UAT-8616 vmanage-admin credential manipulation and SD-WAN config exfiltration

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule monitors Cisco SD-WAN logs (vManage, auth, and syslog) for suspicious administrative activity including credential manipulation, unauthorized password changes, successful vManage-admin SSH logins, and potential configuration exfiltration via vManage API calls.