Detect Cisco Catalyst SD-WAN Manager Privileged API Abuse (CVE-2026-20122) in Microsoft Sentinel

let SdwanManagerHosts = dynamic(["sdwan-manager", "vmanage"]);
let PrivilegedApiPaths = dynamic(["/dataservice/admin", "/dataservice/system", "/dataservice/device/action", "/dataservice/template", "/dataservice/settings/configuration", "/dataservice/certificate", "/dataservice/aaa"]);
let SuspiciousStatusCodes = dynamic([200, 201, 204]);
let LookbackWindow = 1h;
union
(
    CommonSecurityLog
    | where TimeGenerated >= ago(LookbackWindow)
    | where DeviceVendor =~ "Cisco" and DeviceProduct has_any ("SD-WAN", "vManage", "Catalyst SD-WAN")
    | where RequestURL has_any (PrivilegedApiPaths)
    | where RequestMethod in ("POST", "PUT", "DELETE", "PATCH")
    | where toint(EventOutcome) in (SuspiciousStatusCodes)
    | extend SourceIP = SourceIP, RequestedAPI = RequestURL, HttpMethod = RequestMethod
    | project TimeGenerated, SourceIP, DestinationIP, RequestedAPI, HttpMethod, EventOutcome, Message, DeviceAction
),
(
    AzureDiagnostics
    | where TimeGenerated >= ago(LookbackWindow)
    | where Category =~ "ApplicationGatewayAccessLog" or ResourceType =~ "APPLICATIONGATEWAYS"
    | where requestUri_s has_any (PrivilegedApiPaths)
    | where httpMethod_s in ("POST", "PUT", "DELETE", "PATCH")
    | where httpStatus_d in (200, 201, 204)
    | extend SourceIP = clientIP_s, RequestedAPI = requestUri_s, HttpMethod = httpMethod_s
    | project TimeGenerated, SourceIP, RequestedAPI, HttpMethod, httpStatus_d, host_s
)
| summarize
    RequestCount = count(),
    UniqueAPIs = dcount(RequestedAPI),
    APIsAccessed = make_set(RequestedAPI, 20),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
  by SourceIP, HttpMethod
| where RequestCount >= 3 or UniqueAPIs >= 2
| extend RiskScore = case(
    UniqueAPIs >= 4, "Critical",
    UniqueAPIs >= 2, "High",
    RequestCount >= 10, "High",
    "Medium"
  )
| sort by UniqueAPIs desc, RequestCount desc