rage.fail

azure-siem-workspace-locatedin

explicit azure emits LocatedIn

match (record)

{ "field": "resourceGroup", "resource_type": "Microsoft.OperationalInsights/workspaces" }

emit

source type	`LoggingService`
target type	`ResourceGroup`
source	`<Log Analytics workspace (LoggingService)>`
target	`<ResourceGroup (AdministrativeBoundary)>`

Narrative

Log Analytics workspace {source.name} is located in resource group {target.name}.

Raw rule rules/explicit/azure/loganalytics.yaml

id: azure-siem-workspace-locatedin
emits: LocatedIn
applies_to:
- azure
match_record:
  resource_type: Microsoft.OperationalInsights/workspaces
  field: resourceGroup
emit:
  source_type: LoggingService
  target_type: ResourceGroup
  source: <Log Analytics workspace (LoggingService)>
  target: <ResourceGroup (AdministrativeBoundary)>
  api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces
  evidence_field: id (parse resourceGroup segment)
  narrative: Log Analytics workspace {source.name} is located in resource group {target.name}.