Sunturai
Back to results
MediumSplunk security contentNasreddine Bencherchali +1Threat hunting

Cisco SD-WAN - Peering Activity

This analytic detects Cisco SD-WAN `control-connection-state-change` events where a control connection transitions. It extracts and highlights key triage fields including `peer-type`, `peer-system-ip`, `public-ip`,…

Description

This analytic detects Cisco SD-WAN `control-connection-state-change` events where a control connection transitions. It extracts and highlights key triage fields including `peer-type`, `peer-system-ip`, `public-ip`, and `public-port`. Analysts should manually validate whether the `peer-system-ip` matches the expected SD-WAN addressing schema and device inventory, whether the event timing aligns with known operational activity (maintenance, failover, or planned changes), and whether the `public-ip` is an expected source for control peering in the environment. Treat `peer-type:vmanage` events with higher scrutiny, especially when peer or source IP values are previously unseen.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
cisco_sd_wan_ntce_1000001

Known benign triggers

  • New controller onboarding, topology expansion, controller failover, maintenance windows, and temporary transport. Path changes can create rare peer/public-IP combinations. Validate outliers against change records and known SD-WAN inventory before escalating.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice