azure-monitor-delete-activity-log-alert
Delete an activity log alert rule, silencing automated detection triggered by Azure Resource Manager (ARM) control-plane events (resource creation, deletion, policy changes, role assignments). Activity log alerts are distinct from scheduled-query and metric alerts, on their own ARM resource type.
match (effective permission)
{
"action": "Microsoft.Insights/activityLogAlerts/delete",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | <principal> |
| target | <activity log alert rule (SecurityService node)> |
| permissions | Microsoft.Insights/activityLogAlerts/delete |
| conditions | iam_permission deny_assignment |
| state logic | ACTIVE when the principal holds the delete action at the effective scope with no deny assignment. Activity log alert rules are distinct ARM resources from scheduled query and metric alerts; deleting one does not affect the others. BLOCKED if deny assignment covers activityLogAlerts/delete. |
Narrative
{principal.name} can delete activity log alert rule {target.name} (Microsoft.Insights/activityLogAlerts/delete), silencing automated detection based on Azure Resource Manager control-plane events. Subsequent ARM events matching the rule's conditions (e.g., resource deletion, role assignment, policy change) go undetected until the rule is recreated. This is a detective-control evasion primitive with no accompanying resource access.
Raw rule rules/derived/azure/monitor.yaml
id: azure-monitor-delete-activity-log-alert
emits: CanDelete
description: Delete an activity log alert rule, silencing automated detection triggered by Azure Resource
Manager (ARM) control-plane events (resource creation, deletion, policy changes, role assignments).
Activity log alerts are distinct from scheduled-query and metric alerts, on their own ARM resource type.
match_effective_permission:
action: Microsoft.Insights/activityLogAlerts/delete
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: SecurityService
source: <principal>
target: <activity log alert rule (SecurityService node)>
permissions:
- Microsoft.Insights/activityLogAlerts/delete
conditions:
- iam_permission
- deny_assignment
state_logic: ACTIVE when the principal holds the delete action at the effective scope with no deny assignment.
Activity log alert rules are distinct ARM resources from scheduled query and metric alerts; deleting
one does not affect the others. BLOCKED if deny assignment covers activityLogAlerts/delete.
confidence: 0.92
derived_from:
- 'effective permission: Microsoft.Insights/activityLogAlerts/delete'
false_positive_note: DEFENSE EVASION ONLY. Deleting an activity log alert rule silences detection of
Azure control-plane events (e.g., 'alert on resource deletion' or 'alert on new role assignment').
It does not grant access to any resource. Activity log alerts and scheduled-query alerts are on separate
resource types; deleting one does not affect the other. Do NOT chain to access escalation edges. Monitoring
Contributor and Contributor/Owner roles include activityLogAlerts/delete; Monitoring Reader does NOT.
narrative: '{principal.name} can delete activity log alert rule {target.name} (Microsoft.Insights/activityLogAlerts/delete),
silencing automated detection based on Azure Resource Manager control-plane events. Subsequent ARM
events matching the rule''s conditions (e.g., resource deletion, role assignment, policy change) go
undetected until the rule is recreated. This is a detective-control evasion primitive with no accompanying
resource access.'