Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected

Back
Id69c0644f-4ad5-41b6-9e09-a94c072ab80e
RulenameVMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected
DescriptionThis analytics rule creates notifications of newly connected devices. These clients are connected to the LAN interface of the Edge.
SeverityInformational
Required data connectorsVMwareSDWAN
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-lanside-devicedetect.yaml
Version1.0.0
Arm template69c0644f-4ad5-41b6-9e09-a94c072ab80e.json
Deploy To Azure
VMware_VECO_EventLogs_CL
| extend details = todynamic(detail)
| evaluate bag_unpack(details)
| where event == "EDGE_NEW_DEVICE"
triggerThreshold: 0
incidentConfiguration:
  groupingConfiguration:
    groupByEntities: []
    enabled: true
    groupByCustomDetails: []
    reopenClosedIncident: false
    groupByAlertDetails: []
    lookbackDuration: 1h
    matchingMethod: AllEntities
  createIncident: true
description: This analytics rule creates notifications of newly connected devices. These clients are connected to the LAN interface of the Edge.
customDetails:
  DHCP_Parameter_List: dhcp_param_list
  Client_MAC_Address: client_mac
name: VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-lanside-devicedetect.yaml
suppressionDuration: 5h
version: 1.0.0
triggerOperator: gt
alertDetailsOverride:
  alertDynamicProperties: []
requiredDataConnectors:
- dataTypes:
  - SDWAN
  connectorId: VMwareSDWAN
severity: Informational
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: hostname
  - identifier: OSFamily
    columnName: os_description
  - identifier: OSVersion
    columnName: os_version
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: client_ipv4addr
  entityType: IP
id: 69c0644f-4ad5-41b6-9e09-a94c072ab80e
queryFrequency: 1h
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |+
  VMware_VECO_EventLogs_CL
  | extend details = todynamic(detail)
  | evaluate bag_unpack(details)
  | where event == "EDGE_NEW_DEVICE"  

kind: Scheduled
suppressionEnabled: false
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/69c0644f-4ad5-41b6-9e09-a94c072ab80e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/69c0644f-4ad5-41b6-9e09-a94c072ab80e')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDynamicProperties": []
        },
        "alertRuleTemplateName": "69c0644f-4ad5-41b6-9e09-a94c072ab80e",
        "customDetails": {
          "Client_MAC_Address": "client_mac",
          "DHCP_Parameter_List": "dhcp_param_list"
        },
        "description": "This analytics rule creates notifications of newly connected devices. These clients are connected to the LAN interface of the Edge.",
        "displayName": "VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "hostname",
                "identifier": "HostName"
              },
              {
                "columnName": "os_description",
                "identifier": "OSFamily"
              },
              {
                "columnName": "os_version",
                "identifier": "OSVersion"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "client_ipv4addr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT1H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-lanside-devicedetect.yaml",
        "query": "VMware_VECO_EventLogs_CL\n| extend details = todynamic(detail)\n| evaluate bag_unpack(details)\n| where event == \"EDGE_NEW_DEVICE\"\n\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Informational",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}