Unexpected Cisco vManage Peering Event
Detects Cisco SD-WAN control connection state changes indicating a new 'vmanage' peer connection from an unauthorized IP address. This rule is designed to identify potential exploitation of vulnerabilities like CVE-2026-20182, where attackers establish unauthorized infrastructure ties by creating new vManage peer connections. The rule filters for syslog messages from the Viptela-vSmart-VDAEMON indicating a 'control-connection-state-change' with 'new-state:up' and 'peer-type:vmanage', and then excludes connections from a list of authorized vManage IP ranges.
Microsoft Sentinel (KQL)
