rage.fail

azure-siem-sentinel-node-locatedin

explicit azure emits LocatedIn

match (record)

{ "field": "name", "resource_type": "Microsoft.SecurityInsights/alertRules" }

where

alertRule is scoped under a Microsoft.OperationalInsights/workspaces/{workspace} provider path

emit

source type	`SecurityService`
target type	`ResourceGroup`
source	`<Sentinel analytics rule (SecurityService)>`
target	`<ResourceGroup of the parent workspace (AdministrativeBoundary)>`

Narrative

Sentinel analytics rule {source.name} is located in resource group {target.name} (co-located with its parent workspace).

Raw rule rules/explicit/azure/loganalytics.yaml

id: azure-siem-sentinel-node-locatedin
emits: LocatedIn
applies_to:
- azure
match_record:
  resource_type: Microsoft.SecurityInsights/alertRules
  field: name
where:
- alertRule is scoped under a Microsoft.OperationalInsights/workspaces/{workspace} provider path
emit:
  source_type: SecurityService
  target_type: ResourceGroup
  source: <Sentinel analytics rule (SecurityService)>
  target: <ResourceGroup of the parent workspace (AdministrativeBoundary)>
  api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{workspace}/providers/Microsoft.SecurityInsights/alertRules
  evidence_field: id (parse resourceGroup segment)
  narrative: Sentinel analytics rule {source.name} is located in resource group {target.name} (co-located
    with its parent workspace).