↳ GitHub sourceAnalytics ruleHigh

Cisco SDWAN - Intrusion Events

Description

'This Analytic rule will monitor Intrusion events in Cisco syslog data based on the provided Signature ID. This will create an incident if that Signature ID is found in the specified time range.'

Rule type: Scheduled
Version: 1.0.1
Declared status: Available
Query frequency: 3h
Query period: 3h
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CiscoSDWAN

Data types

CiscoSyslogUTD

KQL query

Original query, unchanged.

CiscoSyslogUTD
| where SignatureId == "Enter SignatureId"
| distinct SignatureId,SourceIP

Declared entities

RegistryKey

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelIntrusionEvents.yaml ↗
Commit: 9800e51 ↗
Source identifier: 232a1c75-63fc-4c81-8b18-b4a739fccba8

Additional source files 2

Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelIntrusionEvents.yamlsource ↗Solutions/Cisco SD-WAN/Data/Solution_CiscoSD-WAN.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.