Name:Cisco SD-WAN - Peering Activity id:1d192a47-4bd3-4c06-902d-5dbe2375ec6d version:1 date:2026-03-02 author:Nasreddine Bencherchali, Splunk status:production type:Hunting Description:This analytic detects Cisco SD-WAN `control-connection-state-change` events where a control connection transitions.
It extracts and highlights key triage fields including `peer-type`, `peer-system-ip`, `public-ip`, and `public-port`.
Analysts should manually validate whether the `peer-system-ip` matches the expected SD-WAN addressing schema and
device inventory, whether the event timing aligns with known operational activity (maintenance, failover, or
planned changes), and whether the `public-ip` is an expected source for control peering in the environment.
Treat `peer-type:vmanage` events with higher scrutiny, especially when peer or source IP values are previously
unseen.
Data_source:
-Cisco SD-WAN NTCE 1000001
search:`cisco_sd_wan_syslog` TERM("*control-connection-state-change*") TERM("*peer-system-ip:*") TERM("*public-ip:*") TERM("*new-state:up*") | rex field=_raw "^(?<event_timestamp>(?:[A-Z][a-z]{2}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}(?:\.\d{3})?|[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.\d{1,6})?(?:Z|[+-][0-9]{2}:[0-9]{2})))\s*:?" | rex field=_raw "^(?:[A-Z][a-z]{2}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}(?:\.\d{3})?\s*:?\s+)(?<prefix_host>[^\s:]+)\s+\S+(?:\[\d+\])?:\s+%" | eval dest=coalesce(prefix_host, legacy_host, device_name, host) | rex field=_raw "new-state:(?<new_state>\S+)" | rex field=_raw "peer-type:(?<peer_type>\S+)" | rex field=_raw "peer-system-ip:(?<peer_system_ip>\S+)" | rex field=_raw "public-ip:(?<public_ip>\S+)" | rex field=_raw "public-port:(?<public_port>\d+)"
| where isnotnull(peer_type) AND isnotnull(peer_system_ip)
| stats count max(event_timestamp) as event_time values(public_ip) as public_ips values(public_port) as public_ports by peer_type peer_system_ip dest new_state
