VMware Cloud Web Security - Policy Change Detected

Back


Id	3efebd49-c985-431b-9da8-d7d397092d18
Rulename	VMware Cloud Web Security - Policy Change Detected
Description	This Analytics rule provides notifications when a VMware CWS policy has been modified. These alerts serve audit purposes. Policy changes might lower the level of security controls.
Severity	Informational
Required data connectors	VMwareSDWAN
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sase-cws-policychange.yaml
Version	1.0.0
Arm template	3efebd49-c985-431b-9da8-d7d397092d18.json

KQL

VMware_VECO_EventLogs_CL
| where event == "CWS_EVENT"
| extend cwsPolicyAction = todynamic(detail).subEvent
| where cwsPolicyAction contains "SECURITY_RULE"
| extend cwsRuleName = todynamic(detail).name
| extend cwsRuleType = todynamic(detail).data.ruleType
| extend cwsPolicyName = todynamic(detail).policyName

YAML

query: |+
  VMware_VECO_EventLogs_CL
  | where event == "CWS_EVENT"
  | extend cwsPolicyAction = todynamic(detail).subEvent
  | where cwsPolicyAction contains "SECURITY_RULE"
  | extend cwsRuleName = todynamic(detail).name
  | extend cwsRuleType = todynamic(detail).data.ruleType
  | extend cwsPolicyName = todynamic(detail).policyName  

queryFrequency: 1h
suppressionEnabled: false
queryPeriod: 1h
triggerOperator: gt
alertDetailsOverride:
  alertDescriptionFormat: |+
    CWS Policy Change Detected:

    CWS Policy Name: {{cwsPolicyName}}
     - Rule changed: {{cwsRuleName}}
        - Audited Action: {{cwsPolicyAction}}    

  alertDynamicProperties:
  - alertProperty: ProductComponentName
    value: cwsRuleType
suppressionDuration: 5h
eventGroupingSettings:
  aggregationKind: AlertPerResult
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sase-cws-policychange.yaml
description: This Analytics rule provides notifications when a VMware CWS policy has been modified. These alerts serve audit purposes. Policy changes might lower the level of security controls.
triggerThreshold: 0
requiredDataConnectors:
- connectorId: VMwareSDWAN
  dataTypes:
  - CWS
kind: Scheduled
version: 1.0.0
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    groupByCustomDetails: []
    enabled: true
    groupByAlertDetails: []
    matchingMethod: AllEntities
    lookbackDuration: 1h
    groupByEntities: []
  createIncident: true
name: VMware Cloud Web Security - Policy Change Detected
id: 3efebd49-c985-431b-9da8-d7d397092d18
severity: Informational

ARM