VMware SD-WAN - Orchestrator Audit Event

Severity: informational
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

This rule is searching for configuration changes. Configuration changes can override security measures and the overarching security design. Therefore audit events must be accurately tracked.

Rule body

id: 50c86f92-86b0-4ae3-bb94-698da076ca9e
name: VMware SD-WAN - Orchestrator Audit Event
version: 1.0.0
kind: Scheduled
description: This rule is searching for configuration changes. Configuration changes can override security measures and the overarching security design. Therefore audit events must be accurately tracked.
severity: Informational
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
requiredDataConnectors:
  - connectorId: VMwareSDWAN
    dataTypes:
      - SDWAN
query: |
  VMware_VECO_EventLogs_CL
  | where event == "EDIT_PROFILE"
  | extend edgeProfile = extract("^profile \\[(.+)\\] [a-z]+ module", 1, message)
  | extend configAction = extract("^profile \\[.+\\] (.+) module", 1, message)
  | extend edgeModule = extract("^profile \\[.+\\] [a-z]+ module \\[(.+)\\]$", 1, message)
  | extend configChange = todynamic(detail).diff
  | project TimeGenerated, severity, edgeProfile, configAction, edgeModule, configChange
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 5h
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: SingleAlert
alertDetailsOverride:
  alertDescriptionFormat: "There was a configuration change event on the VMware Edge Cloud Orchestrator.\nThe configuration changes are the following:\n{{{configChange}} "
  alertDynamicProperties:
  - alertProperty: ProductComponentName
    value: edgeProfile
customDetails:
  edgeProfile: edgeProfile
  auditAction: configAction
  edgeModule: edgeModule
suppressionDuration: 5h

Stages and Predicates

Stage 1: `source`

VMware_VECO_EventLogs_CL

Stage 2: `where`

| where event == "EDIT_PROFILE"

Stage 3: `extend` (4 consecutive steps)

| extend edgeProfile = extract("^profile \\[(.+)\\] [a-z]+ module", 1, message)
| extend configAction = extract("^profile \\[.+\\] (.+) module", 1, message)
| extend edgeModule = extract("^profile \\[.+\\] [a-z]+ module \\[(.+)\\]$", 1, message)
| extend configChange = todynamic(detail).diff

Stage 4: `project`

| project TimeGenerated, severity, edgeProfile, configAction, edgeModule, configChange

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`event`	eq	`EDIT_PROFILE`	`field:"event" kind:eq value:"EDIT_PROFILE"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`TimeGenerated`	`project`
`configAction`	`project`
`configChange`	`project`
`edgeModule`	`project`
`edgeProfile`	`project`
`severity`	`project`

VMware SD-WAN - Orchestrator Audit Event

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where