add faked snort data (#1113)

nasbench · web-flow · commit c3670bef1539 · 2026-01-09T02:22:24.000+01:00
* add faked snort data

* fix metadata
diff --git a/datasets/cisco_secure_firewall_threat_defense/intrusion_event/intrusion_events.log b/datasets/cisco_secure_firewall_threat_defense/intrusion_event/intrusion_events.log
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:2b60073787945069e3589037b1b337468f40beb60adcbfe8d900d7fd97827630
-size 1260867
+oid sha256:fbb3f751fe1eba2da9fb5214ca14e86d9e9bd3f9976e67c3ffe3874ffc2e5a8b
+size 1278440
diff --git a/datasets/emerging_threats/SaltTyphoon/salttyphoon_correlation.log b/datasets/emerging_threats/SaltTyphoon/salttyphoon_correlation.log
diff --git a/datasets/emerging_threats/SaltTyphoon/salttyphoon_correlation.yml b/datasets/emerging_threats/SaltTyphoon/salttyphoon_correlation.yml
@@ -0,0 +1,13 @@
+author: Nasreddine Bencherchali, Splunk
+id: d403fecb-720c-48fb-9d1a-5671f0195513
+date: '2026-01-08'
+description: Generated datasets for Cisco IOS switch exploitation. Correlating Cisco Secure Firewall logs with Cisco IOS logs to detect SaltTyphoon activities.
+environment: NA
+directory: SaltTyphoon
+mitre_technique:
+- T1021.004
+datasets:
+- name: salttyphoon_correlation
+  path: /datasets/emerging_threats/SaltTyphoon/salttyphoon_correlation.log
+  sourcetype: stash
+  source: not_applicable
