VMware SD-WAN Edge - Device Congestion Alert - Packet Drops

Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

The VMware Edge Cloud Orchestrator reported an edge congestion event, where the Edge is dropping a large number of packets on one of its interfaces. This could indicate an ongoing Denial of Service attack against an appliance. Please make sure that Network Flood Protection is turned on.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1498` Network Denial of Service

Rule body

id: a88ead0a-f022-48d6-8f53-e5a164c4c72e
name: VMware SD-WAN Edge - Device Congestion Alert - Packet Drops
version: 1.0.0
kind: Scheduled
description: The VMware Edge Cloud Orchestrator reported an edge congestion event, where the Edge is dropping a large number of packets on one of its interfaces. This could indicate an ongoing Denial of Service attack against an appliance. Please make sure that Network Flood Protection is turned on.
severity: Medium
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
requiredDataConnectors:
  - connectorId: VMwareSDWAN
    dataTypes:
      - SDWAN
tactics:
- Impact
relevantTechniques:
- T1498
query: |-
  VMware_VECO_EventLogs_CL
  | where event == "EDGE_CONGESTED"
  | where message contains "high number of packet drops"
  | extend edgeSerialNumber = extract("edgeSerialNumber: (.+)$", 1, detail)
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 5h
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: SingleAlert
customDetails:
  edgeSerialNumber: edgeSerialNumber
suppressionDuration: 5h

Stages and Predicates

Stage 1: `source`

VMware_VECO_EventLogs_CL

Stage 2: `where`

| where event == "EDGE_CONGESTED"

Stage 3: `where`

| where message contains "high number of packet drops"

Stage 4: `extend`

| extend edgeSerialNumber = extract("edgeSerialNumber: (.+)$", 1, detail)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`event`	eq	`EDGE_CONGESTED`	`field:"event" kind:eq value:"EDGE_CONGESTED"`
`message`	contains	`high number of packet drops`	`field:"message" kind:contains value:"high number of packet drops"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`edgeSerialNumber`	`extend`