Cisco ASA Core Syslog Message Volume Drop

Adversaries may intentionally suppress or reduce the volume of core Cisco ASA syslog messages to evade detection or cover their tracks. This hunting search is recommended to proactively identify suspicious downward shifts or absences in key syslog message IDs, which may indicate tampering or malicious activity. Visualizing this data in Splunk dashboards enables security teams to quickly spot anomalies and investigate potential compromise. The rule specifically looks for drops in message IDs 302013 (Built inbound TCP connection), 302014 (Teardown TCP connection), 609002 (Teardown local-host management), and 710005 (TCP request discarded).