azure-siem-data-connector-delete
Delete a Sentinel data connector to stop ingestion from a specific data source, creating a blind spot.
match (effective permission)
{
"action": "Microsoft.SecurityInsights/dataConnectors/delete",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | <principal> |
| target | <Sentinel data connector (SecurityService)> |
| permissions | Microsoft.SecurityInsights/dataConnectors/delete |
| state logic | ACTIVE when the effective permission is confirmed. Deleting a data connector stops ingestion from the specific source (Azure AD / M365 / Defender / etc.), creating a blind spot in that category of telemetry. BLOCKED if a deny assignment covers dataConnectors/delete. |
Narrative
{principal.name} can delete Sentinel data connector {target.name} (Microsoft.SecurityInsights/dataConnectors/delete), stopping ingestion from its data source and creating a blind spot. This reduces detection capability - it does NOT grant access to other Azure resources.
Raw rule rules/derived/azure/loganalytics.yaml
id: azure-siem-data-connector-delete
emits: CanModifyConfiguration
description: Delete a Sentinel data connector to stop ingestion from a specific data source, creating
a blind spot.
match_effective_permission:
action: Microsoft.SecurityInsights/dataConnectors/delete
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: SecurityService
source: <principal>
target: <Sentinel data connector (SecurityService)>
permissions:
- Microsoft.SecurityInsights/dataConnectors/delete
conditions: []
state_logic: ACTIVE when the effective permission is confirmed. Deleting a data connector stops ingestion
from the specific source (Azure AD / M365 / Defender / etc.), creating a blind spot in that category
of telemetry. BLOCKED if a deny assignment covers dataConnectors/delete.
confidence: 0.93
derived_from:
- 'effective permission: Microsoft.SecurityInsights/dataConnectors/delete'
false_positive_note: "EVASION, NOT ESCALATION. Deleting a data connector does not remove historical\
\ data (already ingested) but prevents new ingestion from that source. The impact depends on which\
\ connector is deleted \u2014 Azure AD connector creates blind spot on sign-in anomalies; Defender\
\ connector hides endpoint alerts. Does NOT grant access to Azure resources. Reconnecting the connector\
\ (dataConnectors/write) later is trivial for a legitimate admin, but the blind spot during the attack\
\ window is real."
narrative: "{principal.name} can delete Sentinel data connector {target.name} (Microsoft.SecurityInsights/dataConnectors/delete),\
\ stopping ingestion from its data source and creating a blind spot. This reduces detection capability\
\ \u2014 it does NOT grant access to other Azure resources."