VMware Cloud Web Security - Policy Change Detected

Severity: informational
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

This Analytics rule provides notifications when a VMware CWS policy has been modified. These alerts serve audit purposes. Policy changes might lower the level of security controls.

Rule body

id: 3efebd49-c985-431b-9da8-d7d397092d18
name: VMware Cloud Web Security - Policy Change Detected
version: 1.0.0
kind: Scheduled
description: This Analytics rule provides notifications when a VMware CWS policy has been modified. These alerts serve audit purposes. Policy changes might lower the level of security controls.
severity: Informational
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
requiredDataConnectors:
  - connectorId: VMwareSDWAN
    dataTypes:
      - CWS
query: |+
  VMware_VECO_EventLogs_CL
  | where event == "CWS_EVENT"
  | extend cwsPolicyAction = todynamic(detail).subEvent
  | where cwsPolicyAction contains "SECURITY_RULE"
  | extend cwsRuleName = todynamic(detail).name
  | extend cwsRuleType = todynamic(detail).data.ruleType
  | extend cwsPolicyName = todynamic(detail).policyName
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDescriptionFormat: |+
    CWS Policy Change Detected:

    CWS Policy Name: {{cwsPolicyName}}
     - Rule changed: {{cwsRuleName}}
        - Audited Action: {{cwsPolicyAction}}

  alertDynamicProperties:
  - alertProperty: ProductComponentName
    value: cwsRuleType
suppressionDuration: 5h

Stages and Predicates

Stage 1: `source`

VMware_VECO_EventLogs_CL

Stage 2: `where`

| where event == "CWS_EVENT"

Stage 3: `extend`

| extend cwsPolicyAction = todynamic(detail).subEvent

Stage 4: `where`

| where cwsPolicyAction contains "SECURITY_RULE"

Stage 5: `extend` (3 consecutive steps)

| extend cwsRuleName = todynamic(detail).name
| extend cwsRuleType = todynamic(detail).data.ruleType
| extend cwsPolicyName = todynamic(detail).policyName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`cwsPolicyAction`	contains	`SECURITY_RULE`	`field:"cwsPolicyAction" kind:contains value:"SECURITY_RULE"`
`event`	eq	`CWS_EVENT`	`field:"event" kind:eq value:"CWS_EVENT"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`cwsPolicyAction`	`extend`
`cwsRuleName`	`extend`
`cwsRuleType`	`extend`
`cwsPolicyName`	`extend`

VMware Cloud Web Security - Policy Change Detected

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: where