azure-siem-workspace-purge
Purge specific log data from a Log Analytics workspace (irreversible - targeted evidence destruction). The purge/action operation is data-plane irreversible row deletion within an existing workspace (distinct from workspaces/delete which destroys the workspace resource). CanDeleteData target set [Storage, Data] excludes LoggingService (ManagementService), so CanDelete (target=*) is the correct fallback to model data-plane row deletion capability.
match (effective permission)
{
"action": "Microsoft.OperationalInsights/workspaces/purge/action",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | LoggingService |
| source | <principal> |
| target | <Log Analytics workspace (LoggingService)> |
| permissions | Microsoft.OperationalInsights/workspaces/purge/action |
| state logic | ACTIVE when the effective permission is confirmed. purge/action is a distinct data-plane permission (not implied by workspaces/write or workspaces/delete); it requires explicit grant. The purge operation is irreversible within the workspace — purged rows cannot be recovered even by Microsoft support. BLOCKED if a deny assignment covers workspaces/purge/action. |
Narrative
{principal.name} can purge specific log rows from Log Analytics workspace {target.name} (purge/action), irreversibly deleting targeted forensic evidence. This is a precision cover-tracks primitive - it does NOT grant access to other Azure resources.
Raw rule rules/derived/azure/loganalytics.yaml
id: azure-siem-workspace-purge
emits: CanDelete
description: "Purge specific log data from a Log Analytics workspace (irreversible \u2014 targeted evidence\
\ destruction). The purge/action operation is data-plane irreversible row deletion within an existing\
\ workspace (distinct from workspaces/delete which destroys the workspace resource). CanDeleteData target\
\ set [Storage, Data] excludes LoggingService (ManagementService), so CanDelete (target=*) is the correct\
\ fallback to model data-plane row deletion capability."
match_effective_permission:
action: Microsoft.OperationalInsights/workspaces/purge/action
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: LoggingService
source: <principal>
target: <Log Analytics workspace (LoggingService)>
permissions:
- Microsoft.OperationalInsights/workspaces/purge/action
conditions: []
state_logic: "ACTIVE when the effective permission is confirmed. purge/action is a distinct data-plane\
\ permission (not implied by workspaces/write or workspaces/delete); it requires explicit grant. The\
\ purge operation is irreversible within the workspace \u2014 purged rows cannot be recovered even\
\ by Microsoft support. BLOCKED if a deny assignment covers workspaces/purge/action."
confidence: 0.97
derived_from:
- 'effective permission: Microsoft.OperationalInsights/workspaces/purge/action'
false_positive_note: "EVASION, NOT ESCALATION. purge/action allows targeted deletion of specific rows\
\ matching a KQL predicate (e.g., delete all AzureActivity rows from the attack window). Requires\
\ a separate POST to purge and a GET to check completion. purge/action is NOT implied by workspaces/write\
\ or Log Analytics Contributor \u2014 it requires an explicit RBAC grant (often restricted to a separate\
\ role). This reduces forensic evidence \u2014 it does NOT grant access to other Azure resources."
narrative: "{principal.name} can purge specific log rows from Log Analytics workspace {target.name}\
\ (purge/action), irreversibly deleting targeted forensic evidence. This is a precision cover-tracks\
\ primitive \u2014 it does NOT grant access to other Azure resources."