VMware SD-WAN - Orchestrator Audit Event

Back


Id	50c86f92-86b0-4ae3-bb94-698da076ca9e
Rulename	VMware SD-WAN - Orchestrator Audit Event
Description	This rule is searching for configuration changes. Configuration changes can override security measures and the overarching security design. Therefore audit events must be accurately tracked.
Severity	Informational
Required data connectors	VMwareSDWAN
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-orchestrator-config-change.yaml
Version	1.0.0
Arm template	50c86f92-86b0-4ae3-bb94-698da076ca9e.json

KQL

VMware_VECO_EventLogs_CL
| where event == "EDIT_PROFILE"
| extend edgeProfile = extract("^profile \\[(.+)\\] [a-z]+ module", 1, message)
| extend configAction = extract("^profile \\[.+\\] (.+) module", 1, message)
| extend edgeModule = extract("^profile \\[.+\\] [a-z]+ module \\[(.+)\\]$", 1, message)
| extend configChange = todynamic(detail).diff
| project TimeGenerated, severity, edgeProfile, configAction, edgeModule, configChange

YAML

description: This rule is searching for configuration changes. Configuration changes can override security measures and the overarching security design. Therefore audit events must be accurately tracked.
query: |
  VMware_VECO_EventLogs_CL
  | where event == "EDIT_PROFILE"
  | extend edgeProfile = extract("^profile \\[(.+)\\] [a-z]+ module", 1, message)
  | extend configAction = extract("^profile \\[.+\\] (.+) module", 1, message)
  | extend edgeModule = extract("^profile \\[.+\\] [a-z]+ module \\[(.+)\\]$", 1, message)
  | extend configChange = todynamic(detail).diff
  | project TimeGenerated, severity, edgeProfile, configAction, edgeModule, configChange  
severity: Informational
triggerThreshold: 0
queryFrequency: 1h
queryPeriod: 1h
customDetails:
  edgeProfile: edgeProfile
  edgeModule: edgeModule
  auditAction: configAction
eventGroupingSettings:
  aggregationKind: SingleAlert
id: 50c86f92-86b0-4ae3-bb94-698da076ca9e
name: VMware SD-WAN - Orchestrator Audit Event
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    groupByCustomDetails: []
    enabled: true
    matchingMethod: AllEntities
    groupByAlertDetails: []
    groupByEntities: []
    lookbackDuration: 5h
kind: Scheduled
triggerOperator: gt
suppressionEnabled: false
suppressionDuration: 5h
version: 1.0.0
alertDetailsOverride:
  alertDynamicProperties:
  - value: edgeProfile
    alertProperty: ProductComponentName
  alertDescriptionFormat: "There was a configuration change event on the VMware Edge Cloud Orchestrator.\nThe configuration changes are the following:\n{{{configChange}} "
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-orchestrator-config-change.yaml
requiredDataConnectors:
- dataTypes:
  - SDWAN
  connectorId: VMwareSDWAN

ARM