Cisco SD-WAN Tenant List Upload Script Abuse
This rule detects scripts abusing the tenant list upload feature on Cisco SD-WAN managers. Such misuse can expose customer networks or implant changes at scale. It is crucial to review who ran the script and what file was uploaded. If this alert fires, investigate the user's recent activities, specifically if they installed new software or clicked any suspicious links. Involve your security team if the situation remains unclear.
Microsoft Sentinel (KQL)
