VMware SD-WAN Edge - IDSIPS Alert triggered Search API

Back


Id	44f78dbf-9f29-4ec0-aaca-ab5bf0b559af
Rulename	VMware SD-WAN Edge - IDS/IPS Alert triggered (Search API)
Description	The VMware SD-WAN Edge appliance captured a potentially malicious traffic flow. Please investigate the IOC information available. This analytics rule analyses Search API streams. Search API queries report only IDS/IPS Alerts. In case you would also need Network Flood Protection, please enable Syslog collection using AMA.
Severity	High
Tactics	LateralMovement
Techniques	T1210
Required data connectors	VMwareSDWAN
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-idps-alert-api.yaml
Version	1.0.0
Arm template	44f78dbf-9f29-4ec0-aaca-ab5bf0b559af.json

KQL

VMware_SDWAN_FirewallLogs_CL
| project TimeGenerated, signature, severity, category, signatureId, actionTaken, edgeName, sourceIp, protocol, sourcePort, destinationIp, destinationPort, domainName, attackSource, attackTarget, firewallPolicyName

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-idps-alert-api.yaml
severity: High
suppressionEnabled: false
queryPeriod: 1h
customDetails:
  IDPS_Signature: signature
  IDPS_Event_Category: category
name: VMware SD-WAN Edge - IDS/IPS Alert triggered (Search API)
suppressionDuration: 5h
query: |
  VMware_SDWAN_FirewallLogs_CL
  | project TimeGenerated, signature, severity, category, signatureId, actionTaken, edgeName, sourceIp, protocol, sourcePort, destinationIp, destinationPort, domainName, attackSource, attackTarget, firewallPolicyName  
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    matchingMethod: AllEntities
    groupByAlertDetails: []
    groupByEntities: []
    reopenClosedIncident: false
    lookbackDuration: 1h
    groupByCustomDetails: []
requiredDataConnectors:
- connectorId: VMwareSDWAN
  dataTypes:
  - SDWAN
entityMappings:
- entityType: DNS
  fieldMappings:
  - columnName: domainName
    identifier: DomainName
- entityType: IP
  fieldMappings:
  - columnName: sourceIp
    identifier: Address
description: |-
  The VMware SD-WAN Edge appliance captured a potentially malicious traffic flow. Please investigate the IOC information available.

  This analytics rule analyses Search API streams. Search API queries report only IDS/IPS Alerts. In case you would also need Network Flood Protection, please enable Syslog collection using AMA.  
relevantTechniques:
- T1210
tactics:
- LateralMovement
queryFrequency: 1h
alertDetailsOverride:
  alertDynamicProperties: []
eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerThreshold: 0
kind: Scheduled
version: 1.0.0
triggerOperator: gt
id: 44f78dbf-9f29-4ec0-aaca-ab5bf0b559af

ARM