VMware Cloud Web Security - Policy Publish Event

VMware_VECO_EventLogs_CL
| where event == "CWS_EVENT"
| extend cwsPolicyAction = todynamic(detail).subEvent
| where cwsPolicyAction == "CWS_POLICY_PUBLISHED"
| extend cwsPolicyName = todynamic(detail).policyName

queryPeriod: 1h
triggerThreshold: 0
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: 1h
    groupByCustomDetails: []
    reopenClosedIncident: false
    groupByAlertDetails: []
    groupByEntities: []
    matchingMethod: AllEntities
    enabled: true
queryFrequency: 1h
id: b26a7d97-6b6e-43ab-870e-eb18460ae602
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sase-cws-policy-publish.yaml
severity: Informational
alertDetailsOverride:
  alertDescriptionFormat: |-
    CWS Policy Published: {{cwsPolicyName}}

    During publish, the VMware Edge Cloud Orchestrator deploys the CWS policies in SASE POPs, making them effective. All new rules will be enforced. Depending on the contents of the policy, this might create an impact on the CWS Data Plane traffic.    
  alertDynamicProperties: []
requiredDataConnectors:
- connectorId: VMwareSDWAN
  dataTypes:
  - CWS
eventGroupingSettings:
  aggregationKind: AlertPerResult
suppressionDuration: 5h
name: VMware Cloud Web Security - Policy Publish Event
query: |+
  VMware_VECO_EventLogs_CL
  | where event == "CWS_EVENT"
  | extend cwsPolicyAction = todynamic(detail).subEvent
  | where cwsPolicyAction == "CWS_POLICY_PUBLISHED"
  | extend cwsPolicyName = todynamic(detail).policyName  

triggerOperator: gt
kind: Scheduled
suppressionEnabled: false
version: 1.0.0
description: This alert is capturing events when VMware CWS policies were published. During publish, the VMware Edge Cloud Orchestrator deploys the CWS policies in SASE POPs, making them effective. All new rules will be enforced. Depending on the contents of the policy, this might create an impact on the CWS Data Plane traffic.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b26a7d97-6b6e-43ab-870e-eb18460ae602')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b26a7d97-6b6e-43ab-870e-eb18460ae602')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "CWS Policy Published: {{cwsPolicyName}}\n\nDuring publish, the VMware Edge Cloud Orchestrator deploys the CWS policies in SASE POPs, making them effective. All new rules will be enforced. Depending on the contents of the policy, this might create an impact on the CWS Data Plane traffic.",
          "alertDynamicProperties": []
        },
        "alertRuleTemplateName": "b26a7d97-6b6e-43ab-870e-eb18460ae602",
        "customDetails": null,
        "description": "This alert is capturing events when VMware CWS policies were published. During publish, the VMware Edge Cloud Orchestrator deploys the CWS policies in SASE POPs, making them effective. All new rules will be enforced. Depending on the contents of the policy, this might create an impact on the CWS Data Plane traffic.",
        "displayName": "VMware Cloud Web Security - Policy Publish Event",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT1H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sase-cws-policy-publish.yaml",
        "query": "VMware_VECO_EventLogs_CL\n| where event == \"CWS_EVENT\"\n| extend cwsPolicyAction = todynamic(detail).subEvent\n| where cwsPolicyAction == \"CWS_POLICY_PUBLISHED\"\n| extend cwsPolicyName = todynamic(detail).policyName\n\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Informational",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}