VeloCloud SD-WAN Integration via API

Purpose

This guide explains how to generate an API Token in the VMware/Arista VeloCloud SD-WAN Orchestrator console and how to use it in Logsign USO to ingest VeloCloud SD-WAN Enterprise Alerts and Enterprise Events for security analytics and forensic purposes.

VeloCloud SD-WAN is an Orchestrator-managed SD-WAN platform (VMware SD-WAN, now part of Arista's SASE/SD-WAN portfolio following the 2024 VMware-to-Arista transition of this business). The Orchestrator exposes a REST API ("APIv2", base path /api/sdwan/v2) for pulling per-customer alerts and events. This API poller is the supported way to bring that data into Logsign USO; there is no separate syslog forwarding path documented for this specific Orchestrator alerts/events data set, so the API integration is the primary collection method covered here.

Prerequisites

You need an Orchestrator user account with access to API Token management for the enterprise (customer) you want to monitor. In a self-managed (non-MSP) deployment this is typically an Enterprise Superuser account in the Enterprise Portal, which is required to create and manage API tokens for Admin users. If your VeloCloud deployment is managed by a partner/MSP on an Operator-tier Orchestrator, your partner's Operator Super User can create a token on your behalf from the Operator Portal instead.

You also need to know your Orchestrator's hostname (the address you use to log in) and the internal identifier VeloCloud calls the Enterprise LogicalId for your organization, a GUID, not the plain numeric Customer ID shown in the browser URL. Step 2 below explains how to obtain it.

Step 1: Create an API Token in the Orchestrator Console

In the Enterprise Portal (self-service):

1. Sign in to your VeloCloud Orchestrator at your organization's Orchestrator address.
2. From the Enterprise Applications drop-down, open Global Settings.
3. Go to User Management > Users and select your user (an Enterprise Superuser is required to manage tokens).
4. Open the API Tokens section and click New Token.
5. Enter a Name and Description (for example, "Logsign USO integration") and choose a Lifetime.
6. Click Create. The token is created with status Pending.
7. Download the token. Once downloaded, its status changes to Enabled and it becomes usable. A token can be downloaded only once; if you lose it, revoke it and create a new one.

If your Orchestrator is managed by a partner/MSP on their Operator Portal instead, the equivalent path is: Operator Users > select the user > Actions > Modify Operator > API Tokens section > Actions > New API Token > fill in Name, Description, Lifetime > Create > Actions > Download API Token.

Step 2: Find Your Enterprise LogicalId

VeloCloud's REST API (APIv2) identifies your organization by an Enterprise LogicalId, a GUID, not by the plain numeric Customer ID that appears in the Orchestrator's browser URL. APIv2 does not support resolving the LogicalId directly from that numeric ID, so it must be looked up once via the older Portal API (APIv1):

1. While browsing your Customer/Monitoring pages in the Orchestrator, note the numeric Customer ID at the end of the URL path (the segment following /customer/).
2. Call the Portal API's getEnterprise method (POST /portal/rest/enterprise/getEnterprise) with that numeric ID. The response includes your Enterprise's logicalId; this is the value Logsign needs.

If you don't have a convenient way to make this API call yourself, your VeloCloud partner/MSP or VeloCloud support can typically provide the Enterprise LogicalId for your tenant directly.

Step 3: Configure the Integration in Logsign USO

After obtaining the Orchestrator host, the API Token, and the Enterprise LogicalId, log in to Logsign USO and add a new VeloCloud SD-WAN data source. You will be asked for:

Logsign sends the token as a Bearer token (Authorization: Bearer <token>) on each request and periodically queries two Orchestrator REST endpoints for your enterprise: /api/sdwan/v2/enterprises/<LogicalId>/alerts and /api/sdwan/v2/enterprises/<LogicalId>/events, normalizing each returned record into a Logsign event.

Notes and Limits

• The Orchestrator's own API guidance recommends calling the Alerts/Events endpoints no more than once per minute; Logsign's polling interval for this source should be configured with that in mind.
• If the Orchestrator returns HTTP 429 (Rate Limit Exceeded) or 401 (Unauthorized), check first whether the API Token has expired, been revoked, or had its Lifetime run out in the Orchestrator console, and reissue a token if needed.
• This integration covers Enterprise Alerts (stateful alarms such as EDGE_DOWN) and Enterprise Events (audit-style records generated by Edges, Gateways, or the Orchestrator itself). It does not cover Edge configuration, business policy, link/flow statistics, or any other Orchestrator API surface; those would require a separate connector.
• Make sure the Enterprise LogicalId you enter is the GUID from Step 2, not the plain numeric Customer ID from the browser URL; the two are different identifiers and the numeric ID will not work in this field.
• Field-level normalization (mapping raw Orchestrator field names to Logsign's canonical event schema) for this source is not yet finalized; contact Logsign support if you need specific fields mapped for search/correlation use cases.