azure-monitor-delete-metric-alert
Delete a metric alert rule, silencing automated detection triggered by metric thresholds (CPU, memory, network, custom metrics). Metric alerts fire independently of log-search alerts and are on distinct ARM resource types.
match (effective permission)
{
"action": "Microsoft.Insights/metricAlerts/delete",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | <principal> |
| target | <metric alert rule (SecurityService node)> |
| permissions | Microsoft.Insights/metricAlerts/delete |
| conditions | iam_permission deny_assignment |
| state logic | ACTIVE when the principal holds the delete action at the effective scope with no deny assignment. Metric alert rules are distinct ARM resources from scheduled query rules and activity log alerts; deleting one does not affect the others. BLOCKED if deny assignment covers metricAlerts/delete. |
Narrative
{principal.name} can delete metric alert rule {target.name} (Microsoft.Insights/metricAlerts/delete), silencing automated detection based on metric thresholds (CPU, memory, network, custom metrics). Subsequent metric violations matching the rule's conditions go undetected until the rule is recreated. This is a detective-control evasion primitive with no accompanying resource access.
Raw rule rules/derived/azure/monitor.yaml
id: azure-monitor-delete-metric-alert
emits: CanDelete
description: Delete a metric alert rule, silencing automated detection triggered by metric thresholds
(CPU, memory, network, custom metrics). Metric alerts fire independently of log-search alerts and are
on distinct ARM resource types.
match_effective_permission:
action: Microsoft.Insights/metricAlerts/delete
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: SecurityService
source: <principal>
target: <metric alert rule (SecurityService node)>
permissions:
- Microsoft.Insights/metricAlerts/delete
conditions:
- iam_permission
- deny_assignment
state_logic: ACTIVE when the principal holds the delete action at the effective scope with no deny assignment.
Metric alert rules are distinct ARM resources from scheduled query rules and activity log alerts;
deleting one does not affect the others. BLOCKED if deny assignment covers metricAlerts/delete.
confidence: 0.92
derived_from:
- 'effective permission: Microsoft.Insights/metricAlerts/delete'
false_positive_note: DEFENSE EVASION ONLY. Deleting a metric alert rule silences threshold-based detection
(e.g., 'alert when CPU > 80%'). It does not grant access to any resource. Metric alerts and scheduled-query
alerts are on separate resource types; deleting one does not affect the other. Do NOT chain to access
escalation edges. Monitoring Contributor and Contributor/Owner roles include metricAlerts/delete;
Monitoring Reader does NOT.
narrative: '{principal.name} can delete metric alert rule {target.name} (Microsoft.Insights/metricAlerts/delete),
silencing automated detection based on metric thresholds (CPU, memory, network, custom metrics). Subsequent
metric violations matching the rule''s conditions go undetected until the rule is recreated. This
is a detective-control evasion primitive with no accompanying resource access.'