VMware SD-WAN Edge - All Cloud Security Service Tunnels DOWN

Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

This analytics rule collects events where an SD-WAN Edge reports that all Cloud Security Service (CSS) tunnels are down. Losing connectivity to a Secure Service Edge (SSE) service can impact security capabilities.

Rule body

id: 8d05cc90-d337-41f5-b5fa-614cbfe1a879
name: VMware SD-WAN Edge - All Cloud Security Service Tunnels DOWN
version: 1.0.0
kind: Scheduled
description: This analytics rule collects events where an SD-WAN Edge reports that all Cloud Security Service (CSS) tunnels are down. Losing connectivity to a Secure Service Edge (SSE) service can impact security capabilities.
severity: Medium
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
requiredDataConnectors:
  - connectorId: VMwareSDWAN
    dataTypes:
      - SDWAN
query: |
  VMware_VECO_EventLogs_CL
  | where event contains "ALL_CSS_DOWN"
  | extend Edge_Serial_Number = extract("edgeSerialNumber:(.*)$", 1, detail)
  | project TimeGenerated, Edge_Serial_Number, message, severity
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: 5h
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDescriptionFormat: '{{message}}  '
  alertDynamicProperties: []
customDetails:
  Edge_Serial_Number: Edge_Serial_Number
suppressionDuration: 5h

Stages and Predicates

Stage 1: `source`

VMware_VECO_EventLogs_CL

Stage 2: `where`

| where event contains "ALL_CSS_DOWN"

Stage 3: `extend`

| extend Edge_Serial_Number = extract("edgeSerialNumber:(.*)$", 1, detail)

Stage 4: `project`

| project TimeGenerated, Edge_Serial_Number, message, severity

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`event`	contains	`ALL_CSS_DOWN`	`field:"event" kind:contains value:"ALL_CSS_DOWN"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Edge_Serial_Number`	`project`
`TimeGenerated`	`project`
`message`	`project`
`severity`	`project`

VMware SD-WAN Edge - All Cloud Security Service Tunnels DOWN

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where