↳ GitHub sourceAnalytics ruleInformational

VMware Cloud Web Security - Policy Publish Event

Description

This alert is capturing events when VMware CWS policies were published. During publish, the VMware Edge Cloud Orchestrator deploys the CWS policies in SASE POPs, making them effective. All new rules will be enforced. Depending on the contents of the policy, this might create an impact on the CWS Data Plane traffic.

Rule type: Scheduled
Version: 1.0.0
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

VMwareSDWAN

Data types

CWS

KQL query

Original query, unchanged.

VMware_VECO_EventLogs_CL
| where event == "CWS_EVENT"
| extend cwsPolicyAction = todynamic(detail).subEvent
| where cwsPolicyAction == "CWS_POLICY_PUBLISHED"
| extend cwsPolicyName = todynamic(detail).policyName

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sase-cws-policy-publish.yaml ↗
Commit: 629d1d3 ↗
Source identifier: b26a7d97-6b6e-43ab-870e-eb18460ae602

Additional source files 2

Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sase-cws-policy-publish.yamlsource ↗Solutions/VMware SD-WAN and SASE/Data/Solution_VMwareSASE_SDWAN.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.