Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected

Back
Id69c0644f-4ad5-41b6-9e09-a94c072ab80e
RulenameVMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected
DescriptionThis analytics rule creates notifications of newly connected devices. These clients are connected to the LAN interface of the Edge.
SeverityInformational
Required data connectorsVMwareSDWAN
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-lanside-devicedetect.yaml
Version1.0.0
Arm template69c0644f-4ad5-41b6-9e09-a94c072ab80e.json
Deploy To Azure
VMware_VECO_EventLogs_CL
| extend details = todynamic(detail)
| evaluate bag_unpack(details)
| where event == "EDGE_NEW_DEVICE"
requiredDataConnectors:
- dataTypes:
  - SDWAN
  connectorId: VMwareSDWAN
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: hostname
  - identifier: OSFamily
    columnName: os_description
  - identifier: OSVersion
    columnName: os_version
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: client_ipv4addr
  entityType: IP
queryFrequency: 1h
queryPeriod: 1h
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
suppressionEnabled: false
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-lanside-devicedetect.yaml
customDetails:
  DHCP_Parameter_List: dhcp_param_list
  Client_MAC_Address: client_mac
id: 69c0644f-4ad5-41b6-9e09-a94c072ab80e
query: |+
  VMware_VECO_EventLogs_CL
  | extend details = todynamic(detail)
  | evaluate bag_unpack(details)
  | where event == "EDGE_NEW_DEVICE"  

alertDetailsOverride:
  alertDynamicProperties: []
suppressionDuration: 5h
kind: Scheduled
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 1h
    matchingMethod: AllEntities
    enabled: true
    groupByCustomDetails: []
    groupByAlertDetails: []
    groupByEntities: []
    reopenClosedIncident: false
  createIncident: true
severity: Informational
name: VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected
triggerOperator: gt
description: This analytics rule creates notifications of newly connected devices. These clients are connected to the LAN interface of the Edge.
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/69c0644f-4ad5-41b6-9e09-a94c072ab80e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/69c0644f-4ad5-41b6-9e09-a94c072ab80e')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDynamicProperties": []
        },
        "alertRuleTemplateName": "69c0644f-4ad5-41b6-9e09-a94c072ab80e",
        "customDetails": {
          "Client_MAC_Address": "client_mac",
          "DHCP_Parameter_List": "dhcp_param_list"
        },
        "description": "This analytics rule creates notifications of newly connected devices. These clients are connected to the LAN interface of the Edge.",
        "displayName": "VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "hostname",
                "identifier": "HostName"
              },
              {
                "columnName": "os_description",
                "identifier": "OSFamily"
              },
              {
                "columnName": "os_version",
                "identifier": "OSVersion"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "client_ipv4addr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT1H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-lanside-devicedetect.yaml",
        "query": "VMware_VECO_EventLogs_CL\n| extend details = todynamic(detail)\n| evaluate bag_unpack(details)\n| where event == \"EDGE_NEW_DEVICE\"\n\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Informational",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}