↳ GitHub sourceAnalytics ruleMedium

VMware Cloud Web Security - Data Loss Prevention Violation

Description

This Analytics rule receives VMware CWS DLP alerts and combines them with their respective Web Log events. Each Data Loss Prevention event is an alert of policy violations and should be investigated.

Rule type: Scheduled
Version: 1.0.0
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

VMwareSDWAN

Data types

CWS

KQL query

Original query, unchanged.

VMware_CWS_DLPLogs_CL
| join kind=innerunique VMware_CWS_Weblogs_CL on TimeGenerated

Declared entities

AccountIPCloudApplicationURL

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sase-cwsdlp-violation.yaml ↗
Commit: 629d1d3 ↗
Source identifier: d811ef72-66b9-43a3-ba29-cd9e4bf75b74

Additional source files 2

Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sase-cwsdlp-violation.yamlsource ↗Solutions/VMware SD-WAN and SASE/Data/Solution_VMwareSASE_SDWAN.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.