azure-siem-analytics-rule-delete
Delete Sentinel analytics rules to silence specific threat detections (defense evasion - disable alerting for attack techniques).
match (effective permission)
{
"action": "Microsoft.SecurityInsights/alertRules/delete",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | <principal> |
| target | <Sentinel analytics rule (SecurityService)> |
| permissions | Microsoft.SecurityInsights/alertRules/delete |
| state logic | ACTIVE when the effective permission is confirmed. Microsoft Sentinel Contributor, Contributor, and Owner roles hold this permission. BLOCKED if a deny assignment covers alertRules/delete. |
Narrative
{principal.name} can delete Sentinel analytics rules in workspace {target.name} (Microsoft.SecurityInsights/alertRules/delete), silencing specific threat detections. This reduces detection capability - it does NOT grant access to other Azure resources.
Raw rule rules/derived/azure/loganalytics.yaml
id: azure-siem-analytics-rule-delete
emits: CanModifyConfiguration
description: "Delete Sentinel analytics rules to silence specific threat detections (defense evasion \u2014\
\ disable alerting for attack techniques)."
match_effective_permission:
action: Microsoft.SecurityInsights/alertRules/delete
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: SecurityService
source: <principal>
target: <Sentinel analytics rule (SecurityService)>
permissions:
- Microsoft.SecurityInsights/alertRules/delete
conditions: []
state_logic: ACTIVE when the effective permission is confirmed. Microsoft Sentinel Contributor, Contributor,
and Owner roles hold this permission. BLOCKED if a deny assignment covers alertRules/delete.
confidence: 0.96
derived_from:
- 'effective permission: Microsoft.SecurityInsights/alertRules/delete'
false_positive_note: "EVASION, NOT ESCALATION. Deleting an analytics rule removes the KQL-based detection\
\ that would fire alerts on the attacker's TTPs (e.g., delete the \"Brute Force\" or \"Suspicious\
\ MFA\" rule before performing those actions). This does NOT grant access to any Azure resource. Do\
\ NOT chain to CanEnterSubscription or any escalation edge. Note: Microsoft Sentinel Reader does NOT\
\ hold alertRules/delete \u2014 only Contributor and above."
narrative: "{principal.name} can delete Sentinel analytics rules in workspace {target.name} (Microsoft.SecurityInsights/alertRules/delete),\
\ silencing specific threat detections. This reduces detection capability \u2014 it does NOT grant\
\ access to other Azure resources."