VMware SD-WAN Edge - IDSIPS Alert triggered Syslog

Back


Id	a8e2bfd2-5d9c-4acc-aa55-30029e50d574
Rulename	VMware SD-WAN Edge - IDS/IPS Alert triggered (Syslog)
Description	The VMware SD-WAN Edge appliance captured a potentially malicious traffic flow. Please investigate the IOC information available. This analytics rule analyzes Syslog streams.
Severity	High
Tactics	LateralMovement
Techniques	T1210
Required data connectors	VMwareSDWAN
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-idps-alert-syslog.yaml
Version	1.0.0
Arm template	a8e2bfd2-5d9c-4acc-aa55-30029e50d574.json

KQL

Syslog
| where SyslogMessage contains "VCF Alert"
| project-rename EdgeName=HostName
| project-away Computer, HostIP, SourceSystem, Type
| extend IdpsSignatureName = extract("SIGNATURE=(.+) CATEGORY=", 1, SyslogMessage)
| extend IdpsAlertCategory = extract("CATEGORY=(.+) SEVERITY=", 1, SyslogMessage)
| extend IdpsAlertSeverity = extract("SEVERITY=(.+) SRC_IP=", 1, SyslogMessage)
| extend IdpsSignatureId = extract("SIG_ID=([0-9]+) SIGNATURE=", 1, SyslogMessage)
| extend OverlaySegmentName = extract("SEGMENT_NAME=(.+) SIG_ID=", 1, SyslogMessage)
| extend IpProtocol = extract("PROTO=([A-Z]+) SRC=", 1, SyslogMessage)
| extend SrcIpAddress = extract("SRC=(.+) DST=", 1, SyslogMessage)
| extend SrcPort = extract("SPT=([0-9]+) DPT=", 1, SyslogMessage)
| extend DstIpAddress = extract("DST=(.+) SPT=", 1, SyslogMessage)
| extend DstPort = extract("DPT=(.+) DEST_DOMAIN=", 1, SyslogMessage)
| extend VictimIp = extract("TARGET_IP=(.+) TARGET_PORT=", 1, SyslogMessage)
| extend AttackerIp = extract("SRC_IP=(.+) SRC_PORT=", 1, SyslogMessage)
| extend DomainName = extract("DEST_DOMAIN=(.+) FW_POLICY_NAME=", 1, SyslogMessage)
| extend EdgeFwAction = extract("ATP_ACTION=(.+) SEGMENT=", 1, SyslogMessage)
| extend SyslogTag = extract("$(.+): ACTION=", 1, SyslogMessage)
| extend FwPolicyName = extract("FW_POLICY_NAME=(.+) SEGMENT_NAME=", 1, SyslogMessage)
| project
    TimeGenerated,
    IdpsSignatureName,
    IdpsAlertSeverity,
    IdpsAlertCategory,
    IdpsSignatureId,
    EdgeFwAction,
    EdgeName,
    SrcIpAddress,
    IpProtocol,
    SrcPort,
    DstIpAddress,
    DstPort,
    DomainName,
    AttackerIp,
    VictimIp,
    FwPolicyName,
    SyslogTag

YAML

name: VMware SD-WAN Edge - IDS/IPS Alert triggered (Syslog)
kind: Scheduled
description: |-
  The VMware SD-WAN Edge appliance captured a potentially malicious traffic flow. Please investigate the IOC information available.

  This analytics rule analyzes Syslog streams.  
entityMappings:
- entityType: DNS
  fieldMappings:
  - columnName: DomainName
    identifier: DomainName
- entityType: IP
  fieldMappings:
  - columnName: VictimIp
    identifier: Address
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-idps-alert-syslog.yaml
version: 1.0.0
triggerThreshold: 0
suppressionDuration: 5h
queryFrequency: 1h
customDetails:
  IDPS_Signature: IdpsSignatureName
  IDPS_Event_Category: IdpsAlertCategory
  Edge_Name: EdgeName
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: 1h
    groupByCustomDetails: []
    groupByEntities: []
    enabled: true
    matchingMethod: AllEntities
    groupByAlertDetails: []
    reopenClosedIncident: false
triggerOperator: gt
relevantTechniques:
- T1210
tactics:
- LateralMovement
eventGroupingSettings:
  aggregationKind: AlertPerResult
requiredDataConnectors:
- connectorId: VMwareSDWAN
  dataTypes:
  - SDWAN
severity: High
queryPeriod: 1h
query: |-
  Syslog
  | where SyslogMessage contains "VCF Alert"
  | project-rename EdgeName=HostName
  | project-away Computer, HostIP, SourceSystem, Type
  | extend IdpsSignatureName = extract("SIGNATURE=(.+) CATEGORY=", 1, SyslogMessage)
  | extend IdpsAlertCategory = extract("CATEGORY=(.+) SEVERITY=", 1, SyslogMessage)
  | extend IdpsAlertSeverity = extract("SEVERITY=(.+) SRC_IP=", 1, SyslogMessage)
  | extend IdpsSignatureId = extract("SIG_ID=([0-9]+) SIGNATURE=", 1, SyslogMessage)
  | extend OverlaySegmentName = extract("SEGMENT_NAME=(.+) SIG_ID=", 1, SyslogMessage)
  | extend IpProtocol = extract("PROTO=([A-Z]+) SRC=", 1, SyslogMessage)
  | extend SrcIpAddress = extract("SRC=(.+) DST=", 1, SyslogMessage)
  | extend SrcPort = extract("SPT=([0-9]+) DPT=", 1, SyslogMessage)
  | extend DstIpAddress = extract("DST=(.+) SPT=", 1, SyslogMessage)
  | extend DstPort = extract("DPT=(.+) DEST_DOMAIN=", 1, SyslogMessage)
  | extend VictimIp = extract("TARGET_IP=(.+) TARGET_PORT=", 1, SyslogMessage)
  | extend AttackerIp = extract("SRC_IP=(.+) SRC_PORT=", 1, SyslogMessage)
  | extend DomainName = extract("DEST_DOMAIN=(.+) FW_POLICY_NAME=", 1, SyslogMessage)
  | extend EdgeFwAction = extract("ATP_ACTION=(.+) SEGMENT=", 1, SyslogMessage)
  | extend SyslogTag = extract("$(.+): ACTION=", 1, SyslogMessage)
  | extend FwPolicyName = extract("FW_POLICY_NAME=(.+) SEGMENT_NAME=", 1, SyslogMessage)
  | project
      TimeGenerated,
      IdpsSignatureName,
      IdpsAlertSeverity,
      IdpsAlertCategory,
      IdpsSignatureId,
      EdgeFwAction,
      EdgeName,
      SrcIpAddress,
      IpProtocol,
      SrcPort,
      DstIpAddress,
      DstPort,
      DomainName,
      AttackerIp,
      VictimIp,
      FwPolicyName,
      SyslogTag  
suppressionEnabled: false
id: a8e2bfd2-5d9c-4acc-aa55-30029e50d574

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a8e2bfd2-5d9c-4acc-aa55-30029e50d574')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a8e2bfd2-5d9c-4acc-aa55-30029e50d574')]",
      "properties": {
        "alertRuleTemplateName": "a8e2bfd2-5d9c-4acc-aa55-30029e50d574",
        "customDetails": {
          "Edge_Name": "EdgeName",
          "IDPS_Event_Category": "IdpsAlertCategory",
          "IDPS_Signature": "IdpsSignatureName"
        },
        "description": "The VMware SD-WAN Edge appliance captured a potentially malicious traffic flow. Please investigate the IOC information available.\n\nThis analytics rule analyzes Syslog streams.",
        "displayName": "VMware SD-WAN Edge - IDS/IPS Alert triggered (Syslog)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "DomainName",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "VictimIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT1H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-idps-alert-syslog.yaml",
        "query": "Syslog\n| where SyslogMessage contains \"VCF Alert\"\n| project-rename EdgeName=HostName\n| project-away Computer, HostIP, SourceSystem, Type\n| extend IdpsSignatureName = extract(\"SIGNATURE=(.+) CATEGORY=\", 1, SyslogMessage)\n| extend IdpsAlertCategory = extract(\"CATEGORY=(.+) SEVERITY=\", 1, SyslogMessage)\n| extend IdpsAlertSeverity = extract(\"SEVERITY=(.+) SRC_IP=\", 1, SyslogMessage)\n| extend IdpsSignatureId = extract(\"SIG_ID=([0-9]+) SIGNATURE=\", 1, SyslogMessage)\n| extend OverlaySegmentName = extract(\"SEGMENT_NAME=(.+) SIG_ID=\", 1, SyslogMessage)\n| extend IpProtocol = extract(\"PROTO=([A-Z]+) SRC=\", 1, SyslogMessage)\n| extend SrcIpAddress = extract(\"SRC=(.+) DST=\", 1, SyslogMessage)\n| extend SrcPort = extract(\"SPT=([0-9]+) DPT=\", 1, SyslogMessage)\n| extend DstIpAddress = extract(\"DST=(.+) SPT=\", 1, SyslogMessage)\n| extend DstPort = extract(\"DPT=(.+) DEST_DOMAIN=\", 1, SyslogMessage)\n| extend VictimIp = extract(\"TARGET_IP=(.+) TARGET_PORT=\", 1, SyslogMessage)\n| extend AttackerIp = extract(\"SRC_IP=(.+) SRC_PORT=\", 1, SyslogMessage)\n| extend DomainName = extract(\"DEST_DOMAIN=(.+) FW_POLICY_NAME=\", 1, SyslogMessage)\n| extend EdgeFwAction = extract(\"ATP_ACTION=(.+) SEGMENT=\", 1, SyslogMessage)\n| extend SyslogTag = extract(\"$(.+): ACTION=\", 1, SyslogMessage)\n| extend FwPolicyName = extract(\"FW_POLICY_NAME=(.+) SEGMENT_NAME=\", 1, SyslogMessage)\n| project\n    TimeGenerated,\n    IdpsSignatureName,\n    IdpsAlertSeverity,\n    IdpsAlertCategory,\n    IdpsSignatureId,\n    EdgeFwAction,\n    EdgeName,\n    SrcIpAddress,\n    IpProtocol,\n    SrcPort,\n    DstIpAddress,\n    DstPort,\n    DomainName,\n    AttackerIp,\n    VictimIp,\n    FwPolicyName,\n    SyslogTag",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "LateralMovement"
        ],
        "techniques": [
          "T1210"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}