diff --git a/decoders/0065-cisco-ios_decoders.xml b/decoders/0065-cisco-ios_decoders.xml
index 214c56e6a..39040e8a1 100644
--- a/decoders/0065-cisco-ios_decoders.xml
+++ b/decoders/0065-cisco-ios_decoders.xml
@@ -83,11 +83,10 @@
 
 <decoder name="cisco-ios-acl">
   <parent>cisco-ios</parent>
-  <type>firewall</type>
   <prematch>^%SEC-6-IPACCESSLOGP: </prematch>
-  <regex offset="after_prematch">^list \S+ (\w+) (\w+) </regex>
+  <regex>(%\w+-\d-\w+):\s+list \S+ (\w+) (\w+) </regex>
   <regex>(\S+)\((\d+)\) -> (\S+)\((\d+)\),</regex>
-  <order>action, protocol, srcip, srcport, dstip, dstport</order>
+  <order>id ,action, protocol, srcip, srcport, dstip, dstport</order>
 </decoder>
 
 
diff --git a/rules/0075-cisco-ios_rules.xml b/rules/0075-cisco-ios_rules.xml
index 4ee96a928..30587c3f7 100644
--- a/rules/0075-cisco-ios_rules.xml
+++ b/rules/0075-cisco-ios_rules.xml
@@ -86,4 +86,19 @@
     <group>authentication_failed,pci_dss_10.2.5,pci_dss_10.2.4,gpg13_3.6,gdpr_IV_35.7.d,gdpr_IV_32.2,</group>
   </rule>
 
+    <rule id="4731" level="5">
+    <if_sid>4716</if_sid>
+    <id>^%SEC-6-IPACCESSLOGP</id>
+    <description>Cisco ACL: denied access event.</description>
+    <group>firewall_drop,pci_dss_1.4,gpg13_4.12,gdpr_IV_35.7.d,</group>
+  </rule>
+  
+  <rule id="4732" level="10" frequency="18" timeframe="45" ignore="240">
+    <if_matched_sid>4731</if_matched_sid>
+    <id>^%SEC-6-IPACCESSLOGP</id>
+    <action>denied</action>
+    <description>Cisco ACL: multiple denied access from same source.</description>
+    <group>multiple_drops,pci_dss_1.4,pci_dss_10.6.1,gpg13_4.12,gdpr_IV_35.7.d,</group>
+  </rule>
+
 </group>
diff --git a/tools/rules-testing/tests/cisco_ios.ini b/tools/rules-testing/tests/cisco_ios.ini
index e4a7a1e04..be7f1bec7 100644
--- a/tools/rules-testing/tests/cisco_ios.ini
+++ b/tools/rules-testing/tests/cisco_ios.ini
@@ -14,8 +14,8 @@ log 1 pass = Sep  1 10:25:29 10.10.10.1 %SEC-6-IPACCESSLOGP: list 102 denied tcp
 log 2 pass = Sep  1 10:25:29 10.10.10.1 %SEC-6-IPACCESSLOGP: list 199 denied tcp 10.0.61.108(1477) -> 10.0.127.20(445), 1 packet
 
 
-rule = 4100
-alert = 0
+rule = 4731
+alert = 5
 decoder = cisco-ios