topic IOC_STATE_RECORD in Network Security

IOC_STATE_RECORD

VyasrvenkatRavi37442 — Fri, 21 Feb 2020 17:49:23 GMT

Hi All,

I have observed a internal to internal machine traffic and observed the event IOC_STATE_RECORD on my SIEM console.

This event flagged by the cisco firepower center (FMC), checked the traffic logs between the these two internal machines. Observed only IOC_STATE_RECORD related events and no firewall logs were found. Please let me know what is IOC_STATE_RECORD ? Is it something, do I need to pay attention for these kind of events. ?

Re: IOC_STATE_RECORD

luizsil — Thu, 09 Jan 2020 11:24:04 GMT

Hello,

IOC States for Indication of Compromise.

Here is the Event Information:

https://www.cisco.com/c/en/us/td/docs/security/firepower/60/api/eStreamer/EventStreamerIntegrationGuide/RNA-Records.html?bookSearch=true#pgfId-6177494

To better have a translation of what an IOC_ID stands for you can grab them all at:

Go to FMC CLI and in expert mode raise your self to root and type the following command:

OmniQuery.pl -db mdb -e "select ioc_id,category,event_type,description from ioc\G;"

So you need to have the IOC_ID and find out what Compromise that is being detected, and if it is a false positive or not.

You can definitely after this program your SIEM to translate these events from IOC_ID to an actual text.

In some SIEMs the IOC_ID may be called another property of the event. example: iocState.value=11

Best Regards,

Luiz Silva

Best Regards,

Luiz

Re: IOC_STATE_RECORD

VyasrvenkatRavi37442 — Sun, 12 Jan 2020 13:02:03 GMT

Thank you for your reply.

Yes I have found iocState.value=11 on my payload. I have searched the value
of 11 from the link which you have provided.

its says New TCP Server for the value 11.

Please correct me am I referring to the correct content.

Re: IOC_STATE_RECORD

luizsil — Mon, 13 Jan 2020 08:19:12 GMT

From the Table I extracted on FMC, ioc_id 11 =

Impact 2 Attack — Impact 2 Intrusion Event - attempted-user

For more details on the event, you can search for Intrusion Events on your FMC and search for the time frame indicated.

Best Regards,

Luiz Silva

Re: IOC_STATE_RECORD

MSS_PROOF — Wed, 21 Jul 2021 16:57:34 GMT

Can you provide us with official documentation for this issue?