VMware Cloud Web Security - Policy Publish Event

Severity: informational
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

This alert is capturing events when VMware CWS policies were published. During publish, the VMware Edge Cloud Orchestrator deploys the CWS policies in SASE POPs, making them effective. All new rules will be enforced. Depending on the contents of the policy, this might create an impact on the CWS Data Plane traffic.

Rule body

id: b26a7d97-6b6e-43ab-870e-eb18460ae602
name: VMware Cloud Web Security - Policy Publish Event
version: 1.0.0
kind: Scheduled
description: This alert is capturing events when VMware CWS policies were published. During publish, the VMware Edge Cloud Orchestrator deploys the CWS policies in SASE POPs, making them effective. All new rules will be enforced. Depending on the contents of the policy, this might create an impact on the CWS Data Plane traffic.
severity: Informational
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
requiredDataConnectors:
  - connectorId: VMwareSDWAN
    dataTypes:
      - CWS
query: |+
  VMware_VECO_EventLogs_CL
  | where event == "CWS_EVENT"
  | extend cwsPolicyAction = todynamic(detail).subEvent
  | where cwsPolicyAction == "CWS_POLICY_PUBLISHED"
  | extend cwsPolicyName = todynamic(detail).policyName
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDescriptionFormat: |-
    CWS Policy Published: {{cwsPolicyName}}

    During publish, the VMware Edge Cloud Orchestrator deploys the CWS policies in SASE POPs, making them effective. All new rules will be enforced. Depending on the contents of the policy, this might create an impact on the CWS Data Plane traffic.
  alertDynamicProperties: []
suppressionDuration: 5h

Stages and Predicates

Stage 1: `source`

VMware_VECO_EventLogs_CL

Stage 2: `where`

| where event == "CWS_EVENT"

Stage 3: `extend`

| extend cwsPolicyAction = todynamic(detail).subEvent

Stage 4: `where`

| where cwsPolicyAction == "CWS_POLICY_PUBLISHED"

Stage 5: `extend`

| extend cwsPolicyName = todynamic(detail).policyName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`cwsPolicyAction`	eq	`CWS_POLICY_PUBLISHED`	`field:"cwsPolicyAction" kind:eq value:"CWS_POLICY_PUBLISHED"`
`event`	eq	`CWS_EVENT`	`field:"event" kind:eq value:"CWS_EVENT"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`cwsPolicyAction`	`extend`
`cwsPolicyName`	`extend`

VMware Cloud Web Security - Policy Publish Event

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: where