Detect Cisco Catalyst SD-WAN Manager Sensitive Information Exposure (CVE-2026-20133) in Microsoft Sentinel

let sdwan_mgr_ips = dynamic([]);
let suspicious_paths = dynamic(["/dataservice/", "/auditlog", "/device/config", "/template/", "/setting/configuration", "/admin/user"]);
let timeframe = 24h;
union
(
    DeviceNetworkEvents
    | where TimeGenerated >= ago(timeframe)
    | where RemotePort in (8443, 443, 8080)
    | where RemoteUrl has_any (suspicious_paths)
    | project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, ActionType
    | extend DataSource = "DeviceNetworkEvents"
),
(
    CommonSecurityLog
    | where TimeGenerated >= ago(timeframe)
    | where DeviceVendor == "Cisco" and DeviceProduct has_any ("SD-WAN", "vManage")
    | where RequestURL has_any (suspicious_paths)
    | where DestinationPort in (8443, 443, 8080)
    | project TimeGenerated, DeviceName, SourceIP, RequestURL, DestinationPort, Activity, AdditionalExtensions
    | extend DataSource = "CommonSecurityLog"
),
(
    AzureDiagnostics
    | where TimeGenerated >= ago(timeframe)
    | where Category == "ApplicationGatewayAccessLog"
    | where requestUri_s has_any (suspicious_paths)
    | where httpStatus_i in (200, 201, 206)
    | project TimeGenerated, clientIP_s, requestUri_s, httpStatus_i, host_s
    | extend DataSource = "AzureDiagnostics"
)
| summarize RequestCount = count(), UniqueURLs = dcount(coalesce(RemoteUrl, RequestURL, requestUri_s)) by bin(TimeGenerated, 5m), DataSource
| where RequestCount > 5