%PIX-3-713226;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000743; sid: 5000743; rev: 2;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal Error, ike_lock trying to lock bit that is already locked"; program: %ASA*-3-713230|%PIX-3-713230|%FWSM-3-713230; parse_src_ip: 1; parse_dst_ip: 2; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000744; sid: 5000744; rev: 4;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal Error, ike_lock trying to unlock bit that is not locked"; program: %ASA*-3-713231|%PIX-3-713231|%FWSM-3-713231; parse_src_ip: 1; parse_dst_ip: 2; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000745; sid: 5000745; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Querying keypair failed"; program: %ASA*-3-717001|%PIX-3-717001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000746; sid: 5000746; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Certificate enrollment failed for trustpoint"; program: %ASA*-3-717002|%PIX-3-717002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000747; sid: 5000747; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Certificate validation failed"; program: %ASA*-3-717009|%PIX-3-717009;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000748; sid: 5000748; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] CRL polling failed for trustpoint"; program: %ASA*-3-717010|%PIX-3-717010;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000749; sid: 5000749; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to refresh CRL cache entry from the server for trustpoint"; program: %ASA*-3-717012|%PIX-3-717012;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000750; sid: 5000750; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to query CA certificate for trustpoint"; program: %ASA*-3-717017|%PIX-3-717017;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000751; sid: 5000751; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to insert CRL for trustpoint"; program: %ASA*-3-717019|%PIX-3-717019;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000752; sid: 5000752; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SSL failed to set device certificate for trustpoint"; program: %ASA*-3-717023|%PIX-3-717023;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000753; sid: 5000753; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Certificate chain failed validation"; program: %ASA*-3-717027|%PIX-3-717027;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000754; sid: 5000754; rev: 2;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny protocol"; program: %ASA*-4-106023|%PIX-4-106023|%FWSM-4-106023;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000755; sid: 5000755; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to determine the security context for the packetvlansource Vlan"; program: %ASA*-4-106027|%PIX-4-106027|%FWSM-4-106027;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000756; sid: 5000756; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NT Domain Authentication Failed rejecting guest login for username."; program: %ASA*-4-109031|%PIX-4-109031|%FWSM-4-109031;  classtype: misc-attack; reference: url, wiki.quadrantsec.com/bin/view/Main/5000757; sid: 5000757; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authentication failed for admin user"; program: %ASA*-4-109033|%PIX-4-109033|%FWSM-4-109033;  classtype: unsuccessful-admin; reference: url, wiki.quadrantsec.com/bin/view/Main/5000758; sid: 5000758; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authentication failed for network user"; program: %ASA*-4-109034|%PIX-4-109034|%FWSM-4-109034;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000759; sid: 5000759; rev: 3;)
#alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Denied ICMP"; program: %ASA*-4-313004|%PIX-4-313004|%FWSM-4-313004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000760; sid: 5000760; rev: 3;)
#alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] No matching connection for ICMP error"; program: %ASA*-4-313005|%PIX-4-313005|%FWSM-4-313005; classtype: bad-unknown; parse_src_ip: 1; reference: url, wiki.quadrantsec.com/bin/view/Main/5000761; sid: 5000761; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NAC Downloaded ACL parse failure"; program: %ASA*-4-335005|%PIX-4-335005|%FWSM-4-335005;  classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000762; sid: 5000762; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Shun add failed unable to allocate resources"; program: %ASA*-4-401005|%PIX-4-401005|%FWSM-4-401005; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000763; sid: 5000763; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPSEC Received an protocol packet from remote IP to local IP that failed anti-replay checking [0/5]"; program: %ASA*-4-402119|%PIX-4-402119|%FWSM-4-402119; threshold: type limit, track by_src, count 5, seconds 300; parse_src_ip: 1; parse_dst_ip: 2; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000764; sid: 5000764; rev: 5;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPSEC Received an ESP packet from remote IP to local IP that failed authentication [0/5]"; program: %ASA*-4-402120|%PIX-4-402120;  classtype: unsuccessful-user; threshold: type limit, track by_src, count 5, seconds 300; parse_src_ip: 1; parse_dst_ip: 3; reference: url, wiki.quadrantsec.com/bin/view/Main/5000765; sid: 5000765; rev: 7;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] CRYPTO The hardware accelerator encountered an error while executing crypto command"; program: %ASA*-4-402123|%PIX-4-402123|%FWSM-4-402123;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000766; sid: 5000766; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPPoE failed to assign PPP IP address"; program: %ASA*-4-403506|%PIX-4-403506|%FWSM-4-403506;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000767; sid: 5000767; rev: 3;)
alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg: "[CISCO-PIXASA] ISAKMP Failed to allocate address for client from pool string"; program: %ASA*-4-404101|%PIX-4-404101|%FWSM-4-404101;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000768; sid: 5000768; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] H225 message contains bad protocol discriminator hex"; program: %ASA*-4-405103|%PIX-4-405103|%FWSM-4-405103;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000769; sid: 5000769; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny traffic for local-host, license limit of number exceeded"; program: %ASA*-4-407001|%PIX-4-407001|%FWSM-4-407001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000770; sid: 5000770; rev: 3;)
alert udp $EXTERNAL_NET any -> $HOME_NET $SNMP_PORT (msg: "[CISCO-PIXASA] Dropped UDP SNMP packet"; program: %ASA*-4-416001|%PIX-4-416001|%FWSM-4-416001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000771; sid: 5000771; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Filter violation error conn number"; program: %ASA*-4-417004|%PIX-4-417004|%FWSM-4-417004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000772; sid: 5000772; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Through-the-device packet to/from management-only network is denied"; program: %ASA*-4-418001|%PIX-4-418001|%FWSM-4-418001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000773; sid: 5000773; rev: 3;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping TCP packet, reason MSS exceeded, MSS size, data size"; program: %ASA*-4-419001|%PIX-4-419001|%FWSM-4-419001; parse_src_ip: 1; parse_dst_ip: 2;  classtype: network-scan; reference: url, wiki.quadrantsec.com/bin/view/Main/5000774; sid: 5000774; rev: 5;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RTP conformance Dropping RTP packet"; program: %ASA*-4-431001|%PIX-4-431001|%FWSM-4-431001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000775; sid: 5000775; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RTCP conformance Dropping RTCP packet"; program: %ASA*-4-431002|%PIX-4-431002|%FWSM-4-431002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000776; sid: 5000776; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping Skinny message length value too small"; program: %ASA*-4-608002|%PIX-4-608002|%FWSM-4-608002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000777; sid: 5000777; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping Skinny message length value too large"; program: %ASA*-4-608003|%PIX-4-608003|%FWSM-4-608003;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000778; sid: 5000778; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping Skinny message id value not allowed"; program: %ASA*-4-608004|%PIX-4-608004|%FWSM-4-608004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000779; sid: 5000779; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping Skinny message id value registration not complete"; program: %ASA*-4-608005|%PIX-4-608005|%FWSM-4-608005;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000780; sid: 5000780; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auto Update failed"; program: %ASA*-4-612002|%PIX-4-612002|%FWSM-4-612002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000781; sid: 5000781; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auto Update failed"; program: %ASA*-4-612003|%PIX-4-612003|%FWSM-4-612003;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000782; sid: 5000782; rev: 3;)
alert udp $EXTERNAL_NET any -> $HOME_NET $DNS_PORT (msg: "[CISCO-PIXASA] DNS lookup for Server failed!"; program: %ASA*-4-713154|%PIX-4-713154|%FWSM-4-713154;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000783; sid: 5000783; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Name lookup failed for hostname during PKI operation"; program: %ASA*-4-717026|%PIX-4-717026|%FWSM-4-717026;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000784; sid: 5000784; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to find a suitable trustpoint for issuer"; program: %ASA*-4-717031|%PIX-4-717031|%FWSM-4-717031;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000785; sid: 5000785; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Tunnel group search using certificate maps failed"; program: %ASA*-4-717037|%PIX-4-717037;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000786; sid: 5000786; rev: 2;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IP address end configuration {FAILED|OK}"; program: %ASA*-5-111004|%PIX-5-111004|%FWSM-5-111004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000787; sid: 5000787; rev: 3;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $FTP_PORT (msg: "[CISCO-PIXASA] FTP cmd_string command unsupported - failed strict inspection"; program: %ASA*-5-303004|%PIX-5-303004|%FWSM-5-303004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000788; sid: 5000788; rev: 4;)
#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORT (msg: "[CISCO-PIXASA] Access denied URL chars"; program: %ASA*-5-304002|%PIX-5-304002|%FWSM-5-304002; content: "http://"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5000789; sid: 5000789; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Asymmetric NAT rules matched for forward and reverse flows [0/1]"; program: %ASA*-5-305013|%PIX-5-305013|%FWSM-5-305013; threshold: type limit, track by_src, count 1, seconds 900; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000790; sid: 5000790; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] EAPoUDP association failed to establish"; program: %ASA*-5-334003|%PIX-5-334003|%FWSM-5-334003;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000791; sid: 5000791; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] EAPoUDP failed to get a response from host"; program: %ASA*-5-334006|%PIX-5-334006|%FWSM-5-334006;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000792; sid: 5000792; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] HTTP - matched string in policy-map verification failed"; program: %ASA*-5-415004|%PIX-5-415004|%FWSM-5-415004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000793; sid: 5000793; rev: 3;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad TCP hdr length - Possible network scan"; program: %ASA*-5-500003|%PIX-5-500003|%FWSM-5-500003; parse_src_ip: 1; parse_dst_ip: 2; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000794; sid: 5000794; rev: 5;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IKE area failed to find centry for message"; program: %ASA*-5-713010|%PIX-5-713010;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000796; sid: 5000796; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failure during phase 1 rekeying attempt due to collision"; program: %ASA*-5-713092|%PIX-5-713092; parse_src_ip: 1;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000797; sid: 5000797; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Ignoring received malformed firewall record"; program: %ASA*-5-713144|%PIX-5-713144|%FWSM-5-713144;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000798; sid: 5000798; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Create peer failure, already at maximum of number of peers"; program: %ASA*-5-718002|%PIX-5-718002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000800; sid: 5000800; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to send to IP"; program: %ASA*-5-718005|%PIX-5-718005|%FWSM-5-718005;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000801; sid: 5000801; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Socket open failure"; program: %ASA*-5-718007|%PIX-5-718007|%FWSM-5-718007;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000802; sid: 5000802; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Socket bind failure"; program: %ASA*-5-718008|%PIX-5-718008|%FWSM-5-718008;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000803; sid: 5000803; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send HELLO response failure"; program: %ASA*-5-718009|%PIX-5-718008|%FWSM-5-718008;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000804; sid: 5000804; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send HELLO request failure"; program: %ASA*-5-718011|%PIX-5-718011|%FWSM-5-718011;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000805; sid: 5000805; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send CFG UPDATE failure"; program: %ASA*-5-718024|%PIX-5-718024|%FWSM-5-718024;  classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000806; sid: 5000806; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send OOS indicator failure"; program: %ASA*-5-718028|%PIX-5-718028|%FWSM-5-718028;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000807; sid: 5000807; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send TOPOLOGY indicator failure"; program: %ASA*-5-718033|%PIX-5-718033|%FWSM-5-718033;  classtype: configuration-error; reference: url, wiki.quadrantsec.com/bin/view/Main/5000808; sid: 5000808; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Create of secure tunnel failure"; program: %ASA*-5-718048|%PIX-5-718048;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000809; sid: 5000809; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Delete of secure tunnel failure"; program: %ASA*-5-718050|%PIX-5-718050;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000810; sid: 5000810; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Queue send failure from ISR"; program: %ASA*-5-718057|%PIX-5-718057;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000811; sid: 5000811; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Inbound socket select fail"; program: %ASA*-5-718060|%PIX-5-718060|%FWSM-5-718060;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000812; sid: 5000812; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Inbound socket read fail"; program: %ASA*-5-718061|%PIX-5-718061|%FWSM-5-718061;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000813; sid: 5000813; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Cannot continue to run"; program: %ASA*-5-718065|%PIX-5-718065|%FWSM-5-718065;  classtype: hardware-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000814; sid: 5000814; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create access list for peer"; program: %ASA*-5-718074|%PIX-5-718074|%FWSM-5-718074;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000815; sid: 5000815; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create tunnel group for peer"; program: %ASA*-5-718076|%PIX-5-718076;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000816; sid: 5000816; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to delete tunnel group for peer"; program: %ASA*-5-718077|%PIX-5-718077;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000817; sid: 5000817; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create crypto map for peer"; program: %ASA*-5-718078|%PIX-5-718078;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000818; sid: 5000818; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to delete crypto map for peer"; program: %ASA*-5-718079|%PIX-5-718079;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000819; sid: 5000819; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create crypto policy for peer"; program: %ASA*-5-718080|%PIX-5-718080;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000820; sid: 5000820; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to delete crypto policy for peer"; program: %ASA*-5-718081|%PIX-5-718081;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000821; sid: 5000821; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to install LB NP rules"; program: %ASA*-5-718086|%PIX-5-718086;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000822; sid: 5000822; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to delete LB NP rules"; program: %ASA*-5-718087|%PIX-5-718087;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000823; sid: 5000823; rev: 2;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny IP [0/5]"; program: %ASA*-6-106012|%PIX-6-106012|%FWSM-6-106012;  classtype: bad-unknown; threshold: type limit, track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5000824; sid: 5000824; rev: 5;)
#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny TCP [no connection]"; program: %ASA*-6-106015|%PIX-6-106015|%FWSM-6-106015; normalize; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000825; sid: 5000825; rev: 5;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to determine the security context"; program: %ASA*-6-106025|%PIX-6-106025|%FWSM-6-106025;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000826; sid: 5000826; rev: 5;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to determine the security context"; program: %ASA*-6-106026|%PIX-6-106026|%FWSM-6-106026;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000827; sid: 5000827; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] access-list ACL {permitted | denied | est-allowed} protocol"; program: %ASA*-6-106100|%PIX-6-106100|%FWSM-6-106100;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000828; sid: 5000828; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auth from inside to outside failed [server failed] on interface"; program: %ASA*-6-109002|%PIX-6-109002|%FWSM-6-109002; parse_src_ip: 1; parse_dst_ip: 2; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000829; sid: 5000829; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auth from inside to outside failed [all servers failed] on interface"; program: %ASA*-6-109003|%PIX-6-109003|%FWSM-6-109002;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000830; sid: 5000830; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authentication failed for user [0/5]"; program: %ASA*-6-109006|%PIX-6-109006|%FWSM-6-109006;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000831; threshold: type limit, track by_src, count 5, seconds 300; sid: 5000831; rev: 5;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization permitted for user"; program: %ASA*-6-109007|%PIX-6-109007|%FWSM-6-109007;  classtype: successful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000832; sid: 5000832; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization denied for user from outside to inside on interface"; program: %ASA*-6-109008|%PIX-6-109008|%FWSM-6-109008;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000833; sid: 5000833; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization denied [not authenticated]"; program: %ASA*-6-109024|%PIX-6-109024|%FWSM-6-109024;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000834; sid: 5000834; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization denied for user"; program: %ASA*-6-109025|%PIX-6-109025|%FWSM-6-109025;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000835; sid: 5000835; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] User user locked out on exceeding number successive failed authentication attempts"; program: %ASA*-6-113006|%PIX-6-113006|%FWSM-6-113006;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000836; sid: 5000836; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] AAA unable to complete the request"; program: %ASA*-6-113013|%PIX-6-113013|%FWSM-6-113013;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000837; sid: 5000837; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] URL Server request failed URL"; program: %ASA*-6-304004|%PIX-6-304004|%FWSM-6-304004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000838; sid: 5000838; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RIP hdr failed"; program: %ASA*-6-312001|%PIX-6-312001|%FWSM-6-312001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000839; sid: 5000839; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] No management IP address configured for transparent firewall"; program: %ASA*-6-322004|%PIX-6-322004|%FWSM-6-322004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000840; sid: 5000840; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NAC is disabled for host"; program: %ASA*-6-335004|%PIX-6-335004|%FWSM-6-335004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000841; sid: 5000841; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Login denied [Brute Force] [10/1]"; program: %ASA*-6-605004|%PIX-6-605004|%FWSM-6-605004; parse_src_ip: 1; parse_port; after: track by_src, count 10, seconds 300; threshold: type limit, track by_src, count 1, seconds 86400;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000842; flowbits: set,brute_force,21600; sid: 5000842; rev: 9;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization failed"; program: %ASA*-6-610101|%PIX-6-610101|%FWSM-6-610101;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000843; sid: 5000843; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] User authentication failed [0/5]"; program: %ASA*-6-611102|%PIX-6-611102|%FWSM-6-610102;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000844; threshold: type limit, track by_src, count 5, seconds 300; sid: 5000844; rev: 5;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VNPClient XAUTH Failed"; program: %ASA*-6-611311|%PIX-6-611311;  classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000845; sid: 5000845; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient Secure Unit Authentication Disabled"; program: %ASA*-6-611317|%PIX-6-611317;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000846; sid: 5000846; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient User Authentication Disabled"; program: %ASA*-6-611319|%PIX-6-611319;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000847; sid: 5000847; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient Device Pass Thru Disabled"; program: %ASA*-6-611321|%PIX-6-611321;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000848; sid: 5000848; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient Extended XAUTH conversation initiated when SUA disabled"; program: %ASA*-6-611322|%PIX-6-611322;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000849; sid: 5000849; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Checksum Failure in database"; program: %ASA*-6-613001|%PIX-6-613001|%FWSM-6-613001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000850; sid: 5000850; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] vlan number not available for firewall interface"; program: %ASA*-6-615001|%PIX-6-615001|%FWSM-6-615001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000851; sid: 5000851; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] vlan number available for firewall interface"; program: %ASA*-6-615002|%PIX-6-615002|%FWSM-6-615002;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000852; sid: 5000852; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad register"; program: %ASA*-6-621007|%PIX-6-621007|%FWSM-6-621007;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000853; sid: 5000853; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Attempt to send an IKE packet from standby unit. Dropping the packet! [0/1]"; program: %ASA*-6-713235|%PIX-6-713235|%FWSM-6-713235; type limit, track by_src, count 1, seconds 900; classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000854; sid: 5000854; rev: 5;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Certificate received from Certificate Authority for trustpoint"; program: %ASA*-6-717003|%PIX-6-717003|%FWSM-6-717003;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000855; sid: 5000855; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PKCS 12 export failed"; program: %ASA*-6-717004|%PIX-6-717004|%FWSM-6-717004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000856; sid: 5000856; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PKCS 12 import failed"; program: %ASA*-6-717006|%PIX-6-717006|%FWSM-6-717006;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000857; sid: 5000857; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] uauth_lookup_net fail for uauth_in"; program: %ASA*-7-109014|%PIX-7-109014|%FWSM-7-109014;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000858; sid: 5000858; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Uauth null proxy error"; program: %ASA*-7-109021|%PIX-7-109021|%FWSM-7-109021;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000859; sid: 5000859; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send failure"; program: %ASA*-7-713039|%PIX-7-713039|%FWSM-7-713039;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000861; sid: 5000861; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Cert validation failure handle invalid for Main/Aggressive Mode Initiator/Responder!"; program: %ASA*-7-713094|%PIX-7-713094|%FWSM-7-713094;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000862; sid: 5000862; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Attempt to get Phase 1 ID data failed while hash computation"; program: %ASA*-7-713104|%PIX-7-713104;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000863; sid: 5000863; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Processing firewall record"; program: %ASA*-7-713143|%PIX-7-713143|%FWSM-7-713143;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000864; sid: 5000864; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote user has been granted access by the Firewall Server [Brute Force] [10/1]"; after: track by_src, count 10, seconds 300; threshold: type limit, track by_src, count 5, seconds 300; program: %ASA*-7-713160|%PIX-7-713160|%FWSM-7-713160;  classtype: successful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5000865; flowbits: set,brute_force,21600; sid: 5000865; rev: 6;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] The Firewall Server has requested a list of active user sessions"; program: %ASA*-7-713164|%PIX-7-713164|%FWSM-7-713164;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000866; sid: 5000866; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Got bad refCnt assigning"; program: %ASA*-7-713190|%PIX-7-713190|%FWSM-7-713190;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000867; sid: 5000867; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] subroutine Q Send failure RetCode"; program: %ASA*-7-715004|%PIX-7-715004|%FWSM-7-715004;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000868; sid: 5000868; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] subroutine name Bad message code Cod"; program: %ASA*-7-715005|%PIX-7-715005|%FWSM-7-715005;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000869; sid: 5000869; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IKE received response to a request from the utility"; program: %ASA*-7-715042|%PIX-7-715042;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000870; sid: 5000870; rev: 2;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ERROR malformed Keepalive payload"; program: %ASA*-7-715045|%PIX-7-715045|%FWSM-7-715045;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000871; sid: 5000871; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Claims to be IOS but failed authentication"; program: %ASA*-7-715050|%PIX-7-715050|%FWSM-7-715050;  classtype: misc-attack; reference: url, wiki.quadrantsec.com/bin/view/Main/5000872; sid: 5000872; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropped received IKE fragment"; program: %ASA*-7-715060|%PIX-7-715060|%FWSM-7-715060;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000873; sid: 5000873; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error assembling fragments! Fragment numbers are non-continuous"; program: %ASA*-7-715062|%PIX-7-715062|%FWSM-7-715062;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000874; sid: 5000874; rev: 3;)
#alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IKE state_machine subtype FSM error history"; program: %ASA*-7-715065|%PIX-7-715065|%FWSM-7-715065;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000875; sid: 5000875; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal interprocess communication queue send failure"; program: %ASA*-7-718001|%PIX-7-718001|%FWSM-7-718001;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000876; sid: 5000876; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send KEEPALIVE request failure"; program: %ASA*-7-718018|%PIX-7-718018|%FWSM-7-718018;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000877; sid: 5000877; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send KEEPALIVE response failure"; program: %ASA*-7-718020|%PIX-7-718020|%FWSM-7-718020;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000878; sid: 5000878; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create group"; program: %ASA*-7-718047|%PIX-7-718047|%FWSM-7-718047;  classtype: bad-unknown; reference: url, wiki.quadrantsec.com/bin/view/Main/5000879; sid: 5000879; rev: 3;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Creation of group policy"; program: %ASA*-7-718046|%PIX-7-718046|%FWSM-7-718046;  classtype: system-event; reference: url, wiki.quadrantsec.com/bin/view/Main/5000880; sid: 5000880; rev: 3;)
#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORT (msg: "[CISCO-PIXASA] Access denied URL"; program: %ASA*-5-304002|%PIX-5-304002|%FWSM-7-304002; content: "http://"; classtype: policy-violation; normalize; reference: url, wiki.quadrantsec.com/bin/view/Main/5001086; sid: 5001086; rev: 5;)
#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] AAA user authentication successful [0/5]"; program: %ASA*-6-113004|%PIX-6-113004|%FWSM-6-113004; classtype: successful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5001087; threshold: type limit, track by_src, count 5, seconds 300; parse_src_ip: 1; sid: 5001087; rev: 6;)
#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] AAA user authentication Reject [0/5]"; program: %ASA*-6-113005|%PIX-6-113005|%FWSM-6-113005; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5001092; threshold: type limit, track by_src, count 5, seconds 300; parse_src_ip: 1; sid: 5001092; rev: 5;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] AAA user authentication Reject - Brute force [10/1]"; program: %ASA*-6-113005|%PIX-6-113005|%FWSM-6-113005; classtype: unsuccessful-user; normalize; reference: url, wiki.quadrantsec.com/bin/view/Main/5001593; after: track by_src, count 10, seconds 300; threshold: type limit, track by_src, count 1, seconds 86400; fwsam: src, 1 day; flowbits: set,brute_force,21600; sid: 5001593; rev: 8;)
#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Disconnect by SSH server"; program: %ASA*-6-315011|%PIX-6-315011|%FWSM-6-315011; classtype: system-event; normalize; reference: url, wiki.quadrantsec.com/bin/view/Main/5001088; sid: 5001088; rev: 3;)
#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORT (msg: "[CISCO-PIXASA] Access denied URL chars - HTTPS"; program: %ASA*-5-304002|%PIX-5-304002|%FWSM-5-304002; content: "https://"; classtype: policy-violation; reference: url, wiki.quadrantsec.com/bin/view/Main/5001089; sid: 5001089; rev: 3;)
#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORT (msg: "[CISCO-PIXASA] Access denied URL - HTTPS"; program: %ASA*-5-304002|%PIX-5-304002|%FWSM-5-304002; content: "https://"; classtype: policy-violation; normalize; reference: url, wiki.quadrantsec.com/bin/view/Main/5001091; sid: 5001091; rev: 4;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] User authentication failed - Brute force [5/1]"; program: %ASA*-6-611102|%PIX-6-611102|%FWSM-6-610102; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5001654; threshold: type limit, track by_src, count 1, seconds 86400; after: track by_src, count 5, seconds 300; flowbits: set,brute_force,21600; sid: 5001654; rev: 5;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] TCP access denied by ACL - Brute force [25/1]"; program: %ASA*-3-710003; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5001714; normalize; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type limit, track by_src, count 1, seconds 86400; after: track by_src, count 25, seconds 300; flowbits: set,brute_force,21600; sid: 5001714; rev: 7;)
#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] TCP access denied by ACL"; program: %ASA*-3-710003; classtype: unsuccessful-user; reference: url, wiki.quadrantsec.com/bin/view/Main/5001715; parse_src_ip: 1; parse_dst_ip: 2; parse_port; sid: 5001715; rev: 1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORT (msg: "[CISCO-PIXASA] WebVPN console/admin failed"; program: %ASA*-3-113021; classtype: unsuccessful-admin; reference: url, wiki.quadrantsec.com/bin/view/Main/5001963; sid: 5001963; rev: 1;)

APT Browse - Built by Thomas Orozco.