VMware SD-WAN - Orchestrator Audit Event

Back


Id	50c86f92-86b0-4ae3-bb94-698da076ca9e
Rulename	VMware SD-WAN - Orchestrator Audit Event
Description	This rule is searching for configuration changes. Configuration changes can override security measures and the overarching security design. Therefore audit events must be accurately tracked.
Severity	Informational
Required data connectors	VMwareSDWAN
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-orchestrator-config-change.yaml
Version	1.0.0
Arm template	50c86f92-86b0-4ae3-bb94-698da076ca9e.json

KQL

VMware_VECO_EventLogs_CL
| where event == "EDIT_PROFILE"
| extend edgeProfile = extract("^profile \\[(.+)\\] [a-z]+ module", 1, message)
| extend configAction = extract("^profile \\[.+\\] (.+) module", 1, message)
| extend edgeModule = extract("^profile \\[.+\\] [a-z]+ module \\[(.+)\\]$", 1, message)
| extend configChange = todynamic(detail).diff
| project TimeGenerated, severity, edgeProfile, configAction, edgeModule, configChange

YAML

queryFrequency: 1h
eventGroupingSettings:
  aggregationKind: SingleAlert
id: 50c86f92-86b0-4ae3-bb94-698da076ca9e
triggerOperator: gt
incidentConfiguration:
  groupingConfiguration:
    groupByCustomDetails: []
    enabled: true
    lookbackDuration: 5h
    groupByEntities: []
    matchingMethod: AllEntities
    groupByAlertDetails: []
    reopenClosedIncident: false
  createIncident: true
query: |
  VMware_VECO_EventLogs_CL
  | where event == "EDIT_PROFILE"
  | extend edgeProfile = extract("^profile \\[(.+)\\] [a-z]+ module", 1, message)
  | extend configAction = extract("^profile \\[.+\\] (.+) module", 1, message)
  | extend edgeModule = extract("^profile \\[.+\\] [a-z]+ module \\[(.+)\\]$", 1, message)
  | extend configChange = todynamic(detail).diff
  | project TimeGenerated, severity, edgeProfile, configAction, edgeModule, configChange  
queryPeriod: 1h
suppressionEnabled: false
customDetails:
  edgeProfile: edgeProfile
  auditAction: configAction
  edgeModule: edgeModule
name: VMware SD-WAN - Orchestrator Audit Event
triggerThreshold: 0
kind: Scheduled
requiredDataConnectors:
- connectorId: VMwareSDWAN
  dataTypes:
  - SDWAN
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-orchestrator-config-change.yaml
version: 1.0.0
severity: Informational
alertDetailsOverride:
  alertDescriptionFormat: "There was a configuration change event on the VMware Edge Cloud Orchestrator.\nThe configuration changes are the following:\n{{{configChange}} "
  alertDynamicProperties:
  - alertProperty: ProductComponentName
    value: edgeProfile
description: This rule is searching for configuration changes. Configuration changes can override security measures and the overarching security design. Therefore audit events must be accurately tracked.
suppressionDuration: 5h

ARM