Microsoft Sentinel high experimental kql

VMware SD-WAN Edge - IDS/IPS Alert triggered (Search API)

The VMware SD-WAN Edge appliance captured a potentially malicious traffic flow. Please investigate the IOC information available. This analytics rule analyses Search API streams. Search API queries report only IDS/IPS Alerts. In case you would also need Network Flood Protection, please enable Syslog collection using AMA.

View Source

Detection Logic

VMware_SDWAN_FirewallLogs_CL
| project TimeGenerated, signature, severity, category, signatureId, actionTaken, edgeName, sourceIp, protocol, sourcePort, destinationIp, destinationPort, domainName, attackSource, attackTarget, firewallPolicyName

Field Validations

Loading…

Comments (0)

Loading comments...