VMware SD-WAN - Orchestrator Audit Event

Back


Id	50c86f92-86b0-4ae3-bb94-698da076ca9e
Rulename	VMware SD-WAN - Orchestrator Audit Event
Description	This rule is searching for configuration changes. Configuration changes can override security measures and the overarching security design. Therefore audit events must be accurately tracked.
Severity	Informational
Required data connectors	VMwareSDWAN
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-orchestrator-config-change.yaml
Version	1.0.0
Arm template	50c86f92-86b0-4ae3-bb94-698da076ca9e.json

KQL

VMware_VECO_EventLogs_CL
| where event == "EDIT_PROFILE"
| extend edgeProfile = extract("^profile \\[(.+)\\] [a-z]+ module", 1, message)
| extend configAction = extract("^profile \\[.+\\] (.+) module", 1, message)
| extend edgeModule = extract("^profile \\[.+\\] [a-z]+ module \\[(.+)\\]$", 1, message)
| extend configChange = todynamic(detail).diff
| project TimeGenerated, severity, edgeProfile, configAction, edgeModule, configChange

YAML

customDetails:
  auditAction: configAction
  edgeProfile: edgeProfile
  edgeModule: edgeModule
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-orchestrator-config-change.yaml
alertDetailsOverride:
  alertDescriptionFormat: "There was a configuration change event on the VMware Edge Cloud Orchestrator.\nThe configuration changes are the following:\n{{{configChange}} "
  alertDynamicProperties:
  - value: edgeProfile
    alertProperty: ProductComponentName
query: |
  VMware_VECO_EventLogs_CL
  | where event == "EDIT_PROFILE"
  | extend edgeProfile = extract("^profile \\[(.+)\\] [a-z]+ module", 1, message)
  | extend configAction = extract("^profile \\[.+\\] (.+) module", 1, message)
  | extend edgeModule = extract("^profile \\[.+\\] [a-z]+ module \\[(.+)\\]$", 1, message)
  | extend configChange = todynamic(detail).diff
  | project TimeGenerated, severity, edgeProfile, configAction, edgeModule, configChange  
requiredDataConnectors:
- dataTypes:
  - SDWAN
  connectorId: VMwareSDWAN
incidentConfiguration:
  groupingConfiguration:
    groupByCustomDetails: []
    enabled: true
    matchingMethod: AllEntities
    groupByEntities: []
    lookbackDuration: 5h
    groupByAlertDetails: []
    reopenClosedIncident: false
  createIncident: true
kind: Scheduled
name: VMware SD-WAN - Orchestrator Audit Event
severity: Informational
suppressionEnabled: false
triggerOperator: gt
description: This rule is searching for configuration changes. Configuration changes can override security measures and the overarching security design. Therefore audit events must be accurately tracked.
queryFrequency: 1h
triggerThreshold: 0
queryPeriod: 1h
version: 1.0.0
suppressionDuration: 5h
eventGroupingSettings:
  aggregationKind: SingleAlert
id: 50c86f92-86b0-4ae3-bb94-698da076ca9e

ARM