|
| 1 | +--- |
| 2 | +id: vmware-workspace-one |
| 3 | +title: VMware Workspace ONE |
| 4 | +sidebar_label: VMware Workspace ONE |
| 5 | +description: The VMware Workspace ONE app for Sumo Logic helps security analysts monitor device compliance, encryption, and security status, offering a powerful solution for analysing spot risks, enforce policies, and keep devices secure. |
| 6 | +--- |
| 7 | + |
| 8 | +import useBaseUrl from '@docusaurus/useBaseUrl'; |
| 9 | + |
| 10 | +<img src={useBaseUrl('img/send-data/vmware_workspace_one.png')} alt="vmware-workspace-one-logo" width="50" /> |
| 11 | + |
| 12 | +The Sumo Logic App for VMware Workspace ONE helps security analysts monitor device compliance, encryption, and security status. It offers dashboards that show non-compliant or compromised device, and data encryption gaps. Geolocation panels track device locations and flag roaming in restricted areas. Out-of-the-box alerts notify analysts about security issues like compromised devices, non-compliance, and unauthorized roaming. These features help analysts spot address risks, enforce security policies, and maintain a secure enterprise device ecosystem. |
| 13 | + |
| 14 | +:::info |
| 15 | +This app includes [built-in monitors](#vmware-workspace-one-monitors). For details on creating custom monitors, refer to the [Create monitors for VMware Workspace ONE app](#create-monitors-for-the-vmware-workspace-one-app). |
| 16 | +::: |
| 17 | + |
| 18 | +## Log types |
| 19 | + |
| 20 | +This app uses Sumo Logic’s VMware Workspace ONE Source to collect [audit logs](https://help.sumologic.com/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/vmware-workspace-one-source/) from the VMware Workspace ONE platform. |
| 21 | + |
| 22 | +## Sample log message |
| 23 | + |
| 24 | +<details> |
| 25 | +<summary>Audit Log</summary> |
| 26 | + |
| 27 | +```json |
| 28 | +{ |
| 29 | + "AcLineStatus": 1, |
| 30 | + "AssetNumber": "827BE1C5AEC05C378C61C44103E9D3FCB2EC354D", |
| 31 | + "AvailableDeviceCapacity": 1, |
| 32 | + "AvailablePhysicalMemory": 4, |
| 33 | + "BatteryLevel": "abcd", |
| 34 | + "ComplianceStatus": "NonCompliant", |
| 35 | + "ComplianceSummary": { |
| 36 | + "DeviceCompliance": [ |
| 37 | + { |
| 38 | + "ActionTaken": [ |
| 39 | + { |
| 40 | + "ActionType": 0 |
| 41 | + } |
| 42 | + ], |
| 43 | + "CompliantStatus": true, |
| 44 | + "Id": { |
| 45 | + "Value": 1 |
| 46 | + }, |
| 47 | + "LastComplianceCheck": "2025-01-15T03:15:26.8528889+01:00", |
| 48 | + "NextComplianceCheck": "2025-01-15T03:01:26.8528889+01:00", |
| 49 | + "PolicyDetail": "compliance policy for device compromised status including application list contains rule", |
| 50 | + "PolicyName": "application list compliance policy", |
| 51 | + "Uuid": "2851e9e5-2084-433c-a741-dae0856295ff" |
| 52 | + } |
| 53 | + ] |
| 54 | + }, |
| 55 | + "CompromisedStatus": true, |
| 56 | + "DataEncryptionYN": "N", |
| 57 | + "DataProtectionStatus": 5, |
| 58 | + "DepTokenSource": 0, |
| 59 | + "DeviceCapacity": 1, |
| 60 | + "DeviceCellularNetworkInfo": [ |
| 61 | + { |
| 62 | + "CardId": "Text value", |
| 63 | + "CarrierName": "Text value", |
| 64 | + "DeviceMCC": { |
| 65 | + |
| 66 | + }, |
| 67 | + "IsRoaming": true, |
| 68 | + "PhoneNumber": "Text value" |
| 69 | + } |
| 70 | + ], |
| 71 | + "DeviceFriendlyName": "users iPhone iOS 10.3.2 ", |
| 72 | + "DeviceMCC": { |
| 73 | + "CurrentMCC": "Text value", |
| 74 | + "SIMMCC": "Text value" |
| 75 | + }, |
| 76 | + "DeviceManufacturerId": 1, |
| 77 | + "DeviceNetworkInfo": [ |
| 78 | + { |
| 79 | + "ConnectionType": "Text value", |
| 80 | + "IPAddress": "221.192.199.49", |
| 81 | + "MACAddress": "Text value", |
| 82 | + "Name": "Text value", |
| 83 | + "Vendor": "Text value" |
| 84 | + } |
| 85 | + ], |
| 86 | + "DeviceReportedName": "5CD6473R77 - Demo HP Chromebook", |
| 87 | + "EasId": "6Q93UFOQ7H0K39JPMFPTEMJQ3K", |
| 88 | + "EnrolledViaDEP": true, |
| 89 | + "EnrollmentStatus": "Enrolled", |
| 90 | + "EnrollmentUserUuid": "00000000-0000-0000-0000-000000000000", |
| 91 | + "HostName": "zs-MacBook-Air", |
| 92 | + "Id": { |
| 93 | + "Value": 0 |
| 94 | + }, |
| 95 | + "Imei": "356766060039613", |
| 96 | + "IsActivationLockEnabled": true, |
| 97 | + "IsCloudBackupEnabled": true, |
| 98 | + "IsDeviceDNDEnabled": true, |
| 99 | + "IsDeviceLocatorEnabled": true, |
| 100 | + "IsNetworkTethered": true, |
| 101 | + "IsRemoteManagementEnabled": "abcd", |
| 102 | + "IsRoaming": true, |
| 103 | + "IsSecurityPatchUpdate": true, |
| 104 | + "IsSupervised": true, |
| 105 | + "LastBluetoothSampleTime": "2022-06-03T03:01:26.8528889+01:00", |
| 106 | + "LastComplianceCheckOn": "2022-06-03T03:01:26.8528889+01:00", |
| 107 | + "LastCompromisedCheckOn": "2022-06-03T03:01:26.8528889+01:00", |
| 108 | + "LastEnrolledOn": "2022-06-03T03:01:26.8528889+01:00", |
| 109 | + "LastNetworkLANSampleTime": "2022-06-03T03:01:26.8528889+01:00", |
| 110 | + "LastSeen": "2022-06-03T03:01:26.8528889+01:00", |
| 111 | + "LastSystemSampleTime": "2022-06-03T03:01:26.8528889+01:00", |
| 112 | + "LocalHostName": "zs-MacBook-Air.mshome.net", |
| 113 | + "LocationGroupId": { |
| 114 | + "Name": "Text value", |
| 115 | + "Uuid": "6d82a40e-dcc1-46de-9fc2-33c9ad2f8797" |
| 116 | + }, |
| 117 | + "LocationGroupName": "locationgroup1", |
| 118 | + "MacAddress": "485A3F880798", |
| 119 | + "ManagedBy": 0, |
| 120 | + "Model": "iPhone", |
| 121 | + "ModelId": { |
| 122 | + |
| 123 | + }, |
| 124 | + "OEMInfo": "Samsung", |
| 125 | + "OSBuildVersion": "17G65", |
| 126 | + "OperatingSystem": "10.3.2", |
| 127 | + "Ownership": "C", |
| 128 | + "PhoneNumber": "+14045550100", |
| 129 | + "Platform": "Apple", |
| 130 | + "PlatformId": { |
| 131 | + |
| 132 | + }, |
| 133 | + "ProcessorArchitecture": 5, |
| 134 | + "SecurityPatchDate": "2022-06-03T03:01:26.8629122+01:00", |
| 135 | + "SerialNumber": "R51G844T90R", |
| 136 | + "SystemIntegrityProtectionEnabled": true, |
| 137 | + "SystemUpdateReceivedTime": "2022-06-03T03:01:26.8629122+01:00", |
| 138 | + "TotalPhysicalMemory": 3, |
| 139 | + "Udid": "827BE1C5AEC05C378C61C44103E9D3FCB2EC354D", |
| 140 | + "UserApprovedEnrollment": true, |
| 141 | + "UserEmailAddress": "[email protected]", |
| 142 | + "UserId": { |
| 143 | + |
| 144 | + }, |
| 145 | + "UserName": "user1", |
| 146 | + "Uuid": "8a2ca18c-8b1c-4783-bc18-2ccb61110e4f", |
| 147 | + "VirtualMemory": 2, |
| 148 | + "WifiSsid": "guest" |
| 149 | +} |
| 150 | +``` |
| 151 | +</details> |
| 152 | + |
| 153 | +## Sample queries |
| 154 | + |
| 155 | +```sql title="Total Devices" |
| 156 | +_sourcecategory = "VMWare" |
| 157 | +| json "Ownership", "UserEmailAddress", "IsDeviceDNDEnabled", "LocationGroupName", "Imei", "SystemIntegrityProtectionEnabled", "DeviceFriendlyName", "ProcessorArchitecture", "IsRoaming", "ComplianceStatus", "UserName", "LastComplianceCheckOn", "IsDeviceLocatorEnabled", "HostName", "IsCloudBackupEnabled", "LastEnrolledOn", "DeviceReportedName", "SerialNumber", "IsActivationLockEnabled", "CompromisedStatus", "OperatingSystem", "Model", "DataProtectionStatus", "SecurityPatchDate", "LocalHostName", "IsSupervised", "Platform", "LocationGroupId.Name", "OSBuildVersion", "TotalPhysicalMemory", "OEMInfo", "LastCompromisedCheckOn", "UserId.Uuid", "UserId.Name", "EnrollmentStatus", "DataEncryptionYN" as ownership,user_email, is_dnd_enabled, location_group_name, imei, is_system_protection_enabled, device_name, architecture, is_roaming, compliance_status, user_name, last_compliance_checked_on, is_device_location_enabled, hostname, is_cloud_backup_enabled, last_enrolled_on, device_reported_name, serial_number, is_activation_lock_enabled, compromised_status, os, model, data_protection_status, security_patch_date, local_hostname, is_supervised, platform, location_groupid_name, os_build_version, total_physical_mem, oem_info, last_compromised_checked_on, uuid, user_name1, entrollment_status, data_encryption nodrop |
| 158 | +| json "DeviceNetworkInfo[0].IPAddress" as ip nodrop |
| 159 | +``` |
| 160 | + |
| 161 | +## Set up collection |
| 162 | + |
| 163 | +To set up the [VMware Workspace ONE Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/vmware-workspace-one-source) for the VMware Workspace ONE app, follow the instructions provided. These instructions will guide you through the process of creating a source using the VMware Workspace ONE Source category, which you will need to use when installing the app. By following these steps, you can ensure that your VMware Workspace ONE app is properly integrated and configured to collect and analyze your Alerts data. |
| 164 | + |
| 165 | +## Installing the VMware Workspace ONE app |
| 166 | + |
| 167 | +import AppInstall2 from '../../reuse/apps/app-install-v2.md'; |
| 168 | + |
| 169 | +<AppInstall2/> |
| 170 | + |
| 171 | +## Viewing the VMware Workspace ONE dashboards |
| 172 | + |
| 173 | +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; |
| 174 | + |
| 175 | +<ViewDashboards/> |
| 176 | + |
| 177 | +### Overview |
| 178 | + |
| 179 | +The **VMware Workspace ONE - Overview** dashboard provides detils on compromised statuses, gaps in data encryption, device compliance, and geographical distribution of devices. This dashboards provides insights into non-compliant devices and users, compromised devices and users, and non data encrypted devices and users. Geolocation panels provide visibility into device locations and highlight roaming in embargoed regions.<br/><img src='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/VMWare+Workspace+ONE/VMWare+Workspace+ONE+-+Overview.png' alt="VMware-Workspace-ONE-Overview" /> |
| 180 | + |
| 181 | +## Create monitors for the VMware Workspace ONE app |
| 182 | + |
| 183 | +import CreateMonitors from '../../reuse/apps/create-monitors.md'; |
| 184 | + |
| 185 | +<CreateMonitors/> |
| 186 | + |
| 187 | +### VMware Workspace ONE monitors |
| 188 | + |
| 189 | +The VMware Workspace ONE monitors serve as a security tool, concentrating on observing essential operations and unusual occurrences within the VMware Workspace ONE Platform. These notifications offer instantaneous insight into significant events, allowing security personnel to swiftly react to deviations or breaches. |
| 190 | + |
| 191 | +| Name | Description | Trigger Type (Critical / Warning / MissingData) | Alert Condition | |
| 192 | +|:--|:--|:--|:--| |
| 193 | +| `Compromised Devices` | This monitor identifies devices marked as compromised in Workspace ONE. It monitors the `compromised_status` field to trigger when devices are flagged as compromised, enabling analysts to take immediate action to secure affected devices. | Critical | Count > 0 | |
| 194 | +| `Non-Compliance Devices` | This monitor detects devices that fail to meet compliance standards based on the `compliance_status` field. It helps ensure devices adhere to organizational policies and regulatory requirements. | Critical | Count > 0| |
| 195 | +| `Roaming Devices from Embargoed Countries` | This monitor tracks devices roaming in restricted or embargoed regions. It assists in mitigating risks associated with unauthorized device movement in high-risk areas. | Critical | Count > 0| |
| 196 | + |
| 197 | +## Upgrading/Downgrading the VMware Workspace ONE app (Optional) |
| 198 | + |
| 199 | +import AppUpdate from '../../reuse/apps/app-update.md'; |
| 200 | + |
| 201 | +<AppUpdate/> |
| 202 | + |
| 203 | +## Uninstalling the VMware Workspace ONE app (Optional) |
| 204 | + |
| 205 | +import AppUninstall from '../../reuse/apps/app-uninstall.md'; |
| 206 | + |
| 207 | +<AppUninstall/> |
0 commit comments