VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected

Back


Id	69c0644f-4ad5-41b6-9e09-a94c072ab80e
Rulename	VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected
Description	This analytics rule creates notifications of newly connected devices. These clients are connected to the LAN interface of the Edge.
Severity	Informational
Required data connectors	VMwareSDWAN
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-lanside-devicedetect.yaml
Version	1.0.0
Arm template	69c0644f-4ad5-41b6-9e09-a94c072ab80e.json

KQL

VMware_VECO_EventLogs_CL
| extend details = todynamic(detail)
| evaluate bag_unpack(details)
| where event == "EDGE_NEW_DEVICE"

YAML

kind: Scheduled
triggerThreshold: 0
triggerOperator: gt
version: 1.0.0
alertDetailsOverride:
  alertDynamicProperties: []
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    enabled: true
    matchingMethod: AllEntities
    groupByAlertDetails: []
    groupByEntities: []
    groupByCustomDetails: []
    lookbackDuration: 1h
suppressionDuration: 5h
queryFrequency: 1h
id: 69c0644f-4ad5-41b6-9e09-a94c072ab80e
requiredDataConnectors:
- connectorId: VMwareSDWAN
  dataTypes:
  - SDWAN
suppressionEnabled: false
name: VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected
description: This analytics rule creates notifications of newly connected devices. These clients are connected to the LAN interface of the Edge.
customDetails:
  Client_MAC_Address: client_mac
  DHCP_Parameter_List: dhcp_param_list
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: hostname
    identifier: HostName
  - columnName: os_description
    identifier: OSFamily
  - columnName: os_version
    identifier: OSVersion
- entityType: IP
  fieldMappings:
  - columnName: client_ipv4addr
    identifier: Address
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-lanside-devicedetect.yaml
queryPeriod: 1h
severity: Informational
query: |+
  VMware_VECO_EventLogs_CL
  | extend details = todynamic(detail)
  | evaluate bag_unpack(details)
  | where event == "EDGE_NEW_DEVICE"  

eventGroupingSettings:
  aggregationKind: AlertPerResult

ARM