azure-siem-analytics-rule-write
Disable or modify Sentinel analytics rules to suppress alerts for specific TTPs (defense evasion).
match (effective permission)
{
"action": "Microsoft.SecurityInsights/alertRules/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | <principal> |
| target | <Sentinel analytics rule (SecurityService)> |
| permissions | Microsoft.SecurityInsights/alertRules/write |
| state logic | ACTIVE when the effective permission is confirmed. alertRules/write allows setting enabled=false (disable alert), modifying the KQL detection query (e.g., add an exclusion for the attacker's IP/account), or changing severity and suppression settings. BLOCKED if a deny assignment covers alertRules/write. |
Narrative
{principal.name} can modify or disable Sentinel analytics rules in workspace {target.name} (Microsoft.SecurityInsights/alertRules/write), suppressing detections for specific attack techniques. This reduces detection - it does NOT grant access to other Azure resources.
Raw rule rules/derived/azure/loganalytics.yaml
id: azure-siem-analytics-rule-write
emits: CanModifyConfiguration
description: Disable or modify Sentinel analytics rules to suppress alerts for specific TTPs (defense
evasion).
match_effective_permission:
action: Microsoft.SecurityInsights/alertRules/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: SecurityService
source: <principal>
target: <Sentinel analytics rule (SecurityService)>
permissions:
- Microsoft.SecurityInsights/alertRules/write
conditions: []
state_logic: ACTIVE when the effective permission is confirmed. alertRules/write allows setting enabled=false
(disable alert), modifying the KQL detection query (e.g., add an exclusion for the attacker's IP/account),
or changing severity and suppression settings. BLOCKED if a deny assignment covers alertRules/write.
confidence: 0.95
derived_from:
- 'effective permission: Microsoft.SecurityInsights/alertRules/write'
false_positive_note: EVASION, NOT ESCALATION. alertRules/write allows disabling or neutering specific
detections. Setting enabled=false is the direct evasion path; modifying KQL to add an exclusion is
more subtle. Neither grants access to Azure resources. Do NOT chain to CanEnterSubscription or CanExecuteAs.
Microsoft Sentinel Contributor holds alertRules/write.
narrative: "{principal.name} can modify or disable Sentinel analytics rules in workspace {target.name}\
\ (Microsoft.SecurityInsights/alertRules/write), suppressing detections for specific attack techniques.\
\ This reduces detection \u2014 it does NOT grant access to other Azure resources."