detection.wiki

Detection rules › Kusto

VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected

Severity
informational
Time window
1h
Source
github.com/Azure/Azure-Sentinel

This analytics rule creates notifications of newly connected devices. These clients are connected to the LAN interface of the Edge.

Rule body

id: 69c0644f-4ad5-41b6-9e09-a94c072ab80e
name: VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected
version: 1.0.0
kind: Scheduled
description: This analytics rule creates notifications of newly connected devices. These clients are connected to the LAN interface of the Edge.
severity: Informational
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
requiredDataConnectors:
  - connectorId: VMwareSDWAN
    dataTypes:
      - SDWAN
query: |+
  VMware_VECO_EventLogs_CL
  | extend details = todynamic(detail)
  | evaluate bag_unpack(details)
  | where event == "EDGE_NEW_DEVICE"
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDynamicProperties: []
customDetails:
  Client_MAC_Address: client_mac
  DHCP_Parameter_List: dhcp_param_list
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: hostname
  - identifier: OSFamily
    columnName: os_description
  - identifier: OSVersion
    columnName: os_version
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: client_ipv4addr
suppressionDuration: 5h

Stages and Predicates

Stage 1: source

VMware_VECO_EventLogs_CL

Stage 2: extend

| extend details = todynamic(detail)

Stage 3: evaluate

| evaluate bag_unpack(details)

Stage 4: where

| where event == "EDGE_NEW_DEVICE"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
eventeq
  • EDGE_NEW_DEVICE
field:"event" kind:eq value:"EDGE_NEW_DEVICE"

Output fields

These fields are emitted when the rule matches.

FieldSource
detailsextend