detection.wiki

Detection rules › Kusto

VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected

Severity
informational
Time window
1h
Source
github.com/Azure/Azure-Sentinel

This analytics rule creates notifications of newly connected devices. These clients are connected to the LAN interface of the Edge.

Rule body kusto

id: 69c0644f-4ad5-41b6-9e09-a94c072ab80e
name: VMware Edge Cloud Orchestrator - New LAN-Side Client Device Detected
version: 1.0.0
kind: Scheduled
description: This analytics rule creates notifications of newly connected devices. These clients are connected to the LAN interface of the Edge.
severity: Informational
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
requiredDataConnectors:
  - connectorId: VMwareSDWAN
    dataTypes:
      - SDWAN
query: |+
  VMware_VECO_EventLogs_CL
  | extend details = todynamic(detail)
  | evaluate bag_unpack(details)
  | where event == "EDGE_NEW_DEVICE"
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDynamicProperties: []
customDetails:
  Client_MAC_Address: client_mac
  DHCP_Parameter_List: dhcp_param_list
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: hostname
  - identifier: OSFamily
    columnName: os_description
  - identifier: OSVersion
    columnName: os_version
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: client_ipv4addr
suppressionDuration: 5h

Stages and Predicates

Stage 1: source

VMware_VECO_EventLogs_CL

Stage 2: extend

| extend details = todynamic(detail)

Stage 3: evaluate

| evaluate bag_unpack(details)

Stage 4: where

| where event == "EDGE_NEW_DEVICE"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
eventeq
  • EDGE_NEW_DEVICE transforms: cased

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
detailsextend