VMware_CWS_Weblogs_CL
| where action == "block"
description: VMware Cloud Web Security reported access events which were violating web access policy rules. Additional investigation might be required.
suppressionEnabled: false
suppressionDuration: 5h
requiredDataConnectors:
- dataTypes:
- CWS
connectorId: VMwareSDWAN
incidentConfiguration:
groupingConfiguration:
reopenClosedIncident: false
groupByAlertDetails: []
lookbackDuration: 5h
groupByEntities: []
groupByCustomDetails: []
enabled: false
matchingMethod: AllEntities
createIncident: true
id: b84a1f62-ad30-4ae1-8b21-3d304d8aa818
severity: Medium
eventGroupingSettings:
aggregationKind: AlertPerResult
query: |
VMware_CWS_Weblogs_CL
| where action == "block"
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sase-cws-policyviolation.yaml
kind: Scheduled
queryPeriod: 1h
name: VMware Cloud Web Security - Web Access Policy Violation
queryFrequency: 1h
triggerThreshold: 0
version: 1.0.0
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: sourceIp
- entityType: Malware
fieldMappings:
- identifier: Name
columnName: virusList
- entityType: URL
fieldMappings:
- identifier: Url
columnName: url
- entityType: Account
fieldMappings:
- identifier: AadUserId
columnName: userId
triggerOperator: gt
