Analytics Story: Cisco Catalyst SD-WAN Analytics

Date: 2026-03-02 ID: 7ec01b6e-95fa-4a89-86b7-ada08cf237de Author: Nasreddine Bencherchali, Splunk Product: Splunk Enterprise Security

Description

This analytic story provides a suite of detections designed to analyze logs collected from Cisco Catalyst SD-WAN devices. The included analytics focus on identifying anomalous control connections, unexpected peer relationships, rare peer-type and system-IP combinations, suspicious public IP associations, and other deviations from established SD-WAN topology behavior. These detections help security teams surface unauthorized devices, misconfigurations, infrastructure drift, and potential exploitation attempts targeting SD-WAN components.

Why it matters

Cisco Catalyst SD-WAN provides centralized orchestration and policy-driven connectivity through control-plane communications between vManage, vSmart, and edge devices. The platform generates logs related to control-connection state changes, peer identity, public IP associations, and system roles, etc. This analytic story leverages that telemetry to detect behavioral anomalies within SD-WAN control relationships, highlighting rare or unexpected peer interactions that may indicate configuration errors, unauthorized infrastructure, or adversary activity.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity	Exploit Public-Facing Application	TTP
Cisco SD-WAN - Low Frequency Rogue Peer	Exploit Public-Facing Application	Anomaly
Cisco SD-WAN - Peering Activity	Exploit Public-Facing Application	Hunting
Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity	Active Scanning	Hunting

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Cisco SD-WAN NTCE 1000001	Other	`cisco:sdwan:syslog`	`/var/log/vsyslog`
Cisco SD-WAN Service Proxy Access Logs	Other	`cisco:sdwan:access`	`/var/log/nms/containers/service-proxy/serviceproxy-access.log`

References

Source: GitHub | Version: 1