# Sagan cisco-pixasa.rules
# Copyright (c) 2009-2010, Softwink, Inc.
# All rights reserved.
#
# Please submit any custom rules or ideas to sagan-submit@softwink.com or the sagan-sigs mailing list
#
#*************************************************************
#  Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
#  following conditions are met:
#
#  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following
#    disclaimer.
#  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
#    following disclaimer in the documentation and/or other materials provided with the distribution.
#  * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived
#    from this software without specific prior written permission.
#
#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES,
#  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
#  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
#  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
#  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#*************************************************************

alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to initialize 4GE SSM I/O card"; content: "%ASA-1-114001:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000416; sid: 5000416; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to initialize SFP in 4GE SSM I/O card"; content: "%ASA-1-114002:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000417; sid: 5000417; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to run cached commands in 4GE SSM I/O card"; content: "%ASA-1-114003:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000418; sid: 5000418; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function"; content: "%ASA-1-216001:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000419; sid: 5000419; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] AAA Marking protocol server ip-addr in server group tag as FAILED"; content: "%ASA-2-113022:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000420; sid: 5000420; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in - function message"; content: "%ASA-2-216001:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000421; sid: 5000421; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot locate AK47 instance"; content: "%ASA-2-716500:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000422; sid: 5000422; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot attach AK47 instance"; content: "%ASA-2-716501:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000423; sid: 5000423; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot allocate default arena"; content: "%ASA-2-716502:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000424; sid: 5000424; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot allocate fiber descriptors pool"; content: "%ASA-2-716503:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000425; sid: 5000425; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber library cannot allocate fiber stacks pool"; content: "%ASA-2-716504:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000426; sid: 5000426; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber has joined fiber in unfinished state"; content: "%ASA-2-716505:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000427; sid: 5000427; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber scheduler has reached unreachable code. Cannot continue terminating"; content: "%ASA-2-716507:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000428; sid: 5000428; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber scheduler is scheduling rotten fiber. Cannot continuing terminating"; content: "%ASA-2-716508:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000429; sid: 5000429; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber scheduler is scheduling alien fiber. Cannot continue terminating"; content: "%ASA-2-716509:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000430; sid: 5000430; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber scheduler is scheduling finished fiber. Cannot continue terminating"; content: "%ASA-2-716510:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000431; sid: 5000431; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber has joined fiber waited upon by someone else"; content: "%ASA-2-716512:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000432; sid: 5000432; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function Fiber in callback blocked on other channel"; content: "%ASA-2-716513:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000433; sid: 5000433; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM failed to allocate memory for AK47 instance"; content: "%ASA-2-716515:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000434; sid: 5000434; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM has corrupted ROL array. Cannot continue terminating"; content: "%ASA-2-716516:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000435; sid: 5000435; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM cached block has no associated arena"; content: "%ASA-2-716517:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000436; sid: 5000436; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM pool has no associated arena"; content: "%ASA-2-716518:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000437; sid: 5000437; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM has corrupted pool list. Cannot continue terminating"; content: "%ASA-2-716519:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000438; sid: 5000438; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM pool has no block list"; content: "%ASA-2-716520:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000439; sid: 5000439; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM no realloc allowed in named pool"; content: "%ASA-2-716521:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000440; sid: 5000440; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function OCCAM corrupted standalone block"; content: "%ASA-2-716522:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000441; sid: 5000441; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] UNICORN_SYSLOGID_PERM_STORAGE_SERVER_LOAD_FAIL"; content: "%ASA-2-716526:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000442; sid: 5000442; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] UNICORN_SYSLOGID_PERM_STORAGE_SERVER_STORE_FAIL"; content: "%ASA-2-716527:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000443; sid: 5000443; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unexpected fiber scheduler error; possible out-of-memory condition"; content: "%ASA-2-716528:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000444; sid: 5000444; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to get port statistics in 4GE SSM I/O card"; content: "%ASA-3-114006:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000445; sid: 5000445; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to get current msr in 4GE SSM I/O card"; content: "%ASA-3-114007:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000446; sid: 5000446; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to enable port after link is up in 4GE SSM I/O card"; content: "%ASA-3-114008:"; classtype: hardware-error; reference: url, wiki.softwink.com/bin/view/Main/5000447; sid: 5000447; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set multicast address in 4GE SSM I/O card"; content: "%ASA-3-114009:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000448; sid: 5000448; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set multicast hardware address in 4GE SSM I/O card"; content: "%ASA-3-114010:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000449; sid: 5000449; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to delete multicast address in 4GE SSM I/O card"; content: "%ASA-3-114011:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000450; sid: 5000450; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to delete multicast hardware address in 4GE SSM I/O card"; content: "%ASA-3-114012:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000451; sid: 5000451; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set mac address table in 4GE SSM I/O card"; content: "%ASA-3-114013:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000452; sid: 5000452; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set mac address in 4GE SSM I/O card"; content: "%ASA-3-114014:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000453; sid: 5000453; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set mode in 4GE SSM I/O card"; content: "%ASA-3-114015:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000454; sid: 5000454; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set multicast mode in 4GE SSM I/O card"; content: "%ASA-3-114016:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000455; sid: 5000455; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to get link status in 4GE SSM I/O card"; content: "%ASA-3-114017:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000456; sid: 5000456; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set port speed in 4GE SSM I/O card"; content: "%ASA-3-114018:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000457; sid: 5000457; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set media type in 4GE SSM I/O card"; content: "%ASA-3-114019:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000458; sid: 5000458; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error in function message"; content: "%ASA-3-216001:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000459; sid: 5000459; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] I2C_API_name error"; content: "%ASA-3-219002:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000460; sid: 5000460; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPN Handle error protocol"; content: "%ASA-3-316002:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000461; sid: 5000461; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot experienced a control channel communications failure"; content: "%ASA-3-323001:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000462; sid: 5000462; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot failed to write software. Hw-module reset is required before further use"; content: "%ASA-3-323004:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000463; sid: 5000463; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot can not be powered on completely"; content: "%ASA-3-323005:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000464; sid: 5000464; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Type Module in slot experienced a data channel communication failure, data channel is DOWN"; content: "%ASA-3-323006:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000465; sid: 5000465; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPS card not up and fail-close mode used, dropping ICMP packet [1]"; content: "%ASA-3-420001:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000466; sid: 5000466; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPS card not up and fail-close mode used, dropping ICMP packet [2]"; content: "%ASA-3-420001:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000467; sid: 5000467; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] TCP|UDP flow from interface is dropped because application has failed"; content: "%ASA-3-421001:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000468; sid: 5000468; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] TCP|UDP flow from interface  is skipped because application has failed"; content: "%ASA-3-421007:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000469; sid: 5000469; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authentication to SSO server failed"; content: "%ASA-3-716056:"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000470; sid: 5000470; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Email Proxy session pointer has terminated due to reason error"; content: "%ASA-3-719002:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000471; sid: 5000471; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Message ERROR message [1]"; content: "%ASA-3-722007:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000472; sid: 5000472; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Message ERROR message [2]"; content: "%ASA-3-722008:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000473; sid: 5000473; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Message ERROR message [3]"; content: "%ASA-3-722009:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000474; sid: 5000474; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot is not able to shut down. Module Error"; content: "%ASA-4-413001:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000475; sid: 5000475; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot is not able to reload. Module Error"; content: "%ASA-4-413002:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000476; sid: 5000476; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Module in slot failed to write software. Trying again"; content: "%ASA-4-413004:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000477; sid: 5000477; rev: 1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPS requested to drop ICMP packets"; content: "%ASA-4-420002:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000478; sid: 5000478; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} invalid NBNS pkt"; content: "%ASA-4-423001:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000479; sid: 5000479; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} mismatched NBNS pkt"; content: "%ASA-4-423002:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000480; sid: 5000480; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} invalid NBDGM pkt"; content: "%ASA-4-423003:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000481; sid: 5000481; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} mismatched NBDGM pkt"; content: "%ASA-4-423004:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000482; sid: 5000482; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {Allowed | Dropped} NBDGM pkt"; content: "%ASA-4-423005:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000483; sid: 5000483; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Packet denied. [Ingress|Egress] interface is in a backup state"; content: "%ASA-4-424001:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000484; sid: 5000484; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Connection to the backup interface is denied"; content: "%ASA-4-424002:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000485; sid: 5000485; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny traffic, licensed host limit exceeded."; content: "%ASA-4-450001:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000486; sid: 5000486; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Received DH key with bad length"; content: "%ASA-4-713240:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000487; sid: 5000487; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] META-DATA Unexpected error in Next Card Code mode while not doing SDI"; content: "%ASA-4-713247:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000488; sid: 5000488; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] META-DATA Received authentication failure message"; content: "%ASA-4-713251:"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000489; sid: 5000489; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to initialize with Chunk Manager"; content: "%ASA-4-720001:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000490; sid: 5000490; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to allocate chunk from Chunk Manager"; content: "%ASA-4-720007:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000491; sid: 5000491; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to register to High Availability Framework"; content: "%ASA-4-720008:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000492; sid: 5000492; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to create version control block"; content: "%ASA-4-720009:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000493; sid: 5000493; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to allocate memory"; content: "%ASA-4-720011:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000494; sid: 5000494; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to insert certificate in trust point"; content: "%ASA-4-720013:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000495; sid: 5000495; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to queue add to message queue"; content: "%ASA-4-720033:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000496; sid: 5000496; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to send type message id to standby unit"; content: "%ASA-4-720043:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000497; sid: 5000497; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to receive message from active unit"; content: "%ASA-4-720044:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000498; sid: 5000498; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to sync SDI node secret file for server on the standby unit"; content: "%ASA-4-720047:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000499; sid: 5000499; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to add new SDI node secret file for server id on the standby unit"; content: "%ASA-4-720051:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000500; sid: 5000500; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to delete SDI node secret file for server id on the standby unit"; content: "%ASA-4-720052:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000501; sid: 5000501; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to add cTCP IKE rule during bulk sync"; content: "%ASA-4-720053:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000502; sid: 5000502; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to add new cTCP record"; content: "%ASA-4-720054:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000503; sid: 5000503; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN Stateful failover can only be run in single/non-transparent mode"; content: "%ASA-4-720055:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000504; sid: 5000504; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update cTCP database"; content: "%ASA-4-720064:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000505; sid: 5000505; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to add new cTCP IKE rule"; content: "%ASA-4-720065:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000506; sid: 5000506; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to activate IKE database"; content: "%ASA-4-720066:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000507; sid: 5000507; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to deactivate IKE database"; content: "%ASA-4-720067:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000508; sid: 5000508; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to parse peer message"; content: "%ASA-4-720068:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000509; sid: 5000509; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to activate cTCP database"; content: "%ASA-4-720069:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000510; sid: 5000510; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to deactivate cTCP database"; content: "%ASA-4-720070:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000511; sid: 5000511; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Fail to insert certificate in trust point on the standby unit"; content: "%ASA-4-720073:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000512; sid: 5000512; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error parsing SVC connect request"; content: "%ASA-4-722001:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000513; sid: 5000513; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error consolidating SVC connect request."; content: "%ASA-4-722002:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000514; sid: 5000514; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error authenticating SVC connect request"; content: "%ASA-4-722003:"; classtype: unsuccessful-admin; reference: url, wiki.softwink.com/bin/view/Main/5000515; sid: 5000515; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error responding to SVC connect request"; content: "%ASA-4-722004:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000516; sid: 5000516; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad SVC frame length length expected"; content: "%ASA-4-722016:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000517; sid: 5000517; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad SVC framing 525446, reserved 0"; content: "%ASA-4-722017:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000518; sid: 5000518; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad SVC protocol version"; content: "%ASA-4-722018:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000519; sid: 5000519; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] CRYPTO An attempt to allocate a large memory block failed"; content: "%ASA-5-402128:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000520; sid: 5000520; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] META-DATA Rekey initiation is being disabled during CRACK authentication"; content: "%ASA-5-713248:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000521; sid: 5000521; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Integrity Firewall Server is not available. VPN Tunnel creation rejected for client"; content: "%ASA-5-713252:"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000522; sid: 5000522; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Integrity Firewall Server is not available. Entering ALLOW mode. VPN Tunnel created for client"; content: "%ASA-5-713253:"; classtype: successful-user; reference: url, wiki.softwink.com/bin/view/Main/5000523; sid: 5000523; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to initialize default timer"; content: "%ASA-5-720016:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000525; sid: 5000525; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update LB runtime data"; content: "%ASA-5-720017:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000526; sid: 5000526; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to get a buffer from the underlying core high availability subsystem"; content: "%ASA-5-720018:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000527; sid: 5000527; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update cTCP statistics"; content: "%ASA-5-720019:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000528; sid: 5000528; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to send type timer message"; content: "%ASA-5-720020:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000529; sid: 5000529; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] HA non-block send failed for peer msg. HA error code."; content: "%ASA-5-720021:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000530; sid: 5000530; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Fail to look up CTCP flow handle"; content: "%ASA-5-720035:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000531; sid: 5000531; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to process state update message from the active peer"; content: "%ASA-5-720036:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000532; sid: 5000532; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update cTCP dynamic data"; content: "%ASA-5-720071:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000533; sid: 5000533; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Timeout waiting for Integrity Firewall Server to become available"; content: "%ASA-5-720072:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000534; sid: 5000534; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] CRYPTO An attempt to release a DMA memory block failed, location address"; content: "%ASA-6-402129:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000535; sid: 5000535; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN access DENIED to specified location url"; content: "%ASA-6-716004:"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000536; sid: 5000536; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN ACL Parse Error"; content: "%ASA-6-716005:"; classtype: configuration-error; reference: url, wiki.softwink.com/bin/view/Main/5000537; sid: 5000537; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN session not allowed. WebVPN ACL parse error"; content: "%ASA-6-716009:"; classtype: configuration-error; reference: url, wiki.softwink.com/bin/view/Main/5000538; sid: 5000538; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Reboot pending, new sessions disabled. Denied user login"; content: "%ASA-6-716040:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000539; sid: 5000539; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error adding to ACL"; content: "%ASA-6-716050:"; classtype: configuration-error; reference: url, wiki.softwink.com/bin/view/Main/5000540; sid: 5000540; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error adding dynamic ACL for user"; content: "%ASA-6-716051:"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000541; sid: 5000541; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Email Proxy feature is disabled on interface"; content: "%ASA-6-719010:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000542; sid: 5000542; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN authorization failed"; content: "%ASA-6-719019:"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000543; sid: 5000543; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN authorization completed successfully"; content: "%ASA-6-719020:"; classtype: successful-user; reference: url, wiki.softwink.com/bin/view/Main/5000544; sid: 5000544; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN has not been successfully authenticated. Access denied"; content: "%ASA-6-719023:"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000545; sid: 5000545; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Email Proxy piggyback auth fail session"; content: "%ASA-6-719024:"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000546; sid: 5000546; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Email Proxy DNS name resolution failed for hostname"; content: "%ASA-6-719025:"; classtype: configuration-errorn; reference: url, wiki.softwink.com/bin/view/Main/5000547; sid: 5000547; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Starting VPN Stateful Failover Subsystem"; content: "%ASA-6-720002:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000548; sid: 5000548; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Initialization of VPN Stateful Failover Component completed successfully"; content: "%ASA-6-720003:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000549; sid: 5000549; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover main thread started"; content: "%ASA-6-720004:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000550; sid: 5000550; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover timer thread started"; content: "%ASA-6-720005:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000551; sid: 5000551; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover sync thread started"; content: "%ASA-6-720006:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000552; sid: 5000552; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover client is being disabled"; content: "%ASA-6-720010:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000553; sid: 5000553; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] Failed to update IPSec failover runtime data on the standby unit"; content: "%ASA-6-720012:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000554; sid: 5000554; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover client is transitioning to active state"; content: "%ASA-6-720039:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000555; sid: 5000555; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN failover client is transitioning to standby state"; content: "%ASA-6-720040:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000556; sid: 5000556; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN Stateful failover Message Thread is being disabled"; content: "%ASA-6-720056:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000557; sid: 5000557; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN Stateful failover Timer Thread is disabled"; content: "%ASA-6-720058:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000559; sid: 5000559; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [VPN-unit] VPN Stateful failover Sync Thread is disabled."; content: "%ASA-6-720060:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000561; sid: 5000561; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Global Compression Disabled"; content: "%ASA-6-722025:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000563; sid: 5000563; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Device failed SSL handshake"; content: "%ASA-6-725006:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000564; sid: 5000564; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to inject {TCP|UDP} packet"; content: "%ASA-7-421004:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000565; sid: 5000565; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] File access DENIED, filename"; content: "%ASA-7-716021:"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000566; sid: 5000566; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to browse the network"; content: "%ASA-7-716024:"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000567; sid: 5000567; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to browse domain domain"; content: "%ASA-7-716025:"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000568; sid: 5000568; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to browse directory"; content: "%ASA-7-716026:"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000569; sid: 5000569; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to view file"; content: "%ASA-7-716027:"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000570; sid: 5000570; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to remove file"; content: "%ASA-7-716028:"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000571; sid: 5000571; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to rename file"; content: "%ASA-7-716029:"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000572; sid: 5000572; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to modify file"; content: "%ASA-7-716030:"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000573; sid: 5000573; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to create file"; content: "%ASA-7-716031:"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000574; sid: 5000574; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to create folder"; content: "%ASA-7-716032:"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000575; sid: 5000575; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to remove folder"; content: "%ASA-7-716033:"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000576; sid: 5000576; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] File Access User failed to login into the server"; content: "%ASA-7-716037:"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000577; sid: 5000577; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Session Termination"; content: "%ASA-7-722030:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000579; sid: 5000579; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SVC Session Termination Out"; content: "%ASA-7-722031:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000580; sid: 5000580; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN Citrix encountered bad flow control flow"; content: "%ASA-7-723004:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000581; sid: 5000581; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN Citrix SOCKS errors"; content: "%ASA-7-723006:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000582; sid: 5000582; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN Citrix receives bad SOCKS socks message length"; content: "%ASA-7-723011:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000583; sid: 5000583; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] WebVPN Citrix received bad SOCKS socks message format"; content: "%ASA-7-723012:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000584; sid: 5000584; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SSL lib error"; content: "%ASA-7-725014:"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000585; sid: 5000585; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dynamic DNS Update failed"; content: "3-331001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000586; sid: 5000586; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Switching to ACTIVE";content: "%ASA-1-104001:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000587; sid: 5000587; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA]%PIX|ASA-1-104002 [Primary] Switching to STNDBY [cause string]."; content: "%ASA-1-104002:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000588; sid: 5000588; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA]%PIX|ASA-1-104003 [Primary] Switching to FAILED"; content: "%ASA-1-104003:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000589; sid: 5000589; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA]%PIX|ASA-1-104004 [Primary] Switching to OK."; content: "%ASA-1-104004:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000590; sid: 5000590; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA]%PIX|ASA-1-105037 The primary and standby units are switching back and forth as the active unit"; content: "%ASA-1-105037:"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000591; sid: 5000591; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed Identification Test"; content: "2-218004:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000592; sid: 5000592; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover cable OK"; content: "1-101001:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000595; sid: 5000595; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Bad failover cable"; content: "1-101002:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000596; sid: 5000596; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover cable not connected [this unit]"; content: "1-101003:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000597; sid: 5000597; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover cable not connected [other unit]"; content: "1-101004:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000598; sid: 5000598; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Error reading failover cable status"; content: "1-101005:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000599; sid: 5000599; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Power failure/System reload other side"; content: "1-102001:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000600; sid: 5000600; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] No response from other firewall"; content: "1-103001:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000601; sid: 5000601; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Other firewall network interface OK"; content: "1-103002:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000602; sid: 5000602; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Other firewall network interface failed"; content: "1-103003:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000603; sid: 5000603; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Other firewall reports this firewall failed"; content: "1-103004:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000604; sid: 5000604; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Other firewall reporting failure"; content: "1-103005:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000605; sid: 5000605; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to ACTIVE"; content: "1-104001:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000606; sid: 5000606; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to STNDBY"; content: "1-104002:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000607; sid: 5000607; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to FAILED"; content: "1-104003:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000608; sid: 5000608; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Switching to OK"; content: "1-104004:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000609; sid: 5000609; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Disabling failover"; content: "1-105001:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000610; sid: 5000610; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Enabling failover"; content: "1-105002:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000611; sid: 5000611; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Lost Failover communications with mate on interface"; content: "1-105005:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000612; sid: 5000612; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover cable communication failure"; content: "1-105011:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000614; sid: 5000614; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [failover_unit] Standby unit failed to sync due to a locked config"; content: "1-105021:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000615; sid: 5000615; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failover LAN interface is up"; content: "1-105031:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000616; sid: 5000616; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LAN Failover interface is down"; content: "1-105032:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000617; sid: 5000617; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Receive a LAN_FAILOVER_UP message from peer"; content: "1-105034:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000618; sid: 5000618; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Receive a LAN failover interface down msg from peer"; content: "1-105035:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000619; sid: 5000619; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] dropped a LAN Failover command message"; content: "1-105036:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000620; sid: 5000620; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Unable to verify the Interface count with mate. Failover may be disabled in mate"; content: "1-105039:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000621; sid: 5000621; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Mate failover version is not compatible"; content: "1-105040:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000622; sid: 5000622; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover interface OK"; content: "1-105042:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000623; sid: 5000623; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover interface failed"; content: "1-105043:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000624; sid: 5000624; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny protocol reverse path check"; content: "1-106021:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000625; sid: 5000625; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny protocol connection spoof"; content: "1-106022:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000626; sid: 5000626; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] The number of ACL log deny-flows has reached limit"; content: "1-106101:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000627; sid: 5000627; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RIP auth failed"; content: "1-107001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000628; sid: 5000628; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RIP pkt failed"; content: "1-107002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000629; sid: 5000629; rev: 1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Inbound TCP connection denied"; content: "2-106001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000631; sid: 5000631; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Connection denied by outbound ACL"; content: "2-106002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000632; sid: 5000632; rev: 1;)
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny inbound UDP"; content: "2-106006:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000633; sid: 5000633; rev: 1;)
alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg: "[CISCO-PIXASA] Deny inbound UDP from outside due to DNS {Response|Query}"; content: "2-106007:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000634; sid: 5000634; rev: 1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping echo request"; content: "2-106013:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000635; sid: 5000635; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny IP spoof"; content: "2-106016:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000636; sid: 5000636; rev: 1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny IP due to Land Attack"; content: "2-106017:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000637; sid: 5000637; rev: 1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ICMP denied by outbound ACL"; content: "2-106018:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000638; sid: 5000638; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny IP teardrop fragment"; content: "2-106020:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000639; sid: 5000639; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad route_compress"; content: "2-215001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000640; sid: 5000640; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed Identification Test in slot"; content: "2-218001:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000641; sid: 5000641; rev: 1;)
alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg: "[CISCO-PIXASA] Dropped DNS responses with mis-matched id"; content: "2-410002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000642; sid: 5000642; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Configuration replication failed for command"; content: "2-709007:"; pcre: "/%PIX-|%ASA-/"; classtype: configuration-error ; reference: url, wiki.softwink.com/bin/view/Main/5000643; sid: 5000643; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unexpected event"; content: "2-717011:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000644; sid: 5000644; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] [Primary] Failover message block alloc failed"; content: "3-105010:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000645; sid: 5000645; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny inbound protocol"; content: "3-106010:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000646; sid: 5000646; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny inbound [No xlate]"; content: "3-106011:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000647; sid: 5000647; rev: 1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny inbound ICMP"; content: "3-106014:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000648; sid: 5000648; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auth from inside to outside failed [too many pending auths]"; content: "3-109010:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000649; sid: 5000649; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Can't find authorization ACL for user"; content: "3-109016:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000650; sid: 5000650; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Downloaded ACL has parsing error"; content: "3-109019:"; pcre: "/%PIX-|%ASA-/"; classtype: configuration-error; reference: url, wiki.softwink.com/bin/view/Main/5000651; sid: 5000651; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Downloaded ACL has config error"; content: "3-109020:"; pcre: "/%PIX-|%ASA-/"; classtype: configuration-error; reference: url, wiki.softwink.com/bin/view/Main/5000652; sid: 5000652; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to install ACL, downloaded for user"; content: "3-109032:"; pcre: "/%PIX-|%ASA-/"; classtype: configuration-error; reference: url, wiki.softwink.com/bin/view/Main/5000653; sid: 5000653; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Kerberos error. Clock skew with server greater than 300 seconds"; content: "3-113020:"; pcre: "/%PIX-|%ASA-/"; classtype: configuration-error; reference: url, wiki.softwink.com/bin/view/Main/5000654; sid: 5000654; rev: 1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg: "[CISCO-PIXASA] FTP data connection failed"; content: "3-201005:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000655; sid: 5000655; rev: 1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg: "[CISCO-PIXASA] RCMD backconnection failed "; content: "3-201006:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000656; sid: 5000656; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU sw_module_name error"; content: "3-210001:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000657; sid: 5000657; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU allocate block [bytes] failed"; content: "3-210002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000658; sid: 5000658; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU allocate connection failed"; content: "3-210005:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000659; sid: 5000659; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU look NAT  failed"; content: "3-210006:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000660; sid: 5000660; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU allocate xlate failed"; content: "3-210007:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000661; sid: 5000661; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU make UDP connection for outside to inside failed"; content: "3-210010:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000662; sid: 5000662; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU PAT port reserve failed"; content: "3-210020:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000663; sid: 5000663; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] LU create static xlate interface failed"; content: "3-210021:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000664; sid: 5000664; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Memory allocation Error"; content: "3-211001:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000665; sid: 5000665; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to open SNMP channel"; content: "3-212001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000666; sid: 5000666; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unable to open SNMP trap channel"; content: "3-212002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000667; sid: 5000667; rev: 1;)
alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg: "[CISCO-PIXASA] Unable to receive an SNMP request on interface"; content: "3-212003:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000668; sid: 5000668; rev: 1;)
alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg: "[CISCO-PIXASA] Unable to send an SNMP response"; content: "3-212004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000669; sid: 5000669; rev: 1;)
alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg: "[CISCO-PIXASA] Dropping SNMP request"; content: "3-212006:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000670; sid: 5000670; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPTP tunnel hashtable insert failed"; content: "3-213002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000671; sid: 5000671; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPP virtual interface client ip allocation failed"; content: "3-213004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000672; sid: 5000672; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] H.323 library_name ASN Library failed to initialize"; content: "3-302019:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000673; sid: 5000673; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ACL = deny; no sa created"; content: "3-302302:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000674; sid: 5000674; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] {outbound static|identity|portmap|regular] translation creation failed"; content: "3-305006:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000675; sid: 5000675; rev: 1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Denied ICMP"; content: "3-313001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000676; sid: 5000676; rev: 1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Denied ICMPv6"; content: "3-313008:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000677; sid: 5000677; rev: 1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg: "[CISCO-PIXASA] Fail to establish SSH session because RSA host key retrieval failed"; content: "3-315004:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000678; sid: 5000678; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Denied new tunnel limit exceeded"; content: "3-316001:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000679; sid: 5000679; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IP routing table creation failure"; content: "3-317003:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000681; sid: 5000681; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error"; content: "3-318001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000682; sid: 5000682; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Arp update for IP address address to NPn failed"; content: "3-319003:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000683; sid: 5000683; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Route update for IP address failed"; content: "3-319004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000684; sid: 5000684; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny MAC address possible spoof attempt"; content: "3-322001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000685; sid: 5000685; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ARP inspection check failed [1]"; content: "3-322002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000686; sid: 5000686; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ARP inspection check failed [2]"; content: "3-322003:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000687; sid: 5000687; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] GSN tunnel limit exceeded"; content: "3-324006:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000690; sid: 5000690; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Radius Accounting Request has a bad header length"; content: "3-324301:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000691; sid: 5000691; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Unexpected error in the timer library"; content: "3-326001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000692; sid: 5000692; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error"; content: "3-326002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000693; sid: 5000693; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] An internal error occurred while processing a packet queue"; content: "3-326004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000694; sid: 5000694; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Mrib notification failed"; content: "3-326005:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000695; sid: 5000695; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Entry-creation failed"; content: "3-326006:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000696; sid: 5000696; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Entry-update failed"; content: "3-326007:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000697; sid: 5000697; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] MRIB registration failed"; content: "3-326008:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000698; sid: 5000698; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] MRIB connection-open failed"; content: "3-326009:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000699; sid: 5000699; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] MRIB unbind failed"; content: "3-326010:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000700; sid: 5000700; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] MRIB table deletion failed"; content: "3-326011:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000701; sid: 5000701; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Initialization of string functionality failed"; content: "3-326012:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000702; sid: 5000702; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal error"; content: "3-326013:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000703; sid: 5000703; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Initialization failed"; content: "3-326014:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000704; sid: 5000704; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Communication error"; content: "3-326015:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000705; sid: 5000705; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to set un-numbered interface"; content: "3-326016:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000706; sid: 5000706; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Interface Manager error"; content: "3-326017:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000707; sid: 5000707; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] List error"; content: "3-326020:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000708; sid: 5000708; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error"; content: "3-326021:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000709; sid: 5000709; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error"; content: "3-326022:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000710; sid: 5000710; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] An internal error occurred while processing a packet queue"; content: "3-326024:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000711; sid: 5000711; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Server unexpected error"; content: "3-326026:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000712; sid: 5000712; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Corrupted update"; content: "3-326027:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000713; sid: 5000713; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Asynchronous error"; content: "3-326028:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000714; sid: 5000714; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IP SLA Monitor Failed to initialize, will not work"; content: "3-327002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000715; sid: 5000715; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IP SLA Monitor Generic Timer wheel timer functionality failed to initialize"; content: "3-327003:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000716; sid: 5000716; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPPoE - Bad host-unique in PADO - packet dropped"; content: "3-403501:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000717; sid: 5000717; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPPoE - Bad host-unique in PADS - dropping packet"; content: "3-403502:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000718; sid: 5000718; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPPoEPPPoE client on interface failed to locate PPPoE vpdn group"; content: "3-403507:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000719; sid: 5000719; rev: 1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg: "[CISCO-PIXASA] Failed to save logging buffer using filename to FTP server"; content: "3-414001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000720; sid: 5000720; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to save logging buffer to flash or syslog directory using file name filename"; content: "3-414002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000721; sid: 5000721; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NTP daemon Packet denied"; content: "3-610001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000722; sid: 5000722; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NTP daemon Authentication failed"; content: "3-610002:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000723; sid: 5000723; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient Backup Server List Error"; content: "3-611313:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000724; sid: 5000724; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error processing payload"; content: "3-713048:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000725; sid: 5000725; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Tunnel Rejected User matched with group name, check failed"; content: "3-713059:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000726; sid: 5000726; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Tunnel Rejected User not member of group, check failed"; content: "3-713060:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000727; sid: 5000727; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to retrieve identity certificate"; content: "3-713082:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000728; sid: 5000728; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Set Cert filehandle failure no IPSec SA in group"; content: "3-713088:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000729; sid: 5000729; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Request attempt failed!"; content: "3-713107:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000730; sid: 5000730; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to process CONNECTED notify!"; content: "3-713112:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000731; sid: 5000731; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Client-reported firewall does not match configured firewall action tunnel"; content: "3-713141:"; pcre: "/%PIX-|%ASA-/"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000732; sid: 5000732; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Client did not report firewall in use, but there is a configured firewall action tunnel"; content: "3-713142:"; pcre: "/%PIX-|%ASA-/"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000733; sid: 5000733; rev: 1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] TCP Connection to Firewall Server has been lost, restricted tunnels are now allowed full network access"; content: "3-713159:"; pcre: "/%PIX-|%ASA-/"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000734; sid: 5000734; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote user network access has been restricted by the Firewall Server"; content: "3-713161:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000735; sid: 5000735; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote user has been rejected by the Firewall Server"; content: "3-713162:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000736; sid: 5000736; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote user has been terminated by the Firewall Server"; content: "3-713163:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000737; sid: 5000737; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Headend security gateway has failed our user authentication attempt - check configured username and password"; content: "3-713166:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000738; sid: 5000738; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote peer has failed user authentication - check configured username and password"; content: "3-713167:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000739; sid: 5000739; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error Username too long - connection aborted"; content: "3-713185:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000740; sid: 5000740; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] User Authorization failed"; content: "3-713198:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000741; sid: 5000741; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IKE Receiver Error reading from socket"; content: "3-713203:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000742; sid: 5000742; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Connection failed with peer, no trust-point defined"; content: "3-713226:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000743; sid: 5000743; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal Error, ike_lock trying to lock bit that is already locked"; content: "3-713230:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000744; sid: 5000744; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal Error, ike_lock trying to unlock bit that is not locked"; content: "3-713231:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000745; sid: 5000745; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Querying keypair failed"; content: "3-717001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000746; sid: 5000746; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Certificate enrollment failed for trustpoint"; content: "3-717002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000747; sid: 5000747; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Certificate validation failed"; content: "3-717009:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000748; sid: 5000748; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] CRL polling failed for trustpoint"; content: "3-717010:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000749; sid: 5000749; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to refresh CRL cache entry from the server for trustpoint"; content: "3-717012:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000750; sid: 5000750; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to query CA certificate for trustpoint"; content: "3-717017:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000751; sid: 5000751; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to insert CRL for trustpoint"; content: "3-717019:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000752; sid: 5000752; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] SSL failed to set device certificate for trustpoint"; content: "3-717023:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000753; sid: 5000753; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Certificate chain failed validation"; content: "3-717027:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000754; sid: 5000754; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny protocol"; content: "4-106023:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000755; sid: 5000755; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to determine the security context for the packetvlansource Vlan"; content: "4-106027:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000756; sid: 5000756; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NT Domain Authentication Failed rejecting guest login for username."; content: "4-109031:"; pcre: "/%PIX-|%ASA-/"; classtype: misc-attack; reference: url, wiki.softwink.com/bin/view/Main/5000757; sid: 5000757; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authentication failed for admin user"; content: "4-109033:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-admin; reference: url, wiki.softwink.com/bin/view/Main/5000758; sid: 5000758; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authentication failed for network user"; content: "4-109034:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000759; sid: 5000759; rev: 1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Denied ICMP"; content: "4-313004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000760; sid: 5000760; rev: 1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] No matching connection for ICMP error"; content: "4-313005:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000761; sid: 5000761; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NAC Downloaded ACL parse failure"; content: "4-335005:"; pcre: "/%PIX-|%ASA-/"; classtype: configuration-error; reference: url, wiki.softwink.com/bin/view/Main/5000762; sid: 5000762; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Shun add failed unable to allocate resources"; content: "4-401005:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000763; sid: 5000763; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPSEC Received an protocol packet from remote IP to local IP that failed anti-replay checking"; content: "4-402119:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000764; sid: 5000764; rev: 1;)

alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IPSEC Received an protocol packet from remote IP to local IP that failed authentication"; content: "4-402120:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000765; sid: 5000765; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] CRYPTO The hardware accelerator encountered an error while executing crypto command"; content: "4-402123:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-event; reference: url, wiki.softwink.com/bin/view/Main/5000766; sid: 5000766; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PPPoE failed to assign PPP IP address"; content: "4-403506:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000767; sid: 5000767; rev: 1;)
alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg: "[CISCO-PIXASA] ISAKMP Failed to allocate address for client from pool string"; content: "4-404101:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000768; sid: 5000768; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] H225 message contains bad protocol discriminator hex"; content: "4-405103:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000769; sid: 5000769; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny traffic for local-host, license limit of number exceeded"; content: "4-407001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000770; sid: 5000770; rev: 1;)
alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg: "[CISCO-PIXASA] Dropped UDP SNMP packet"; content: "4-416001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000771; sid: 5000771; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Filter violation error conn number"; content: "4-417004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000772; sid: 5000772; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Through-the-device packet to/from management-only network is denied"; content: "4-418001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000773; sid: 5000773; rev: 1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping TCP packet, reason MSS exceeded, MSS size, data size"; content: "4-419001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000774; sid: 5000774; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RTP conformance Dropping RTP packet"; content: "4-431001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000775; sid: 5000775; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RTCP conformance Dropping RTCP packet"; content: "4-431002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000776; sid: 5000776; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping Skinny message length value too small"; content: "4-608002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000777; sid: 5000777; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping Skinny message length value too large"; content: "4-608003:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000778; sid: 5000778; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping Skinny message id value not allowed"; content: "4-608004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000779; sid: 5000779; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropping Skinny message id value registration not complete"; content: "4-608005:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000780; sid: 5000780; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auto Update failed"; content: "4-612002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000781; sid: 5000781; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auto Update failed"; content: "4-612003:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000782; sid: 5000782; rev: 1;)
alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg: "[CISCO-PIXASA] DNS lookup for Server failed!"; content: "4-713154:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000783; sid: 5000783; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Name lookup failed for hostname during PKI operation"; content: "4-717026:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000784; sid: 5000784; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to find a suitable trustpoint for issuer"; content: "4-717031:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000785; sid: 5000785; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Tunnel group search using certificate maps failed"; content: "4-717037:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000786; sid: 5000786; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IP address end configuration {FAILED|OK}"; content: "5-111004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000787; sid: 5000787; rev: 1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg: "[CISCO-PIXASA] FTP cmd_string command unsupported - failed strict inspection"; content: "5-303004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000788; sid: 5000788; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Access denied URL chars"; content: "5-304002:"; pcre: "/%PIX-|%ASA-/"; classtype: policy-violation; reference: url, wiki.softwink.com/bin/view/Main/5000789; sid: 5000789; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Asymmetric NAT rules matched for forward and reverse flows"; content: "5-305013:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000790; sid: 5000790; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] EAPoUDP association failed to establish"; content: "5-334003:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000791; sid: 5000791; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] EAPoUDP failed to get a response from host"; content: "5-334006:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000792; sid: 5000792; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] HTTP - matched string in policy-map verification failed"; content: "5-415004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000793; sid: 5000793; rev: 1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad TCP hdr length"; content: "5-500003:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000794; sid: 5000794; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IKE area failed to find centry for message"; content: "5-713010:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000796; sid: 5000796; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failure during phase 1 rekeying attempt due to collision"; content: "5-713092:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000797; sid: 5000797; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Ignoring received malformed firewall record"; content: "5-713144:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000798; sid: 5000798; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Create peer failure, already at maximum of number of peers"; content: "5-718002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000800; sid: 5000800; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to send to IP"; content: "5-718005:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000801; sid: 5000801; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Socket open failure"; content: "5-718007:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000802; sid: 5000802; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Socket bind failure"; content: "5-718008:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000803; sid: 5000803; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send HELLO response failure"; content: "5-718009:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000804; sid: 5000804; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send HELLO request failure"; content: "5-718011:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000805; sid: 5000805; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send CFG UPDATE failure"; content: "5-718024:"; pcre: "/%PIX-|%ASA-/"; classtype: configuration-error; reference: url, wiki.softwink.com/bin/view/Main/5000806; sid: 5000806; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send OOS indicator failure"; content: "5-718028:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000807; sid: 5000807; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send TOPOLOGY indicator failure"; content: "5-718033:"; pcre: "/%PIX-|%ASA-/"; classtype: configuration-error; reference: url, wiki.softwink.com/bin/view/Main/5000808; sid: 5000808; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Create of secure tunnel failure"; content: "5-718048:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000809; sid: 5000809; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Delete of secure tunnel failure"; content: "5-718050:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000810; sid: 5000810; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Queue send failure from ISR"; content: "5-718057:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000811; sid: 5000811; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Inbound socket select fail"; content: "5-718060:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000812; sid: 5000812; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Inbound socket read fail"; content: "5-718061:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000813; sid: 5000813; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Cannot continue to run"; content: "5-718065:"; pcre: "/%PIX-|%ASA-/"; classtype: hardware-failure; reference: url, wiki.softwink.com/bin/view/Main/5000814; sid: 5000814; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create access list for peer"; content: "5-718074:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000815; sid: 5000815; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create tunnel group for peer"; content: "5-718076:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000816; sid: 5000816; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to delete tunnel group for peer"; content: "5-718077:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000817; sid: 5000817; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create crypto map for peer"; content: "5-718078:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000818; sid: 5000818; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to delete crypto map for peer"; content: "5-718079:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000819; sid: 5000819; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create crypto policy for peer"; content: "5-718080:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000820; sid: 5000820; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to delete crypto policy for peer"; content: "5-718081:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000821; sid: 5000821; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to install LB NP rules"; content: "5-718086:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000822; sid: 5000822; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to delete LB NP rules"; content: "5-718087:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000823; sid: 5000823; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny IP"; content: "6-106012:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000824; sid: 5000824; rev: 1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Deny TCP [no connection]"; content: "6-106015:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000825; sid: 5000825; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to determine the security context"; content: "6-106025:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000826; sid: 5000826; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Failed to determine the security context"; content: "6-106026:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000827; sid: 5000827; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] access-list ACL {permitted | denied | est-allowed} protocol"; content: "6-106100:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000828; sid: 5000828; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auth from inside to outside failed [server failed] on interface"; content: "6-109002:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000829; sid: 5000829; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Auth from inside to outside failed [all servers failed] on interface"; content: "6-109003:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000830; sid: 5000830; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authentication failed for user"; content: "6-109006:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000831; sid: 5000831; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization permitted for user"; content: "6-109007:"; pcre: "/%PIX-|%ASA-/"; classtype: successful-user; reference: url, wiki.softwink.com/bin/view/Main/5000832; sid: 5000832; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization denied for user from outside to inside on interface"; content: "6-109008:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000833; sid: 5000833; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization denied [not authenticated]"; content: "6-109024:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000834; sid: 5000834; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization denied for user"; content: "6-109025:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000835; sid: 5000835; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] User user locked out on exceeding number successive failed authentication attempts"; content: "6-113006:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000836; sid: 5000836; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] AAA unable to complete the request"; content: "6-113013:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000837; sid: 5000837; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] URL Server request failed URL"; content: "6-304004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000838; sid: 5000838; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] RIP hdr failed"; content: "6-312001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000839; sid: 5000839; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] No management IP address configured for transparent firewall"; content: "6-322004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000840; sid: 5000840; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] NAC is disabled for host"; content: "6-335004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000841; sid: 5000841; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Login denied"; content: "6-605004:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000842; sid: 5000842; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Authorization failed"; content ""6-610101:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000843; sid: 5000843; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] User authentication failed"; content: "6-611102:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000844; sid: 5000844; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VNPClient XAUTH Failed"; content: "6-611311:"; pcre: "/%PIX-|%ASA-/"; classtype: unsuccessful-user; reference: url, wiki.softwink.com/bin/view/Main/5000845; sid: 5000845; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient Secure Unit Authentication Disabled"; content: "6-611317:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000846; sid: 5000846; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient User Authentication Disabled"; content: "6-611319:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000847; sid: 5000847; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient Device Pass Thru Disabled"; content: "6-611321:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000848; sid: 5000848; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] VPNClient Extended XAUTH conversation initiated when SUA disabled"; content: "6-611322:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000849; sid: 5000849; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Checksum Failure in database"; content: "6-613001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000850; sid: 5000850; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] vlan number not available for firewall interface"; content: "6-615001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000851; sid: 5000851; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] vlan number available for firewall interface"; content: "6-615002:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000852; sid: 5000852; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Bad register"; content: "6-621007:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000853; sid: 5000853; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Attempt to send an IKE packet from standby unit. Dropping the packet!"; content: "6-713235:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000854; sid: 5000854; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Certificate received from Certificate Authority for trustpoint"; content: "6-717003:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000855; sid: 5000855; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PKCS 12 export failed"; content: "6-717004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000856; sid: 5000856; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] PKCS 12 import failed"; content: "6-717006:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000857; sid: 5000857; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] uauth_lookup_net fail for uauth_in"; content: "7-109014:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000858; sid: 5000858; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Uauth null proxy error"; content: "7-109021:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000859; sid: 5000859; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send failure"; content: "7-713039:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000861; sid: 5000861; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Cert validation failure handle invalid for Main/Aggressive Mode Initiator/Responder!"; content: "7-713094:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000862; sid: 5000862; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Attempt to get Phase 1 ID data failed while hash computation"; content: "7-713104:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000863; sid: 5000863; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Processing firewall record"; content: "7-713143:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000864; sid: 5000864; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Remote user has been granted access by the Firewall Server"; content: "7-713160:"; pcre: "/%PIX-|%ASA-/"; classtype: successful-user; reference: url, wiki.softwink.com/bin/view/Main/5000865; sid: 5000865; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] The Firewall Server has requested a list of active user sessions"; content: "7-713164:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000866; sid: 5000866; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Got bad refCnt assigning"; content: "7-713190:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000867; sid: 5000867; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] subroutine Q Send failure RetCode"; content: "7-715004:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000868; sid: 5000868; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] subroutine name Bad message code Cod"; content: "7-715005:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000869; sid: 5000869; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IKE received response to a request from the utility"; content: "7-715042:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000870; sid: 5000870; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] ERROR malformed Keepalive payload"; content: "7-715045:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000871; sid: 5000871; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Claims to be IOS but failed authentication"; content: "7-715050:"; pcre: "/%PIX-|%ASA-/"; classtype: misc-attack; reference: url, wiki.softwink.com/bin/view/Main/5000872; sid: 5000872; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Dropped received IKE fragment"; content: "7-715060:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000873; sid: 5000873; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Error assembling fragments! Fragment numbers are non-continuous"; content: "7-715062:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000874; sid: 5000874; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] IKE state_machine subtype FSM error history"; content: "7-715065:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000875; sid: 5000875; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Internal interprocess communication queue send failure"; content: "7-718001:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000876; sid: 5000876; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send KEEPALIVE request failure"; content: "7-718018:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000877; sid: 5000877; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Send KEEPALIVE response failure"; content: "7-718020:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000878; sid: 5000878; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Fail to create group"; content: "7-718047:"; pcre: "/%PIX-|%ASA-/"; classtype: bad-unknown; reference: url, wiki.softwink.com/bin/view/Main/5000879; sid: 5000879; rev: 1;)
alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Creation of group policy"; content: "7-718046"; pcre: "/%PIX-|%ASA-/"; classtype: system-event; reference: url, wiki.softwink.com/bin/view/Main/5000880; sid: 5000880; rev: 1;)