VMware SD-WAN Edge - Device Congestion Alert - Packet Drops

Back


Id	a88ead0a-f022-48d6-8f53-e5a164c4c72e
Rulename	VMware SD-WAN Edge - Device Congestion Alert - Packet Drops
Description	The VMware Edge Cloud Orchestrator reported an edge congestion event, where the Edge is dropping a large number of packets on one of its interfaces. This could indicate an ongoing Denial of Service attack against an appliance. Please make sure that Network Flood Protection is turned on.
Severity	Medium
Tactics	Impact
Techniques	T1498
Required data connectors	VMwareSDWAN
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-device-congestion.yaml
Version	1.0.0
Arm template	a88ead0a-f022-48d6-8f53-e5a164c4c72e.json

KQL

VMware_VECO_EventLogs_CL
| where event == "EDGE_CONGESTED"
| where message contains "high number of packet drops"
| extend edgeSerialNumber = extract("edgeSerialNumber: (.+)$", 1, detail)

YAML

name: VMware SD-WAN Edge - Device Congestion Alert - Packet Drops
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    groupByCustomDetails: []
    groupByAlertDetails: []
    enabled: true
    matchingMethod: AllEntities
    groupByEntities: []
    lookbackDuration: 5h
  createIncident: true
query: |-
  VMware_VECO_EventLogs_CL
  | where event == "EDGE_CONGESTED"
  | where message contains "high number of packet drops"
  | extend edgeSerialNumber = extract("edgeSerialNumber: (.+)$", 1, detail)  
queryPeriod: 1h
triggerOperator: gt
suppressionEnabled: false
tactics:
- Impact
suppressionDuration: 5h
kind: Scheduled
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-device-congestion.yaml
eventGroupingSettings:
  aggregationKind: SingleAlert
relevantTechniques:
- T1498
id: a88ead0a-f022-48d6-8f53-e5a164c4c72e
customDetails:
  edgeSerialNumber: edgeSerialNumber
severity: Medium
requiredDataConnectors:
- connectorId: VMwareSDWAN
  dataTypes:
  - SDWAN
version: 1.0.0
description: The VMware Edge Cloud Orchestrator reported an edge congestion event, where the Edge is dropping a large number of packets on one of its interfaces. This could indicate an ongoing Denial of Service attack against an appliance. Please make sure that Network Flood Protection is turned on.
queryFrequency: 1h

ARM