azure-monitor-delete-scheduled-query-alert
Delete a scheduled query (log search) alert rule, silencing automated detection based on KQL log queries - disables alerting on specific threat patterns or compliance baselines.
match (effective permission)
{
"action": "Microsoft.Insights/scheduledQueryRules/delete",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | <principal> |
| target | <scheduled query alert rule (SecurityService node)> |
| permissions | Microsoft.Insights/scheduledQueryRules/delete |
| conditions | iam_permission deny_assignment |
| state logic | ACTIVE when the principal holds the delete action at the effective scope with no deny assignment. The deletion silences the specific alert rule; if the rule's action group is also deleted (see azure-monitor-delete-action-group), the response is doubly disabled. BLOCKED if deny assignment covers scheduledQueryRules/delete. |
Narrative
{principal.name} can delete scheduled query alert rule {target.name} (Microsoft.Insights/scheduledQueryRules/delete), silencing automated detection based on the rule's KQL query. Subsequent events matching the rule's pattern go undetected until the rule is recreated. This is a detective-control evasion primitive with no accompanying resource access.
Raw rule rules/derived/azure/monitor.yaml
id: azure-monitor-delete-scheduled-query-alert
emits: CanDelete
description: "Delete a scheduled query (log search) alert rule, silencing automated detection based on\
\ KQL log queries \u2014 disables alerting on specific threat patterns or compliance baselines."
match_effective_permission:
action: Microsoft.Insights/scheduledQueryRules/delete
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: SecurityService
source: <principal>
target: <scheduled query alert rule (SecurityService node)>
permissions:
- Microsoft.Insights/scheduledQueryRules/delete
conditions:
- iam_permission
- deny_assignment
state_logic: ACTIVE when the principal holds the delete action at the effective scope with no deny assignment.
The deletion silences the specific alert rule; if the rule's action group is also deleted (see azure-monitor-delete-action-group),
the response is doubly disabled. BLOCKED if deny assignment covers scheduledQueryRules/delete.
confidence: 0.92
derived_from:
- 'effective permission: Microsoft.Insights/scheduledQueryRules/delete'
false_positive_note: "DEFENSE EVASION ONLY. Deleting an alert rule silences automated detection of whatever\
\ the rule was monitoring (e.g. 'alert on >3 sign-in failures from same IP in 5 min'). It does not\
\ grant access to any resource. An analyst should note which threat scenarios the deleted rule covered.\
\ Do NOT chain to access escalation edges. Monitoring Contributor and Contributor/Owner roles include\
\ scheduledQueryRules/delete; Monitoring Reader does NOT \u2014 verify the effective role before emitting."
narrative: '{principal.name} can delete scheduled query alert rule {target.name} (Microsoft.Insights/scheduledQueryRules/delete),
silencing automated detection based on the rule''s KQL query. Subsequent events matching the rule''s
pattern go undetected until the rule is recreated. This is a detective-control evasion primitive with
no accompanying resource access.'