feat: dual-signal IDS triage rules (SnortML GID411 ≠ signature TP)

Add experimental firewall/IDS Sigma rules that separate SnortML ML-only
highs from classic signature and signature+EVE corroboration paths.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: AAH20

documentation/dual-signal-ids-triage.md

@@ -0,0 +1,25 @@
+# Dual-signal IDS triage (SnortML ≠ signature TP)
+
+Sigma rules under `rules/network/firewall/` that encode composite confidence for
+Cisco Secure Firewall / Snort-family telemetry:
+
+| Rule | Intent |
+|---|---|
+| [SnortML High Confidence ML-Only Alert](../rules/network/firewall/net_firewall_snortml_gid411_high.yml) | GID 411 → escalate / corroborate — **not** auto-contain |
+| [IDS Signature High Priority Classification](../rules/network/firewall/net_firewall_ids_signature_high_priority.yml) | Classic signature classifications → stronger TP candidate |
+| [IDS Signature And High EVE Corroboration](../rules/network/firewall/net_firewall_ids_signature_and_eve_corroboration.yml) | Signature + high EVE → corroborated path |
+
+## Hard rule
+
+**ML probability is never equivalent to a signature true positive.**
+
+Automation and agent harnesses that call containment tools should deny or
+HITL-interrupt ML-only highs and prefer corroborated signature paths.
+
+## Production consumer
+
+Aegis Decision Fabric consumes this disposition envelope for gated remediation:
+https://github.com/AAH20/aegis-decision-fabric
+
+Secure Firewall + Splunk environments under contract (Continuous Trust / paid pilot):
+https://a2zsoc.com/consultation

rules/network/firewall/net_firewall_ids_signature_and_eve_corroboration.yml

@@ -0,0 +1,44 @@
+title: IDS Signature And High EVE Corroboration
+id: f254c044-f25a-4cb9-9bbb-40e9dd0f163f
+status: experimental
+description: |
+    Detects dual-signal corroboration where a classic IDS/Snort signature event
+    (Generator ID not SnortML GID 411) co-occurs with a high Encrypted Visibility Engine
+    (EVE) threat confidence score (>= 80) on the same enriched/correlated firewall event.
+    Signature + ML corroboration is a stronger remediation candidate than ML-only paths
+    (SnortML GID 411 or EVE-only). Requires correlated IntrusionEvent + ConnectionEvent
+    fields (or equivalent enrichment joining on ConnectionID) in the SIEM pipeline.
+references:
+    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
+    - https://github.com/Cisco-Talos/EvidenceForge/pull/389
+    - https://github.com/splunk/attack_data/pull/1206
+    - https://github.com/AAH20/aegis-decision-fabric
+    - https://a2zsoc.com/consultation
+author: Ahmed Hassan (A2Z SOC)
+date: 2026-08-16
+tags:
+    - attack.command-and-control
+    - attack.t1071
+    - attack.t1041
+    - attack.t1573
+logsource:
+    category: firewall
+detection:
+    selection_sig_gid:
+        GeneratorID|gt: 0
+    selection_sig_gid_alt:
+        gid|gt: 0
+    selection_eve:
+        EVE_ThreatConfidencePct|gte: 80
+    selection_eve_alt:
+        eve_threat_confidence_pct|gte: 80
+    filter_snortml:
+        GeneratorID: 411
+    filter_snortml_alt:
+        gid: 411
+    condition: (1 of selection_sig*) and (1 of selection_eve*) and not 1 of filter_snortml*
+falsepositives:
+    - Hosts that coincidentally share correlated ConnectionIDs during enrichment windows
+    - Noisy classic signatures alongside elevated EVE scores on busy egress gateways
+    - Lab and red-team traffic designed to trip both inspectors
+level: high

rules/network/firewall/net_firewall_ids_signature_high_priority.yml

@@ -0,0 +1,52 @@
+title: IDS Signature High Priority Classification
+id: dd19d217-712d-4fbb-b34c-7cfbf28eabb4
+status: experimental
+description: |
+    Detects classic Snort / IDS signature hits (Generator ID not equal to SnortML GID 411)
+    with high-priority classifications commonly associated with malware C2, privilege gain,
+    or known exploits.
+    These events are stronger signature true-positive candidates than ML-only (GID 411) or
+    EVE-only scores and may justify gated remediation after analyst or policy review.
+references:
+    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
+    - https://github.com/Cisco-Talos/EvidenceForge/pull/389
+    - https://github.com/splunk/security_content/pull/4221
+    - https://github.com/AAH20/aegis-decision-fabric
+    - https://a2zsoc.com/consultation
+author: Ahmed Hassan (A2Z SOC)
+date: 2026-08-16
+tags:
+    - attack.execution
+    - attack.t1203
+    - attack.command-and-control
+    - attack.t1071
+logsource:
+    category: firewall
+detection:
+    selection_class:
+        Classification|contains:
+            - "A Network Trojan was Detected"
+            - "Successful Administrator Privilege Gain"
+            - "Successful User Privilege Gain"
+            - "Known malware command and control traffic"
+            - "Known malicious file or file based exploit"
+            - "Known client side exploit attempt"
+            - "Large Scale Information Leak"
+    selection_class_alt:
+        class_desc|contains:
+            - "A Network Trojan was Detected"
+            - "Successful Administrator Privilege Gain"
+            - "Successful User Privilege Gain"
+            - "Known malware command and control traffic"
+            - "Known malicious file or file based exploit"
+            - "Known client side exploit attempt"
+            - "Large Scale Information Leak"
+    filter_snortml:
+        GeneratorID: 411
+    filter_snortml_alt:
+        gid: 411
+    condition: (1 of selection_class*) and not 1 of filter_snortml*
+falsepositives:
+    - Noisy signature packs or policy-violation classifications in permissive environments
+    - Vulnerability scanners and malware sandboxes generating simulated attacks
+level: high

rules/network/firewall/net_firewall_snortml_gid411_high.yml

@@ -0,0 +1,41 @@
+title: SnortML High Confidence ML-Only Alert
+id: 3696b1ea-d290-49c8-af4f-73778db720fc
+status: experimental
+description: |
+    Detects Cisco Secure Firewall / Snort-family intrusion events generated by SnortML
+    (Generator ID / GID 411) at elevated impact.
+    SnortML scores are machine-learning probability signals and must not be treated as
+    equivalent to a classic Snort signature true positive (typically GID 1).
+    High ML-only confidence should escalate for corroboration (classic signature, EVE,
+    endpoint, or threat intel) — not auto-containment.
+    Pair with "IDS Signature High Priority Classification" and
+    "IDS Signature And High EVE Corroboration" for dual-signal triage.
+references:
+    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
+    - https://github.com/Cisco-Talos/EvidenceForge/pull/389
+    - https://github.com/splunk/security_content/issues/4220
+    - https://github.com/AAH20/aegis-decision-fabric
+    - https://a2zsoc.com/consultation
+author: Ahmed Hassan (A2Z SOC)
+date: 2026-08-16
+tags:
+    - attack.command-and-control
+    - attack.t1071
+    - attack.t1041
+logsource:
+    category: firewall
+detection:
+    selection_gid:
+        GeneratorID: 411
+    selection_gid_alt:
+        gid: 411
+    selection_impact:
+        Impact|gte: 2
+    selection_impact_alt:
+        impact|gte: 2
+    condition: (1 of selection_gid*) and (1 of selection_impact*)
+falsepositives:
+    - Benign applications or uncommon encrypted protocols that resemble malware training samples
+    - Lab / scanner traffic exercising SnortML inspectors
+    - Treat as escalate/corroborate — do not equate to classic signature TP
+level: medium