↳ GitHub sourceAnalytics ruleMedium

VMware SD-WAN Edge - All Cloud Security Service Tunnels DOWN

Description

This analytics rule collects events where an SD-WAN Edge reports that all Cloud Security Service (CSS) tunnels are down. Losing connectivity to a Secure Service Edge (SSE) service can impact security capabilities.

Rule type: Scheduled
Version: 1.0.0
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

VMwareSDWAN

Data types

SDWAN

KQL query

Original query, unchanged.

VMware_VECO_EventLogs_CL
| where event contains "ALL_CSS_DOWN"
| extend Edge_Serial_Number = extract("edgeSerialNumber:(.*)$", 1, detail)
| project TimeGenerated, Edge_Serial_Number, message, severity

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-nsd-cssdown.yaml ↗
Commit: 629d1d3 ↗
Source identifier: 8d05cc90-d337-41f5-b5fa-614cbfe1a879

Additional source files 2

Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-nsd-cssdown.yamlsource ↗Solutions/VMware SD-WAN and SASE/Data/Solution_VMwareSASE_SDWAN.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.