↳ GitHub sourceAnalytics ruleMedium

VMware SD-WAN Edge - Device Congestion Alert - Packet Drops

Description

The VMware Edge Cloud Orchestrator reported an edge congestion event, where the Edge is dropping a large number of packets on one of its interfaces. This could indicate an ongoing Denial of Service attack against an appliance. Please make sure that Network Flood Protection is turned on.

Rule type: Scheduled
Version: 1.0.0
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

Impact T1498

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

VMwareSDWAN

Data types

SDWAN

KQL query

Original query, unchanged.

VMware_VECO_EventLogs_CL
| where event == "EDGE_CONGESTED"
| where message contains "high number of packet drops"
| extend edgeSerialNumber = extract("edgeSerialNumber: (.+)$", 1, detail)

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-device-congestion.yaml ↗
Commit: 629d1d3 ↗
Source identifier: a88ead0a-f022-48d6-8f53-e5a164c4c72e

Additional source files 2

Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-device-congestion.yamlsource ↗Solutions/VMware SD-WAN and SASE/Data/Solution_VMwareSASE_SDWAN.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.