azure-siem-workspace-query

id: azure-siem-workspace-query
emits: CanRead
description: "Execute KQL queries against a Log Analytics workspace, reading ingested log data that may\
  \ contain tokens, connection strings, API keys, or session credentials. Modeled as CanRead (target:\
  \ LoggingService) \u2014 CanReadData target set is restricted to Storage/Data/Messaging and does not\
  \ include ManagementService subtypes."
match_effective_permission:
  action: Microsoft.OperationalInsights/workspaces/query/*/action
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: LoggingService
  source: <principal>
  target: <Log Analytics workspace (LoggingService)>
  permissions:
  - Microsoft.OperationalInsights/workspaces/query/*/action
  conditions: []
  state_logic: ACTIVE when the effective permission is confirmed at the workspace scope (Log Analytics
    Reader or Log Analytics Contributor includes this permission). The query surface is the full set of
    log tables in the workspace; privilege gain depends on what sensitive data is ingested. CONDITIONAL
    if the workspace has table-level RBAC configured (Microsoft.OperationalInsights/workspaces/ query/{tableName}/action)
    restricting which tables the principal can query. BLOCKED if a deny assignment covers the query action
    at effective scope.
  confidence: 0.85
  derived_from:
  - 'effective permission: Microsoft.OperationalInsights/workspaces/query/*/action'
  false_positive_note: "SCHEMA CONSTRAINT: CanReadData target set [Storage, Data, Messaging] excludes\
    \ LoggingService (ManagementService subtype). CanRead here models data-plane query access (not just\
    \ metadata recon) \u2014 this is a schema limitation, not a semantic downgrade. Credential-chains\
    \ pivot (CanReadData + ContainsSecret => CanReadSecret) requires explicit ContainsSecret edges on\
    \ data table nodes (ObjectStorage or Data) promoted from the workspace, not derivable from this CanRead\
    \ edge directly. This rule is conservative: credential material in logs depends on application verbosity\
    \ and is not guaranteed. Emit with confidence 0.85 (query access confirmed, but sensitive data presence\
    \ is environment-dependent). Table-level RBAC (query/{tableName}/action) can restrict this to specific\
    \ tables \u2014 downgrade to CONDITIONAL if table-level RBAC is configured and restricts the attacker's\
    \ access to sensitive tables. The query endpoint (api.loganalytics.io) is network-accessible by default\
    \ from any Entra-authenticated client."
  narrative: '{principal.name} can execute KQL queries against Log Analytics workspace {target.name} (workspaces/query/*/action),
    reading all ingested log data. Depending on application logging verbosity, this may expose access
    tokens, connection strings, API keys, or session credentials in log records.'