diff --git a/filters/audits/cisco-firepower.md b/filters/audits/cisco-firepower.md
new file mode 100644
index 000000000..b87a21210
--- /dev/null
+++ b/filters/audits/cisco-firepower.md
@@ -0,0 +1,40 @@
+# Cisco Firepower normalization and rule review
+
+Correct IPsec failures, scan/shun outcomes, ACL precedence, invalid CEL and syslog severity.
+
+This draft targets UTMStack `v11`. It contains 1 filter changes
+and 0 rule changes for this technology only. Review covered
+1 filter configurations and 5 matching shipped rule files.
+Unchanged rules are listed in the regression manifest; they are not duplicated in the diff.
+
+## Contract and validation
+
+- Compared exact standard names/types with go-sdk v1.1.31 and the supplied UTMStack dictionaries.
+- Checked documented pipeline ordering, rename/move behavior, open vendor log fields,
+  event-side versus alert-side fields, and surviving fields used by affected rule predicates/history/grouping.
+- Strict SDK configuration decoding and actual CEL compilation pass for this scope.
+- 12 synthetic normalization cases pass, including SDK Event conversion and any
+  trigger predicate assertions recorded in the manifest.
+- The scoped alerts module tests and `git diff --check` pass with the shared contract runner applied.
+
+The shared alert-contract PR supplies the reusable Go runner for the manifest in
+`plugins/alerts/testdata/filter-contracts/cisco-firepower.json`. Apply that support before running `go test ./...` in `plugins/alerts`.
+
+The model starts from synthetic extraction results. It does not run complex grok,
+JSON/KV/XML/CSV extraction, time conversion, dynamic plugins, historical OpenSearch
+queries, or the closed EventProcessor. Raw vendor logs and resulting alerts must
+still be checked in staging before rollout. No customer false-positive reduction
+has been measured and no production rollout is included.
+
+
+
+## References
+
+- [SDK schema](https://github.com/threatwinds/go-sdk/blob/v1.1.31/plugins/plugins.proto)
+- [Filter steps](https://github.com/threatwinds/go-sdk/wiki/Filter-Steps-Reference)
+- [Standard event schema](https://github.com/threatwinds/go-sdk/wiki/Standard-Event-Schema)
+- [Rule implementation](https://github.com/threatwinds/go-sdk/wiki/Implementing-Rules)
+
+`afterEvents`, empty noncapturing grok names, supported numeric strings, and custom
+`log.*` fields are accepted. Existing textual protocol casing and vendor action names
+are preserved unless a concrete consumer mismatch requires correction.
diff --git a/filters/cisco/firepower.yml b/filters/cisco/firepower.yml
index 2c37bf00e..edba096ce 100644
--- a/filters/cisco/firepower.yml
+++ b/filters/cisco/firepower.yml
@@ -204,73 +204,73 @@ pipeline:
       # First variant
       - grok:
           patterns:
-            - fieldName: log.irrelevant
-              pattern: 'access-list'
-            - fieldName: log.accessList
-              pattern: '{{.data}}\s'
-            - fieldName: actionResult
-              pattern: '{{.word}}'
-            - fieldName: protocol
-              pattern: '{{.word}}'
-            - fieldName: log.irrelevant
-              pattern: 'for user'
-            - fieldName: origin.user
-              pattern: '(''{{.data}}''|{{.data}})\s'
-            - fieldName: log.srcInterface
-              pattern: '{{.data}}/'
-            - fieldName: origin.ip
-              pattern: '({{.ipv4}}|{{.ipv6}})'
-            - fieldName: origin.port
-              pattern: '{{.integer}}'
-            - fieldName: log.dstInterface
-              pattern: '{{.data}}/'
-            - fieldName: target.ip
-              pattern: '({{.ipv4}}|{{.ipv6}})'
-            - fieldName: target.port
-              pattern: '{{.integer}}'
-            - fieldName: log.irrelevant
-              pattern: 'hit-cnt'
-            - fieldName: log.hitCount
-              pattern: '{{.integer}}'
-            - fieldName: log.rest
-              pattern: '{{.greedy}}'
+          - fieldName: log.irrelevant
+            pattern: access-list
+          - fieldName: log.accessList
+            pattern: '{{.data}}\s'
+          - fieldName: log.ciscoResult
+            pattern: '{{.word}}'
+          - fieldName: protocol
+            pattern: '{{.word}}'
+          - fieldName: log.irrelevant
+            pattern: for user
+          - fieldName: origin.user
+            pattern: ('{{.data}}'|{{.data}})\s
+          - fieldName: log.srcInterface
+            pattern: '{{.data}}/'
+          - fieldName: origin.ip
+            pattern: ({{.ipv4}}|{{.ipv6}})
+          - fieldName: origin.port
+            pattern: '{{.integer}}'
+          - fieldName: log.dstInterface
+            pattern: '{{.data}}/'
+          - fieldName: target.ip
+            pattern: ({{.ipv4}}|{{.ipv6}})
+          - fieldName: target.port
+            pattern: '{{.integer}}'
+          - fieldName: log.irrelevant
+            pattern: hit-cnt
+          - fieldName: log.hitCount
+            pattern: '{{.integer}}'
+          - fieldName: log.rest
+            pattern: '{{.greedy}}'
           source: log.msg
           where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
       # Second variant
       - grok:
           patterns:
-            - fieldName: log.irrelevant
-              pattern: 'access-list'
-            - fieldName: log.accessList
-              pattern: '{{.data}}\s'
-            - fieldName: actionResult
-              pattern: '{{.word}}'
-            - fieldName: protocol
-              pattern: '{{.word}}'
-            - fieldName: log.irrelevant
-              pattern: 'for user'
-            - fieldName: origin.user
-              pattern: '(''{{.data}}''|{{.data}})\s'
-            - fieldName: log.srcInterface
-              pattern: '{{.data}}/'
-            - fieldName: origin.ip
-              pattern: '({{.ipv4}}|{{.ipv6}})'
-            - fieldName: origin.port
-              pattern: '\({{.data}}\)'
-            - fieldName: log.irrelevant
-              pattern: '-\>'
-            - fieldName: log.dstInterface
-              pattern: '{{.data}}/'
-            - fieldName: target.ip
-              pattern: '({{.ipv4}}|{{.ipv6}})'
-            - fieldName: target.port
-              pattern: '\({{.data}}\)'
-            - fieldName: log.irrelevant
-              pattern: 'hit-cnt'
-            - fieldName: log.hitCount
-              pattern: '{{.integer}}'
-            - fieldName: log.rest
-              pattern: '{{.greedy}}'
+          - fieldName: log.irrelevant
+            pattern: access-list
+          - fieldName: log.accessList
+            pattern: '{{.data}}\s'
+          - fieldName: log.ciscoResult
+            pattern: '{{.word}}'
+          - fieldName: protocol
+            pattern: '{{.word}}'
+          - fieldName: log.irrelevant
+            pattern: for user
+          - fieldName: origin.user
+            pattern: ('{{.data}}'|{{.data}})\s
+          - fieldName: log.srcInterface
+            pattern: '{{.data}}/'
+          - fieldName: origin.ip
+            pattern: ({{.ipv4}}|{{.ipv6}})
+          - fieldName: origin.port
+            pattern: \({{.data}}\)
+          - fieldName: log.irrelevant
+            pattern: -\>
+          - fieldName: log.dstInterface
+            pattern: '{{.data}}/'
+          - fieldName: target.ip
+            pattern: ({{.ipv4}}|{{.ipv6}})
+          - fieldName: target.port
+            pattern: \({{.data}}\)
+          - fieldName: log.irrelevant
+            pattern: hit-cnt
+          - fieldName: log.hitCount
+            pattern: '{{.integer}}'
+          - fieldName: log.rest
+            pattern: '{{.greedy}}'
           source: log.msg
           where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
       - trim:
@@ -308,18 +308,18 @@ pipeline:
           where: equals("log.messageId", 106102) || equals("log.messageId", 106103)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
-          where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && equalsIgnoreCase("actionResult", "Permitted")
+            value: success
+          where: exists("log.ciscoResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && equalsIgnoreCase("log.ciscoResult", "Permitted")
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'denied'
-          where: exists("actionResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && !equalsIgnoreCase("actionResult", "Permitted")
+            value: denied
+          where: exists("log.ciscoResult") && (equals("log.messageId", 106102) || equals("log.messageId", 106103)) && equalsIgnoreCase("log.ciscoResult", "Denied")
       #......................................................................#
       # FTD-6-109101
       - grok:
@@ -358,10 +358,10 @@ pipeline:
             - origin.user
           where: equals("log.messageId", 109101)
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 109101)
       #......................................................................#
       # FTD-4-109102
@@ -389,10 +389,10 @@ pipeline:
           source: action
           where: equals("log.messageId", 109102)
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 109102)
       #......................................................................#
       # FTD-3-109103
@@ -430,10 +430,10 @@ pipeline:
             - origin.user
           where: equals("log.messageId", 109103)
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 109103)
       #......................................................................#
       # FTD-109201 to 109213
@@ -463,13 +463,13 @@ pipeline:
           fields:
             - log.session
             - origin.user
-          where: lgreaterOrEqual("log.messageId", 109201) && log.messageId<=109213
+          where: greaterOrEqual("log.messageId", 109201) && lessOrEqual("log.messageId", 109213)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: greaterOrEqual("log.messageId", 109201) && log.messageId<=109213
       #......................................................................#
       # FTD-6-113004
@@ -511,10 +511,10 @@ pipeline:
             - target.ip
           where: equals("log.messageId", 113004)
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 113004)
       #......................................................................#
       # FTD-6-113005
@@ -577,10 +577,10 @@ pipeline:
           where: equals("log.messageId", 113008)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 113008)
       #......................................................................#
       # FTD-6-113009
@@ -630,10 +630,10 @@ pipeline:
           where: equals("log.messageId", 113009)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 113009)
       #......................................................................#
       # FTD-6-113010
@@ -721,10 +721,10 @@ pipeline:
           source: action
           where: equals("log.messageId", 113012)
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 113012)
       #......................................................................#
       # FTD-6-113013
@@ -913,10 +913,10 @@ pipeline:
           where: equals("log.messageId", 113019)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 113019)
       #......................................................................#
       # FTD-113031,113032,113033
@@ -1026,10 +1026,10 @@ pipeline:
           where: equals("log.messageId", 113034) || log.messageId==113035 || log.messageId==113036 || log.messageId==113038 || log.messageId==113039
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 113039)
       # Adding action result
       - add:
@@ -1144,10 +1144,10 @@ pipeline:
           where: equals("log.messageId", 201003)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 201003)
       #......................................................................#
       # FTD-4-209003
@@ -1190,10 +1190,10 @@ pipeline:
           where: equals("log.messageId", 209003)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 209003)
       #......................................................................#
       # FTD-3-316001
@@ -1354,10 +1354,10 @@ pipeline:
           where: equals("log.messageId", 302003) || log.messageId==302004
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302003) || log.messageId==302004
       #......................................................................#
       # FTD-6-302012
@@ -1385,10 +1385,10 @@ pipeline:
           where: equals("log.messageId", 302012)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302012)
       #......................................................................#
       # FTD-6-302013
@@ -1521,10 +1521,10 @@ pipeline:
           where: equals("log.messageId", 302013)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302013)
       #......................................................................#
       # FTD-6-302014
@@ -1634,10 +1634,10 @@ pipeline:
           where: equals("log.messageId", 302014)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302014)
       #......................................................................#
       # FTD-6-302015
@@ -1770,10 +1770,10 @@ pipeline:
           where: equals("log.messageId", 302015)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302015)
       #......................................................................#
       # FTD-6-302016
@@ -1892,10 +1892,10 @@ pipeline:
           where: equals("log.messageId", 302016)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302016)
       #......................................................................#
       # FTD-6-302017
@@ -2032,10 +2032,10 @@ pipeline:
           where: equals("log.messageId", 302017)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302017)
       #......................................................................#
       # FTD-6-302018
@@ -2164,10 +2164,10 @@ pipeline:
           where: equals("log.messageId", 302018)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302018)
       #......................................................................#
       # FTD-6-302020, 302021
@@ -2392,10 +2392,10 @@ pipeline:
           where: equals("log.messageId", 302020) || log.messageId==302021
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302020) || log.messageId==302021
       #......................................................................#
       # FTD-6-302022, 302024, 302026
@@ -2510,10 +2510,10 @@ pipeline:
           where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302022) || log.messageId==302024 || log.messageId==302026
       #......................................................................#
       # FTD-6-302023, 302025, 302027
@@ -2568,10 +2568,10 @@ pipeline:
           where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302023) || log.messageId==302025 || log.messageId==302027
       #......................................................................#
       # FTD-302033,302034
@@ -2639,10 +2639,10 @@ pipeline:
           where: equals("log.messageId", 302033) || log.messageId==302034
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302033)
       - add:
           function: 'string'
@@ -2726,10 +2726,10 @@ pipeline:
           where: equals("log.messageId", 302303)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302303)
       #......................................................................#
       # FTD-6-302304
@@ -2799,10 +2799,10 @@ pipeline:
           where: equals("log.messageId", 302304)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 302304)
       #......................................................................#
       # FTD-6-305009
@@ -3335,10 +3335,10 @@ pipeline:
           where: equals("log.messageId", 402114)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: failure
           where: equals("log.messageId", 402114)
       #......................................................................#
       # FTD-4-402115
@@ -3370,10 +3370,10 @@ pipeline:
           where: equals("log.messageId", 402115)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: failure
           where: equals("log.messageId", 402115)
       #......................................................................#
       # FTD-4-402116
@@ -3489,10 +3489,10 @@ pipeline:
           where: equals("log.messageId", 402116)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: failure
           where: equals("log.messageId", 402116)
       #......................................................................#
       # FTD-4-402117
@@ -3525,10 +3525,10 @@ pipeline:
           where: equals("log.messageId", 402117)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: failure
           where: equals("log.messageId", 402117)
       #......................................................................#
       # FTD-4-402118
@@ -3595,10 +3595,10 @@ pipeline:
           where: equals("log.messageId", 402118)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: failure
           where: equals("log.messageId", 402118)
       #......................................................................#
       # FTD-4-402119, 402120
@@ -3659,10 +3659,10 @@ pipeline:
           where: equals("log.messageId", 402119) || log.messageId==402120
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: failure
           where: equals("log.messageId", 402119) || log.messageId==402120
       #......................................................................#
       # FTD-5-402128
@@ -4169,10 +4169,10 @@ pipeline:
           where: equals("log.messageId", 611307)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 611307)
       #......................................................................#
       # FTD-6-611309
@@ -4190,10 +4190,10 @@ pipeline:
           where: equals("log.messageId", 611309)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 611309)
       #......................................................................#
       # FTD-6-611310,611311
@@ -4213,10 +4213,10 @@ pipeline:
           where: equals("log.messageId", 611310) || log.messageId==611311
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 611310)
       - add:
           function: 'string'
@@ -4247,10 +4247,10 @@ pipeline:
           where: equals("log.messageId", 611314)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 611314)
       #......................................................................#
       # FTD-6-611315
@@ -4271,10 +4271,10 @@ pipeline:
           where: equals("log.messageId", 611315)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 611315)
       #......................................................................#
       # FTD-6-611318
@@ -4405,10 +4405,10 @@ pipeline:
             value: 'denied'
           where: equals("log.messageId", 713252)
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 713253)
       #......................................................................#
       # FTD-6-716001,716002,716003
@@ -4469,10 +4469,10 @@ pipeline:
           where: equals("log.messageId", 716001) || log.messageId==716002 || log.messageId==716003
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 716001) || log.messageId==716002
       #......................................................................#
       # FTD-6-716004,716005,716006,716007,716009
@@ -4529,10 +4529,10 @@ pipeline:
             value: 'denied'
           where: equals("log.messageId", 716004) || log.messageId==716007 || log.messageId==716009
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 716006)
       #......................................................................#
       # FTD-6-716038
@@ -4554,10 +4554,10 @@ pipeline:
           where: equals("log.messageId", 716038)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 716038)
       # Cleaning fields
       - trim:
@@ -4666,10 +4666,10 @@ pipeline:
             value: 'denied'
           where: equals("log.messageId", 719019) || log.messageId==719023
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 719020) || log.messageId==719022
       - add:
           function: 'string'
@@ -4798,10 +4798,10 @@ pipeline:
           where: equals("log.messageId", 609002)
       # Adding action result
       - add:
-          function: 'string'
+          function: string
           params:
             key: actionResult
-            value: 'accepted'
+            value: success
           where: equals("log.messageId", 609002)
       #......................................................................#
       # FTD-6-611305
@@ -4954,12 +4954,6 @@ pipeline:
           to: target.ip
           where: equals("log.messageId", 733101) && contains("action", "targeted")
       # Adding action result
-      - add:
-          function: 'string'
-          params:
-            key: actionResult
-            value: 'accepted'
-          where: equals("log.messageId", 733101)
       #......................................................................#
       # FTD-4-733102, 733103
       - grok:
@@ -4987,24 +4981,6 @@ pipeline:
           where: (equals("log.messageId", 733102) || log.messageId==733103) && contains("log.msg", "removes")
       #......................................................................#
       # Decoding severity
-      - add:
-          function: 'string'
-          params:
-            key: severity
-            value: 'high'
-          where: log.severity=="1" || log.severity=="2" || log.severity=="3"
-      - add:
-          function: 'string'
-          params:
-            key: severity
-            value: 'medium'
-          where: log.severity=="4"
-      - add:
-          function: 'string'
-          params:
-            key: severity
-            value: 'low'
-          where: log.severity=="5" || log.severity=="6" || log.severity=="7"
       #......................................................................#
       # Adding common geolocation
       - dynamic:
@@ -5138,4 +5114,115 @@ pipeline:
             - log.ciscoSeparator
             - log.irrelevant
             - log.syslogPri
-            - log.rest
\ No newline at end of file
+            - log.rest
+
+      # Normalize explicit outcomes; an unknown outcome remains unset.
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: denied
+          where: oneOf("log.messageId", [106001, 106017, 106023, 106100]) && (equalsIgnoreCase("log.ciscoResult", "Deny") || equalsIgnoreCase("log.ciscoResult", "Denied"))
+      - add:
+          function: string
+          params:
+            key: actionResult
+            value: denied
+          where: equals("log.messageId", 733102)
+
+      # Normalize the source event severity.
+      - add:
+          function: string
+          params:
+            key: severity
+            value: critical
+          where: oneOf("log.severity", [0,1,2])
+      - add:
+          function: string
+          params:
+            key: severity
+            value: error
+          where: oneOf("log.severity", [3])
+      - add:
+          function: string
+          params:
+            key: severity
+            value: warning
+          where: oneOf("log.severity", [4])
+      - add:
+          function: string
+          params:
+            key: severity
+            value: info
+          where: oneOf("log.severity", [5,6])
+      - add:
+          function: string
+          params:
+            key: severity
+            value: debug
+          where: oneOf("log.severity", [7])
+
+      # Keep addresses in IP fields and retain other source values under log.
+      - rename:
+          from:
+          - origin.ip
+          to: log.unparsedOriginIp
+          where: exists("origin.ip") && (!(inCIDR("origin.ip","0.0.0.0/0") || inCIDR("origin.ip","::/0")) || oneOf("origin.ip",["0.0.0.0","::"]))
+      - rename:
+          from:
+          - target.ip
+          to: log.unparsedTargetIp
+          where: exists("target.ip") && (!(inCIDR("target.ip","0.0.0.0/0") || inCIDR("target.ip","::/0")) || oneOf("target.ip",["0.0.0.0","::"]))
+      - add:
+          function: string
+          params:
+            key: protocol
+            value: ICMP
+          where: equals("protocol",1)
+      - add:
+          function: string
+          params:
+            key: protocol
+            value: TCP
+          where: equals("protocol",6)
+      - add:
+          function: string
+          params:
+            key: protocol
+            value: UDP
+          where: equals("protocol",17)
+      - add:
+          function: string
+          params:
+            key: protocol
+            value: GRE
+          where: equals("protocol",47)
+      - add:
+          function: string
+          params:
+            key: protocol
+            value: ESP
+          where: equals("protocol",50)
+      - add:
+          function: string
+          params:
+            key: protocol
+            value: AH
+          where: equals("protocol",51)
+      - add:
+          function: string
+          params:
+            key: protocol
+            value: ICMPV6
+          where: equals("protocol",58)
+      - add:
+          function: string
+          params:
+            key: protocol
+            value: SCTP
+          where: equals("protocol",132)
+      - rename:
+          from:
+          - protocol
+          to: log.ipProtocolNumber
+          where: exists("protocol") && greaterOrEqual("protocol",0)
diff --git a/plugins/alerts/testdata/filter-contracts/cisco-firepower.json b/plugins/alerts/testdata/filter-contracts/cisco-firepower.json
new file mode 100644
index 000000000..64625f014
--- /dev/null
+++ b/plugins/alerts/testdata/filter-contracts/cisco-firepower.json
@@ -0,0 +1,186 @@
+{
+  "technology": "Cisco Firepower",
+  "filters": [
+    "filters/cisco/firepower.yml"
+  ],
+  "rules": [
+    "rules/cisco/firepower/advanced_malware_protection_alerts.yml",
+    "rules/cisco/firepower/c2_nonstandard_port.yml",
+    "rules/cisco/firepower/intrusion_prevention_high_priority_events.yml",
+    "rules/cisco/firepower/ioc_matches.yml",
+    "rules/cisco/firepower/threat_intelligence_director_alerts.yml"
+  ],
+  "fixtures": [
+    {
+      "name": "cisco/firepower.yml invalid IPsec 402114",
+      "filter": "cisco/firepower.yml",
+      "input": {
+        "log": {
+          "messageId": 402114
+        }
+      },
+      "expected": {
+        "actionResult": "failure"
+      },
+      "absent": [],
+      "rules": {}
+    },
+    {
+      "name": "cisco/firepower.yml invalid IPsec 402115",
+      "filter": "cisco/firepower.yml",
+      "input": {
+        "log": {
+          "messageId": 402115
+        }
+      },
+      "expected": {
+        "actionResult": "failure"
+      },
+      "absent": [],
+      "rules": {}
+    },
+    {
+      "name": "cisco/firepower.yml invalid IPsec 402116",
+      "filter": "cisco/firepower.yml",
+      "input": {
+        "log": {
+          "messageId": 402116
+        }
+      },
+      "expected": {
+        "actionResult": "failure"
+      },
+      "absent": [],
+      "rules": {}
+    },
+    {
+      "name": "cisco/firepower.yml invalid IPsec 402117",
+      "filter": "cisco/firepower.yml",
+      "input": {
+        "log": {
+          "messageId": 402117
+        }
+      },
+      "expected": {
+        "actionResult": "failure"
+      },
+      "absent": [],
+      "rules": {}
+    },
+    {
+      "name": "cisco/firepower.yml invalid IPsec 402118",
+      "filter": "cisco/firepower.yml",
+      "input": {
+        "log": {
+          "messageId": 402118
+        }
+      },
+      "expected": {
+        "actionResult": "failure"
+      },
+      "absent": [],
+      "rules": {}
+    },
+    {
+      "name": "cisco/firepower.yml invalid IPsec 402119",
+      "filter": "cisco/firepower.yml",
+      "input": {
+        "log": {
+          "messageId": 402119
+        }
+      },
+      "expected": {
+        "actionResult": "failure"
+      },
+      "absent": [],
+      "rules": {}
+    },
+    {
+      "name": "cisco/firepower.yml invalid IPsec 402120",
+      "filter": "cisco/firepower.yml",
+      "input": {
+        "log": {
+          "messageId": 402120
+        }
+      },
+      "expected": {
+        "actionResult": "failure"
+      },
+      "absent": [],
+      "rules": {}
+    },
+    {
+      "name": "cisco/firepower.yml scan outcome unknown",
+      "filter": "cisco/firepower.yml",
+      "input": {
+        "log": {
+          "messageId": 733101
+        }
+      },
+      "expected": {},
+      "absent": [
+        "actionResult"
+      ],
+      "rules": {}
+    },
+    {
+      "name": "cisco/firepower.yml explicit shun",
+      "filter": "cisco/firepower.yml",
+      "input": {
+        "log": {
+          "messageId": 733102
+        }
+      },
+      "expected": {
+        "actionResult": "denied"
+      },
+      "absent": [],
+      "rules": {}
+    },
+    {
+      "name": "cisco/firepower.yml ACL Permitted",
+      "filter": "cisco/firepower.yml",
+      "input": {
+        "log": {
+          "messageId": 106102,
+          "ciscoResult": "Permitted"
+        }
+      },
+      "expected": {
+        "actionResult": "success"
+      },
+      "absent": [],
+      "rules": {}
+    },
+    {
+      "name": "cisco/firepower.yml ACL Denied",
+      "filter": "cisco/firepower.yml",
+      "input": {
+        "log": {
+          "messageId": 106102,
+          "ciscoResult": "Denied"
+        }
+      },
+      "expected": {
+        "actionResult": "denied"
+      },
+      "absent": [],
+      "rules": {}
+    },
+    {
+      "name": "cisco/firepower.yml ACL unknown",
+      "filter": "cisco/firepower.yml",
+      "input": {
+        "log": {
+          "messageId": 106102,
+          "ciscoResult": "unknown"
+        }
+      },
+      "expected": {},
+      "absent": [
+        "actionResult"
+      ],
+      "rules": {}
+    }
+  ]
+}