Cisco Secure Firewall ASA · Event 733100

ASA 733100: A drop rate crossed a threat-detection threshold

Basic threat detection counts things the firewall drops and complains when the rate goes above a threshold. The thresholds are Cisco's defaults, not yours, so the first question is never 'what attacked us' — it is whether this threshold means anything in your environment.

Also written as %ASA-4-733100ASA 733100drop rate exceededasa threat detection scanning

How oftenFires regularly
Vendor calls it%ASA-4 (Warning)
Logsyslog

What it means for you

For an analyst

Read the object name before the numbers. 'Firewall' counts ACL drops and rises whenever the internet scans you; 'Scanning' means a host tripped the scanning-threat heuristics and is the one that can actually trigger shunning; 'Interface' counts drops on a link and often reflects capacity rather than attack. The default average rates are low enough that a moderately busy internet edge crosses them daily, which is why this message has a reputation for noise. Note that basic threat detection is on by default while scanning threat detection is not, and that enabling shun on the latter gives the ASA authority to block hosts on its own — worth understanding before you turn it on.

The fields that decide it

Everything else in the log line is context.

Object: What was being counted. This determines what the message actually means.
Current burst rate versus max configured burst rate: The short-window measurement and the threshold it crossed. Bursts trip far more easily than averages and account for most of the noise.
Current average rate versus max configured rate: The longer-window measurement. An average that is consistently above the threshold is a real signal; a burst that spikes once is usually not.
Cumulative total count: The running total since the counter was reset. Useful for trend, useless for judging any single message.
rate_ID: Which of the configured rate intervals tripped. The ASA tracks several windows at once and the ID tells you which one this was.

Common questions

Is ASA 733100 an attack?

Not by itself. It says a counter crossed a threshold, and the default thresholds are conservative enough that an internet-facing firewall crosses them from ordinary background scanning. Read the object name: a 'Firewall' drop rate rising usually means the internet is being the internet, while a 'Scanning' object means a specific host tripped the scanning heuristics and is worth looking at.

How do I stop ASA 733100 from filling my logs?

Tune the thresholds rather than suppressing the message. 'threat-detection rate' lets you set your own average and burst rates per event type, based on what your firewall actually sees. If you have no intention of acting on the data at all, 'no threat-detection basic-threat' turns the feature off — but tuning is usually the better answer, because the trend is genuinely useful.

What is the difference between basic and scanning threat detection?

Basic threat detection counts drops and reports rates; it is enabled by default and cannot block anything. Scanning threat detection profiles individual hosts and can classify one as an attacker, optionally shunning it automatically. Scanning detection costs noticeably more CPU and, with shunning enabled, gives the firewall authority to block traffic on its own judgement — which is worth deciding deliberately rather than switching on to see what happens.

How do I see which host caused a scanning threat detection?

Use 'show threat-detection scanning-threat' for the attackers and targets the ASA has identified, and 'show threat-detection rate' to see the current counters against their thresholds. The syslog message reports the rate; those commands report the hosts, which is what you need to act.

Vendor documentation

Last reviewed 6 September 2026