↳ GitHub sourceAnalytics ruleHigh

Cisco SDWAN - Monitor Critical IPs

View on GitHub ↗Original file ↗

Description

'This analytic rule will monitor critical IPs in Syslog and Netflow Data.'

Rule type: Scheduled
Version: 1.0.1
Declared status: Available
Query frequency: 3h
Query period: 3h
Trigger: gt 0

Declared MITRE coverage

CommandAndControl T1071

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CiscoSDWAN

Data types

CiscoSyslogUTD CiscoSDWANNetflow

KQL query

Original query, unchanged.

CiscoSyslogUTD
| union (CiscoSDWANNetflow)
| where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
| extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
| where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
| summarize count() by SourceIP

Declared entities

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMonitorCriticalIP.yaml ↗
Commit: 9800e51 ↗
Source identifier: a62a207e-62be-4a74-acab-4466d5b3854f

Additional source files 2

Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMonitorCriticalIP.yamlsource ↗Solutions/Cisco SD-WAN/Data/Solution_CiscoSD-WAN.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.