Firewall Configuration Change Detection
Detects configuration changes on firewall devices via CommonSecurityLog. Specifically looks for CONFIG activity that is not an audit-commit, indicating an actual configuration change was made rather than a read-only audit operation. Note: Field aliasing (Client, Administrator, Host_IP, Command, Result, Configuration_Path, Before_Change, After_Change) via extend, fixed date window via datetime_local_to_utc, and project-reorder are handled natively in KQL post-conversion. See third item of the reference. Original query was scoped to a fixed date window, which is (2026-02-09 to 2026-02-10 PST) suggesting threat hunting intent. However, it's worthnoting that Sigma version uses a rolling 24h window for continuous detection. This is the detection version of my KQL script.
Sigma
