azure-siem-workspace-admin

Full control of a Log Analytics workspace (Log Analytics Contributor / Contributor / Owner).

derived azure emits CanAdminister

match (effective permission)

{ "action": "Microsoft.OperationalInsights/workspaces/write", "scope_type": "resource|resourceGroup|subscription" }

where

principal effectively holds Log Analytics Contributor, Contributor, Owner, or a custom role granting Microsoft.OperationalInsights/workspaces/* at the scope

emit

source typeIdentity
target typeLoggingService
source<principal>
target<Log Analytics workspace (LoggingService)>
permissionsMicrosoft.OperationalInsights/workspaces/write
state logicACTIVE when the effective permission is confirmed; BLOCKED if a deny assignment covers workspaces/write at the scope. CanAdminister(workspace) does NOT imply CanGrantPermission — escalation is via Sentinel playbook managed identities or data exfiltration, not via self role-assignment.

Narrative

{principal.name} has full administrative control of Log Analytics workspace {target.name} (Microsoft.OperationalInsights/workspaces/*), including retention settings, data sources, pricing tier, and linked services.

Raw rule rules/derived/azure/loganalytics.yaml

id: azure-siem-workspace-admin
emits: CanAdminister
description: Full control of a Log Analytics workspace (Log Analytics Contributor / Contributor / Owner).
match_effective_permission:
  action: Microsoft.OperationalInsights/workspaces/write
  scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Log Analytics Contributor, Contributor, Owner, or a custom role granting
  Microsoft.OperationalInsights/workspaces/* at the scope
emit:
  source_type: Identity
  target_type: LoggingService
  source: <principal>
  target: <Log Analytics workspace (LoggingService)>
  permissions:
  - Microsoft.OperationalInsights/workspaces/write
  conditions: []
  state_logic: "ACTIVE when the effective permission is confirmed; BLOCKED if a deny assignment covers\
    \ workspaces/write at the scope. CanAdminister(workspace) does NOT imply CanGrantPermission \u2014\
    \ escalation is via Sentinel playbook managed identities or data exfiltration, not via self role-assignment."
  confidence: 0.98
  derived_from:
  - 'effective permission: Microsoft.OperationalInsights/workspaces/write'
  false_positive_note: "NATURE CONFLICT: This rule uses match_effective_permission (derived computation)\
    \ but emits CanAdminister (nature=explicit in edges.yaml). This is a valid normalization pattern \u2014\
    \ it evaluates the effective permission and normalizes it to an edge. SEMANTIC LIMITATION: Log Analytics\
    \ Contributor grants workspaces/write (modification) but NOT workspaces/delete (workspace destruction).\
    \ A principal with only workspaces/write but WITHOUT workspaces/delete does NOT qualify for true CanAdminister\
    \ (which implies full admin including deletion). Downgrade to CanWrite if workspaces/delete is absent.\
    \ This rule emits CanAdminister only when the principal holds both write AND delete (or Contributor/Owner\
    \ role which includes both). Log Analytics Reader holds only workspaces/read and query/*/action; it\
    \ does NOT qualify for CanAdminister or CanWrite."
  narrative: '{principal.name} has full administrative control of Log Analytics workspace {target.name}
    (Microsoft.OperationalInsights/workspaces/*), including retention settings, data sources, pricing
    tier, and linked services.'
move · open · esc close