azure-siem-workspace-write-config

id: azure-siem-workspace-write-config
emits: CanModifyConfiguration
description: Modify Log Analytics workspace configuration (pricing tier, daily cap, retention) to halt
  or reduce log ingestion silently.
match_effective_permission:
  action: Microsoft.OperationalInsights/workspaces/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: LoggingService
  source: <principal>
  target: <Log Analytics workspace (LoggingService)>
  permissions:
  - Microsoft.OperationalInsights/workspaces/write
  conditions: []
  state_logic: ACTIVE when the effective permission is confirmed. workspaces/write allows setting dailyCap
    (ingestion limit in GB/day; 0 = no ingestion after cap), changing retention (shorter retention = less
    historical evidence), and modifying pricing tier (affects alert limits and ingestion behavior). BLOCKED
    if a deny assignment covers workspaces/write.
  confidence: 0.9
  derived_from:
  - 'effective permission: Microsoft.OperationalInsights/workspaces/write'
  false_positive_note: EVASION, NOT ESCALATION. Setting dailyCap=0 or near-zero halts log ingestion silently
    after the cap is reached each day; this reduces monitoring coverage without deleting data. This is
    an effective cover-tracks primitive that is hard to detect if monitoring on workspace configuration
    changes is missing. It does NOT grant access to other Azure resources. Confidence 0.90 (lower than
    delete/purge) because cap changes are more noticeable to operators via Azure Monitor alerts on cap-exceeded
    metrics.
  narrative: "{principal.name} can modify the configuration of Log Analytics workspace {target.name} (workspaces/write),\
    \ including setting the daily ingestion cap to halt new log ingestion silently. This weakens detective\
    \ coverage \u2014 it does NOT grant access to other Azure resources."