azure-siem-workspace-admin
Full control of a Log Analytics workspace (Log Analytics Contributor / Contributor / Owner).
match (effective permission)
{
"action": "Microsoft.OperationalInsights/workspaces/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Log Analytics Contributor, Contributor, Owner, or a custom role granting Microsoft.OperationalInsights/workspaces/* at the scope
emit
| source type | Identity |
|---|---|
| target type | LoggingService |
| source | <principal> |
| target | <Log Analytics workspace (LoggingService)> |
| permissions | Microsoft.OperationalInsights/workspaces/write |
| state logic | ACTIVE when the effective permission is confirmed; BLOCKED if a deny assignment covers workspaces/write at the scope. CanAdminister(workspace) does NOT imply CanGrantPermission — escalation is via Sentinel playbook managed identities or data exfiltration, not via self role-assignment. |
Narrative
{principal.name} has full administrative control of Log Analytics workspace {target.name} (Microsoft.OperationalInsights/workspaces/*), including retention settings, data sources, pricing tier, and linked services.
Raw rule rules/derived/azure/loganalytics.yaml
id: azure-siem-workspace-admin
emits: CanAdminister
description: Full control of a Log Analytics workspace (Log Analytics Contributor / Contributor / Owner).
match_effective_permission:
action: Microsoft.OperationalInsights/workspaces/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Log Analytics Contributor, Contributor, Owner, or a custom role granting
Microsoft.OperationalInsights/workspaces/* at the scope
emit:
source_type: Identity
target_type: LoggingService
source: <principal>
target: <Log Analytics workspace (LoggingService)>
permissions:
- Microsoft.OperationalInsights/workspaces/write
conditions: []
state_logic: "ACTIVE when the effective permission is confirmed; BLOCKED if a deny assignment covers\
\ workspaces/write at the scope. CanAdminister(workspace) does NOT imply CanGrantPermission \u2014\
\ escalation is via Sentinel playbook managed identities or data exfiltration, not via self role-assignment."
confidence: 0.98
derived_from:
- 'effective permission: Microsoft.OperationalInsights/workspaces/write'
false_positive_note: "NATURE CONFLICT: This rule uses match_effective_permission (derived computation)\
\ but emits CanAdminister (nature=explicit in edges.yaml). This is a valid normalization pattern \u2014\
\ it evaluates the effective permission and normalizes it to an edge. SEMANTIC LIMITATION: Log Analytics\
\ Contributor grants workspaces/write (modification) but NOT workspaces/delete (workspace destruction).\
\ A principal with only workspaces/write but WITHOUT workspaces/delete does NOT qualify for true CanAdminister\
\ (which implies full admin including deletion). Downgrade to CanWrite if workspaces/delete is absent.\
\ This rule emits CanAdminister only when the principal holds both write AND delete (or Contributor/Owner\
\ role which includes both). Log Analytics Reader holds only workspaces/read and query/*/action; it\
\ does NOT qualify for CanAdminister or CanWrite."
narrative: '{principal.name} has full administrative control of Log Analytics workspace {target.name}
(Microsoft.OperationalInsights/workspaces/*), including retention settings, data sources, pricing
tier, and linked services.'