Cisco SD-WAN Stolen Certificate Rogue Peering — UAT-8616
Detects potential unauthorized or rogue peer connections within a Cisco SD-WAN infrastructure. The rule monitors certificate-based authentication events for indicators of rogue peers (e.g., certificate mismatches, invalid common names) or connections originating from known malicious IP addresses associated with rogue SD-WAN activity.
Splunk (SPL)
