VMware_CWS_Weblogs_CL
| where action == "block"
suppressionEnabled: false
description: VMware Cloud Web Security reported access events which were violating web access policy rules. Additional investigation might be required.
kind: Scheduled
requiredDataConnectors:
- connectorId: VMwareSDWAN
dataTypes:
- CWS
incidentConfiguration:
groupingConfiguration:
enabled: false
groupByEntities: []
reopenClosedIncident: false
lookbackDuration: 5h
matchingMethod: AllEntities
groupByCustomDetails: []
groupByAlertDetails: []
createIncident: true
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sase-cws-policyviolation.yaml
severity: Medium
name: VMware Cloud Web Security - Web Access Policy Violation
suppressionDuration: 5h
eventGroupingSettings:
aggregationKind: AlertPerResult
triggerThreshold: 0
queryPeriod: 1h
query: |
VMware_CWS_Weblogs_CL
| where action == "block"
id: b84a1f62-ad30-4ae1-8b21-3d304d8aa818
queryFrequency: 1h
entityMappings:
- entityType: IP
fieldMappings:
- columnName: sourceIp
identifier: Address
- entityType: Malware
fieldMappings:
- columnName: virusList
identifier: Name
- entityType: URL
fieldMappings:
- columnName: url
identifier: Url
- entityType: Account
fieldMappings:
- columnName: userId
identifier: AadUserId
triggerOperator: gt
version: 1.0.0
