As I monitored the CS-MARS incidents, I noticed that the System Rule: Modify Network Config constantly firing but we haven't done any changes in the device. The reporting device is ASA firewall which sends syslog messages to CS-MARS.
Below is the raw message sent by the ASA Firewall.
Raw Message: <165>%ASA-5-111008: User `fubu` executed the `terminal pager lines 0` command.
My question is why the ASA device sends a syslog message to MARS that the "user fubu executed terminal pager line 0" but we did not execute this command? Is this a bug on ASA device? Can anyone share your knowledge or give some thoughts regarding this issue. Your help is much appreciated.