UAT-8616 SD-WAN Policy Manipulation and Malicious Device Insertion via vManage
This rule detects administrative changes to Cisco SD-WAN environments, including policy pushes, template attachments, device onboarding, and tunnel modifications. It uses a risk-scoring mechanism based on the type of change and whether the activity occurs outside of standard business hours (06:00 to 22:00). High-risk events (score >= 65) trigger an alert, highlighting potential unauthorized infrastructure modifications or malicious device insertion.
Splunk (SPL)
