Azure Network Azure-Microsoft.Network

48 operations, identified by operationName in the audit log.

operationName	Description
_catch_all	Catch-all for Azure-Microsoft.Network rules matching the resource provider but no specific operation.
Microsoft.Network/applicationGateways/delete	Deletes an Azure Application Gateway.
Microsoft.Network/applicationGateways/write	Creates or updates an Azure Application Gateway, including WAF policy and routing rules.
Microsoft.Network/applicationSecurityGroups/delete	Deletes an Application Security Group used to group VMs for network security rule targeting.
Microsoft.Network/applicationSecurityGroups/write	Creates or updates an Application Security Group.
Microsoft.Network/azureFirewalls/applicationRuleCollections/delete	Deletes an application rule collection from an Azure Firewall.
Microsoft.Network/azureFirewalls/applicationRuleCollections/write	Creates or updates an application rule collection on an Azure Firewall, controlling outbound FQDN-based traffic.
Microsoft.Network/azureFirewalls/delete	Deletes an Azure Firewall instance.
Microsoft.Network/azureFirewalls/natRuleCollections/delete	Deletes a DNAT rule collection from an Azure Firewall.
Microsoft.Network/azureFirewalls/natRuleCollections/write	Creates or updates a DNAT rule collection on an Azure Firewall for inbound traffic translation.
Microsoft.Network/azureFirewalls/networkRuleCollections/delete	Deletes a network rule collection from an Azure Firewall.
Microsoft.Network/azureFirewalls/networkRuleCollections/write	Creates or updates a network rule collection on an Azure Firewall, controlling non-HTTP traffic flows.
Microsoft.Network/azureFirewalls/write	Creates or updates an Azure Firewall, including its IP configuration and rule association.
Microsoft.Network/firewallPolicies/certificates/action	Performs a certificate action on an Azure Firewall Policy, such as associating a TLS inspection certificate.
Microsoft.Network/firewallPolicies/delete	Deletes an Azure Firewall Policy.
Microsoft.Network/firewallPolicies/join/action	Joins an Azure Firewall to a Firewall Policy.
Microsoft.Network/firewallPolicies/ruleCollectionGroups/delete	Deletes a rule collection group from an Azure Firewall Policy.
Microsoft.Network/firewallPolicies/ruleCollectionGroups/write	Creates or updates a rule collection group within an Azure Firewall Policy.
Microsoft.Network/firewallPolicies/ruleGroups/delete	Deletes a legacy rule group from an Azure Firewall Policy.
Microsoft.Network/firewallPolicies/ruleGroups/write	Creates or updates a legacy rule group in an Azure Firewall Policy.
Microsoft.Network/firewallPolicies/write	Creates or updates an Azure Firewall Policy, defining the rule set attached to one or more firewalls.
Microsoft.Network/frontDoorWebApplicationFirewallPolicies/delete	Deletes a Front Door WAF policy.
Microsoft.Network/networkInterfaces/delete	Deletes a network interface card.
Microsoft.Network/networkInterfaces/join/action	Joins a network interface to a virtual machine.
Microsoft.Network/networkInterfaces/tapConfigurations/delete	Deletes a TAP configuration from a network interface (removes traffic mirroring).
Microsoft.Network/networkInterfaces/tapConfigurations/write	Creates or updates a TAP configuration on a network interface, enabling traffic mirroring to a collector.
Microsoft.Network/networkInterfaces/write	Creates or updates a network interface card.
Microsoft.Network/networkSecurityGroups/delete	Deletes a Network Security Group.
Microsoft.Network/networkSecurityGroups/join/action	Associates a Network Security Group with a subnet or network interface.
Microsoft.Network/networkSecurityGroups/providers/Microsoft.Insights/diagnosticSettings/write	Configures diagnostic settings on a Network Security Group to forward flow logs to a Log Analytics workspace or storage account.
Microsoft.Network/networkSecurityGroups/securityRules/delete	Deletes a security rule from a Network Security Group, potentially removing a network access control.
Microsoft.Network/networkSecurityGroups/securityRules/write	Creates or updates a security rule in a Network Security Group, controlling inbound or outbound traffic.
Microsoft.Network/networkSecurityGroups/write	Creates or updates a Network Security Group, which contains security rules governing traffic to associated subnets and NICs.
Microsoft.Network/networkVirtualAppliances/delete	Deletes a Network Virtual Appliance resource.
Microsoft.Network/networkVirtualAppliances/write	Creates or updates a Network Virtual Appliance.
Microsoft.Network/networkWatchers/delete	Deletes a Network Watcher instance, disabling network diagnostics and flow log capture for a region.
Microsoft.Network/p2sVpnGateways/delete	Deletes a Point-to-Site VPN gateway.
Microsoft.Network/p2sVpnGateways/disconnectP2sVpnConnections/action	Disconnects active Point-to-Site VPN client connections from a gateway.
Microsoft.Network/p2sVpnGateways/generateVpnProfile/action	Generates a VPN client profile package for a Point-to-Site VPN gateway.
Microsoft.Network/p2sVpnGateways/providers/Microsoft.Insights/diagnosticSettings/write	Configures diagnostic settings on a P2S VPN gateway to forward logs to a Log Analytics workspace or storage account.
Microsoft.Network/p2sVpnGateways/reset/action	Resets a Point-to-Site VPN gateway.
Microsoft.Network/p2sVpnGateways/write	Creates or updates a Point-to-Site VPN gateway.
Microsoft.Network/virtualHubs/delete	Deletes a Virtual WAN hub.
Microsoft.Network/virtualHubs/write	Creates or updates a Virtual WAN hub.
Microsoft.Network/virtualRouters/delete	Deletes a Virtual Router resource.
Microsoft.Network/virtualRouters/write	Creates or updates a Virtual Router resource.
Microsoft.Network/vpnGateways/vpnConnections/delete	Deletes a VPN connection from a Virtual WAN VPN gateway.
Microsoft.Network/vpnGateways/vpnConnections/write	Creates or updates a VPN connection on a Virtual WAN VPN gateway.

_catch_all: Azure Network (catch-all)

Resource provider: Azure-Microsoft.Network

Description

Catch-all for Azure-Microsoft.Network rules matching the resource provider but no specific operation.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/applicationGateways/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes an Azure Application Gateway.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Application Gateway Modified or Deleted source medium: Identifies when a application gateway is modified or deleted.↳ also matches Microsoft.Network/applicationGateways/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/applicationGateways/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates an Azure Application Gateway, including WAF policy and routing rules.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Application Gateway Modified or Deleted source medium: Identifies when a application gateway is modified or deleted.↳ also matches Microsoft.Network/applicationGateways/delete

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/applicationSecurityGroups/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes an Application Security Group used to group VMs for network security rule targeting.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Application Security Group Modified or Deleted source medium: Identifies when a application security group is modified or deleted.↳ also matches Microsoft.Network/applicationSecurityGroups/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/applicationSecurityGroups/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates an Application Security Group.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Application Security Group Modified or Deleted source medium: Identifies when a application security group is modified or deleted.↳ also matches Microsoft.Network/applicationSecurityGroups/delete

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/azureFirewalls/applicationRuleCollections/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes an application rule collection from an Azure Firewall.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Firewall Rule Collection Modified or Deleted source medium: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.↳ also matches Microsoft.Network/azureFirewalls/applicationRuleCollections/write, Microsoft.Network/azureFirewalls/natRuleCollections/delete, Microsoft.Network/azureFirewalls/natRuleCollections/write, Microsoft.Network/azureFirewalls/networkRuleCollections/delete, Microsoft.Network/azureFirewalls/networkRuleCollections/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/azureFirewalls/applicationRuleCollections/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates an application rule collection on an Azure Firewall, controlling outbound FQDN-based traffic.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Firewall Rule Collection Modified or Deleted source medium: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.↳ also matches Microsoft.Network/azureFirewalls/applicationRuleCollections/delete, Microsoft.Network/azureFirewalls/natRuleCollections/delete, Microsoft.Network/azureFirewalls/natRuleCollections/write, Microsoft.Network/azureFirewalls/networkRuleCollections/delete, Microsoft.Network/azureFirewalls/networkRuleCollections/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/azureFirewalls/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes an Azure Firewall instance.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Firewall Modified or Deleted source medium: Identifies when a firewall is created, modified, or deleted.↳ also matches Microsoft.Network/azureFirewalls/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/azureFirewalls/natRuleCollections/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a DNAT rule collection from an Azure Firewall.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Firewall Rule Collection Modified or Deleted source medium: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.↳ also matches Microsoft.Network/azureFirewalls/applicationRuleCollections/delete, Microsoft.Network/azureFirewalls/applicationRuleCollections/write, Microsoft.Network/azureFirewalls/natRuleCollections/write, Microsoft.Network/azureFirewalls/networkRuleCollections/delete, Microsoft.Network/azureFirewalls/networkRuleCollections/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/azureFirewalls/natRuleCollections/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates a DNAT rule collection on an Azure Firewall for inbound traffic translation.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Firewall Rule Collection Modified or Deleted source medium: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.↳ also matches Microsoft.Network/azureFirewalls/applicationRuleCollections/delete, Microsoft.Network/azureFirewalls/applicationRuleCollections/write, Microsoft.Network/azureFirewalls/natRuleCollections/delete, Microsoft.Network/azureFirewalls/networkRuleCollections/delete, Microsoft.Network/azureFirewalls/networkRuleCollections/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/azureFirewalls/networkRuleCollections/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a network rule collection from an Azure Firewall.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Firewall Rule Collection Modified or Deleted source medium: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.↳ also matches Microsoft.Network/azureFirewalls/applicationRuleCollections/delete, Microsoft.Network/azureFirewalls/applicationRuleCollections/write, Microsoft.Network/azureFirewalls/natRuleCollections/delete, Microsoft.Network/azureFirewalls/natRuleCollections/write, Microsoft.Network/azureFirewalls/networkRuleCollections/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/azureFirewalls/networkRuleCollections/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates a network rule collection on an Azure Firewall, controlling non-HTTP traffic flows.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Firewall Rule Collection Modified or Deleted source medium: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.↳ also matches Microsoft.Network/azureFirewalls/applicationRuleCollections/delete, Microsoft.Network/azureFirewalls/applicationRuleCollections/write, Microsoft.Network/azureFirewalls/natRuleCollections/delete, Microsoft.Network/azureFirewalls/natRuleCollections/write, Microsoft.Network/azureFirewalls/networkRuleCollections/delete

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/azureFirewalls/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates an Azure Firewall, including its IP configuration and rule association.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Firewall Modified or Deleted source medium: Identifies when a firewall is created, modified, or deleted.↳ also matches Microsoft.Network/azureFirewalls/delete

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/firewallPolicies/certificates/action

Resource provider: Azure-Microsoft.Network

Description

Performs a certificate action on an Azure Firewall Policy, such as associating a TLS inspection certificate.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`operationName`	eq	`MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE`	1 rule	panther, sigma

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Network Firewall Policy Modified or Deleted source medium: Identifies when a Firewall Policy is Modified or Deleted.↳ also matches Microsoft.Network/firewallPolicies/delete, Microsoft.Network/firewallPolicies/join/action, Microsoft.Network/firewallPolicies/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/firewallPolicies/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes an Azure Firewall Policy.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`event.outcome`	in	`Success`	1 rule	elastic
`event.outcome`	in	`success`	1 rule	elastic
`operationName`	eq	`MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE`	1 rule	panther, sigma

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Network Firewall Policy Modified or Deleted source medium: Identifies when a Firewall Policy is Modified or Deleted.↳ also matches Microsoft.Network/firewallPolicies/certificates/action, Microsoft.Network/firewallPolicies/join/action, Microsoft.Network/firewallPolicies/write

Elastic #

Azure VNet Firewall Policy Deleted source low: Identifies the deletion of a firewall policy in Azure. An adversary may delete a firewall policy in an attempt to evade defenses and/or to eliminate barriers to their objective.

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/firewallPolicies/join/action

Resource provider: Azure-Microsoft.Network

Description

Joins an Azure Firewall to a Firewall Policy.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`operationName`	eq	`MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE`	1 rule	panther, sigma

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Network Firewall Policy Modified or Deleted source medium: Identifies when a Firewall Policy is Modified or Deleted.↳ also matches Microsoft.Network/firewallPolicies/certificates/action, Microsoft.Network/firewallPolicies/delete, Microsoft.Network/firewallPolicies/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/firewallPolicies/ruleCollectionGroups/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a rule collection group from an Azure Firewall Policy.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Firewall Rule Configuration Modified or Deleted source medium: Identifies when a Firewall Rule Configuration is Modified or Deleted.↳ also matches Microsoft.Network/firewallPolicies/ruleCollectionGroups/write, Microsoft.Network/firewallPolicies/ruleGroups/delete, Microsoft.Network/firewallPolicies/ruleGroups/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/firewallPolicies/ruleCollectionGroups/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates a rule collection group within an Azure Firewall Policy.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Firewall Rule Configuration Modified or Deleted source medium: Identifies when a Firewall Rule Configuration is Modified or Deleted.↳ also matches Microsoft.Network/firewallPolicies/ruleCollectionGroups/delete, Microsoft.Network/firewallPolicies/ruleGroups/delete, Microsoft.Network/firewallPolicies/ruleGroups/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/firewallPolicies/ruleGroups/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a legacy rule group from an Azure Firewall Policy.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Firewall Rule Configuration Modified or Deleted source medium: Identifies when a Firewall Rule Configuration is Modified or Deleted.↳ also matches Microsoft.Network/firewallPolicies/ruleCollectionGroups/delete, Microsoft.Network/firewallPolicies/ruleCollectionGroups/write, Microsoft.Network/firewallPolicies/ruleGroups/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/firewallPolicies/ruleGroups/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates a legacy rule group in an Azure Firewall Policy.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Firewall Rule Configuration Modified or Deleted source medium: Identifies when a Firewall Rule Configuration is Modified or Deleted.↳ also matches Microsoft.Network/firewallPolicies/ruleCollectionGroups/delete, Microsoft.Network/firewallPolicies/ruleCollectionGroups/write, Microsoft.Network/firewallPolicies/ruleGroups/delete

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/firewallPolicies/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates an Azure Firewall Policy, defining the rule set attached to one or more firewalls.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`operationName`	eq	`MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE`	1 rule	panther, sigma

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Network Firewall Policy Modified or Deleted source medium: Identifies when a Firewall Policy is Modified or Deleted.↳ also matches Microsoft.Network/firewallPolicies/certificates/action, Microsoft.Network/firewallPolicies/delete, Microsoft.Network/firewallPolicies/join/action

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/frontDoorWebApplicationFirewallPolicies/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a Front Door WAF policy.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`event.outcome`	in	`Success`	1 rule	elastic
`event.outcome`	in	`success`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Elastic #

Azure VNet Firewall Front Door WAF Policy Deleted source low: Identifies the deletion of a Frontdoor Web Application Firewall (WAF) Policy in Azure. An adversary may delete a Frontdoor Web Application Firewall (WAF) Policy in an attempt to evade defenses and/or to eliminate barriers to their objective.

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkInterfaces/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a network interface card.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Virtual Network Device Modified or Deleted source medium: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.↳ also matches Microsoft.Network/networkInterfaces/join/action, Microsoft.Network/networkInterfaces/tapConfigurations/delete, Microsoft.Network/networkInterfaces/tapConfigurations/write, Microsoft.Network/networkInterfaces/write, Microsoft.Network/networkVirtualAppliances/delete, Microsoft.Network/networkVirtualAppliances/write, Microsoft.Network/virtualHubs/delete, Microsoft.Network/virtualHubs/write, Microsoft.Network/virtualRouters/delete, Microsoft.Network/virtualRouters/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkInterfaces/join/action

Resource provider: Azure-Microsoft.Network

Description

Joins a network interface to a virtual machine.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Virtual Network Device Modified or Deleted source medium: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.↳ also matches Microsoft.Network/networkInterfaces/delete, Microsoft.Network/networkInterfaces/tapConfigurations/delete, Microsoft.Network/networkInterfaces/tapConfigurations/write, Microsoft.Network/networkInterfaces/write, Microsoft.Network/networkVirtualAppliances/delete, Microsoft.Network/networkVirtualAppliances/write, Microsoft.Network/virtualHubs/delete, Microsoft.Network/virtualHubs/write, Microsoft.Network/virtualRouters/delete, Microsoft.Network/virtualRouters/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkInterfaces/tapConfigurations/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a TAP configuration from a network interface (removes traffic mirroring).

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Virtual Network Device Modified or Deleted source medium: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.↳ also matches Microsoft.Network/networkInterfaces/delete, Microsoft.Network/networkInterfaces/join/action, Microsoft.Network/networkInterfaces/tapConfigurations/write, Microsoft.Network/networkInterfaces/write, Microsoft.Network/networkVirtualAppliances/delete, Microsoft.Network/networkVirtualAppliances/write, Microsoft.Network/virtualHubs/delete, Microsoft.Network/virtualHubs/write, Microsoft.Network/virtualRouters/delete, Microsoft.Network/virtualRouters/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkInterfaces/tapConfigurations/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates a TAP configuration on a network interface, enabling traffic mirroring to a collector.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Virtual Network Device Modified or Deleted source medium: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.↳ also matches Microsoft.Network/networkInterfaces/delete, Microsoft.Network/networkInterfaces/join/action, Microsoft.Network/networkInterfaces/tapConfigurations/delete, Microsoft.Network/networkInterfaces/write, Microsoft.Network/networkVirtualAppliances/delete, Microsoft.Network/networkVirtualAppliances/write, Microsoft.Network/virtualHubs/delete, Microsoft.Network/virtualHubs/write, Microsoft.Network/virtualRouters/delete, Microsoft.Network/virtualRouters/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkInterfaces/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates a network interface card.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Virtual Network Device Modified or Deleted source medium: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.↳ also matches Microsoft.Network/networkInterfaces/delete, Microsoft.Network/networkInterfaces/join/action, Microsoft.Network/networkInterfaces/tapConfigurations/delete, Microsoft.Network/networkInterfaces/tapConfigurations/write, Microsoft.Network/networkVirtualAppliances/delete, Microsoft.Network/networkVirtualAppliances/write, Microsoft.Network/virtualHubs/delete, Microsoft.Network/virtualHubs/write, Microsoft.Network/virtualRouters/delete, Microsoft.Network/virtualRouters/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkSecurityGroups/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a Network Security Group.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`operationName`	eq	`MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE`	1 rule	sigma

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Network Security Configuration Modified or Deleted source medium: Identifies when a network security configuration is modified or deleted.↳ also matches Microsoft.Network/networkSecurityGroups/join/action, Microsoft.Network/networkSecurityGroups/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/networkSecurityGroups/securityRules/delete, Microsoft.Network/networkSecurityGroups/securityRules/write, Microsoft.Network/networkSecurityGroups/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkSecurityGroups/join/action

Resource provider: Azure-Microsoft.Network

Description

Associates a Network Security Group with a subnet or network interface.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`operationName`	eq	`MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE`	1 rule	sigma

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Network Security Configuration Modified or Deleted source medium: Identifies when a network security configuration is modified or deleted.↳ also matches Microsoft.Network/networkSecurityGroups/delete, Microsoft.Network/networkSecurityGroups/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/networkSecurityGroups/securityRules/delete, Microsoft.Network/networkSecurityGroups/securityRules/write, Microsoft.Network/networkSecurityGroups/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkSecurityGroups/providers/Microsoft.Insights/diagnosticSettings/write

Resource provider: Azure-Microsoft.Network

Description

Configures diagnostic settings on a Network Security Group to forward flow logs to a Log Analytics workspace or storage account.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`operationName`	eq	`MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE`	1 rule	sigma

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Network Security Configuration Modified or Deleted source medium: Identifies when a network security configuration is modified or deleted.↳ also matches Microsoft.Network/networkSecurityGroups/delete, Microsoft.Network/networkSecurityGroups/join/action, Microsoft.Network/networkSecurityGroups/securityRules/delete, Microsoft.Network/networkSecurityGroups/securityRules/write, Microsoft.Network/networkSecurityGroups/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkSecurityGroups/securityRules/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a security rule from a Network Security Group, potentially removing a network access control.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`operationName`	eq	`MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE`	1 rule	sigma

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Network Security Configuration Modified or Deleted source medium: Identifies when a network security configuration is modified or deleted.↳ also matches Microsoft.Network/networkSecurityGroups/delete, Microsoft.Network/networkSecurityGroups/join/action, Microsoft.Network/networkSecurityGroups/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/networkSecurityGroups/securityRules/write, Microsoft.Network/networkSecurityGroups/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkSecurityGroups/securityRules/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates a security rule in a Network Security Group, controlling inbound or outbound traffic.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`operationName`	eq	`MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE`	2 rules	sigma
`properties.statusCode`	eq	`Created`	1 rule	sigma

Detection Rules #

View all rules referencing this event →

Sigma #

Network Security Group Rule Created source informational: Creates a network security group rule.
Azure Network Security Configuration Modified or Deleted source medium: Identifies when a network security configuration is modified or deleted.↳ also matches Microsoft.Network/networkSecurityGroups/delete, Microsoft.Network/networkSecurityGroups/join/action, Microsoft.Network/networkSecurityGroups/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/networkSecurityGroups/securityRules/delete, Microsoft.Network/networkSecurityGroups/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkSecurityGroups/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates a Network Security Group, which contains security rules governing traffic to associated subnets and NICs.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActivityStatusValue`	eq	`Success`	1 rule	kusto
`count_`	ge	`5`	1 rule	kusto
`operationName`	eq	`MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE`	1 rule	sigma

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Network Security Configuration Modified or Deleted source medium: Identifies when a network security configuration is modified or deleted.↳ also matches Microsoft.Network/networkSecurityGroups/delete, Microsoft.Network/networkSecurityGroups/join/action, Microsoft.Network/networkSecurityGroups/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/networkSecurityGroups/securityRules/delete, Microsoft.Network/networkSecurityGroups/securityRules/write

Kusto #

Rare subscription-level operations in Azure source low: This query looks for a few sensitive subscription-level events based on Azure Activity Logs. For example, this monitors for the operation name 'Create or Update Snapshot', which is used for creating backups but could be misused by attackers to dump hashes or extract sensitive information from the disk.

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkVirtualAppliances/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a Network Virtual Appliance resource.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Virtual Network Device Modified or Deleted source medium: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.↳ also matches Microsoft.Network/networkInterfaces/delete, Microsoft.Network/networkInterfaces/join/action, Microsoft.Network/networkInterfaces/tapConfigurations/delete, Microsoft.Network/networkInterfaces/tapConfigurations/write, Microsoft.Network/networkInterfaces/write, Microsoft.Network/networkVirtualAppliances/write, Microsoft.Network/virtualHubs/delete, Microsoft.Network/virtualHubs/write, Microsoft.Network/virtualRouters/delete, Microsoft.Network/virtualRouters/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkVirtualAppliances/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates a Network Virtual Appliance.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Virtual Network Device Modified or Deleted source medium: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.↳ also matches Microsoft.Network/networkInterfaces/delete, Microsoft.Network/networkInterfaces/join/action, Microsoft.Network/networkInterfaces/tapConfigurations/delete, Microsoft.Network/networkInterfaces/tapConfigurations/write, Microsoft.Network/networkInterfaces/write, Microsoft.Network/networkVirtualAppliances/delete, Microsoft.Network/virtualHubs/delete, Microsoft.Network/virtualHubs/write, Microsoft.Network/virtualRouters/delete, Microsoft.Network/virtualRouters/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/networkWatchers/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a Network Watcher instance, disabling network diagnostics and flow log capture for a region.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Elastic #

Azure VNet Network Watcher Deleted source medium: Identifies the deletion of a Network Watcher in Azure. Network Watchers are used to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. An adversary may delete a Network Watcher in an attempt to evade defenses.

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/p2sVpnGateways/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a Point-to-Site VPN gateway.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Point-to-site VPN Modified or Deleted source medium: Identifies when a Point-to-site VPN is Modified or Deleted.↳ also matches Microsoft.Network/p2sVpnGateways/disconnectP2sVpnConnections/action, Microsoft.Network/p2sVpnGateways/generateVpnProfile/action, Microsoft.Network/p2sVpnGateways/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/p2sVpnGateways/reset/action, Microsoft.Network/p2sVpnGateways/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/p2sVpnGateways/disconnectP2sVpnConnections/action

Resource provider: Azure-Microsoft.Network

Description

Disconnects active Point-to-Site VPN client connections from a gateway.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Point-to-site VPN Modified or Deleted source medium: Identifies when a Point-to-site VPN is Modified or Deleted.↳ also matches Microsoft.Network/p2sVpnGateways/delete, Microsoft.Network/p2sVpnGateways/generateVpnProfile/action, Microsoft.Network/p2sVpnGateways/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/p2sVpnGateways/reset/action, Microsoft.Network/p2sVpnGateways/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/p2sVpnGateways/generateVpnProfile/action

Resource provider: Azure-Microsoft.Network

Description

Generates a VPN client profile package for a Point-to-Site VPN gateway.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Point-to-site VPN Modified or Deleted source medium: Identifies when a Point-to-site VPN is Modified or Deleted.↳ also matches Microsoft.Network/p2sVpnGateways/delete, Microsoft.Network/p2sVpnGateways/disconnectP2sVpnConnections/action, Microsoft.Network/p2sVpnGateways/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/p2sVpnGateways/reset/action, Microsoft.Network/p2sVpnGateways/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/p2sVpnGateways/providers/Microsoft.Insights/diagnosticSettings/write

Resource provider: Azure-Microsoft.Network

Description

Configures diagnostic settings on a P2S VPN gateway to forward logs to a Log Analytics workspace or storage account.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Point-to-site VPN Modified or Deleted source medium: Identifies when a Point-to-site VPN is Modified or Deleted.↳ also matches Microsoft.Network/p2sVpnGateways/delete, Microsoft.Network/p2sVpnGateways/disconnectP2sVpnConnections/action, Microsoft.Network/p2sVpnGateways/generateVpnProfile/action, Microsoft.Network/p2sVpnGateways/reset/action, Microsoft.Network/p2sVpnGateways/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/p2sVpnGateways/reset/action

Resource provider: Azure-Microsoft.Network

Description

Resets a Point-to-Site VPN gateway.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Point-to-site VPN Modified or Deleted source medium: Identifies when a Point-to-site VPN is Modified or Deleted.↳ also matches Microsoft.Network/p2sVpnGateways/delete, Microsoft.Network/p2sVpnGateways/disconnectP2sVpnConnections/action, Microsoft.Network/p2sVpnGateways/generateVpnProfile/action, Microsoft.Network/p2sVpnGateways/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/p2sVpnGateways/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/p2sVpnGateways/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates a Point-to-Site VPN gateway.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Point-to-site VPN Modified or Deleted source medium: Identifies when a Point-to-site VPN is Modified or Deleted.↳ also matches Microsoft.Network/p2sVpnGateways/delete, Microsoft.Network/p2sVpnGateways/disconnectP2sVpnConnections/action, Microsoft.Network/p2sVpnGateways/generateVpnProfile/action, Microsoft.Network/p2sVpnGateways/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/p2sVpnGateways/reset/action

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/virtualHubs/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a Virtual WAN hub.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Virtual Network Device Modified or Deleted source medium: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.↳ also matches Microsoft.Network/networkInterfaces/delete, Microsoft.Network/networkInterfaces/join/action, Microsoft.Network/networkInterfaces/tapConfigurations/delete, Microsoft.Network/networkInterfaces/tapConfigurations/write, Microsoft.Network/networkInterfaces/write, Microsoft.Network/networkVirtualAppliances/delete, Microsoft.Network/networkVirtualAppliances/write, Microsoft.Network/virtualHubs/write, Microsoft.Network/virtualRouters/delete, Microsoft.Network/virtualRouters/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/virtualHubs/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates a Virtual WAN hub.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Virtual Network Device Modified or Deleted source medium: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.↳ also matches Microsoft.Network/networkInterfaces/delete, Microsoft.Network/networkInterfaces/join/action, Microsoft.Network/networkInterfaces/tapConfigurations/delete, Microsoft.Network/networkInterfaces/tapConfigurations/write, Microsoft.Network/networkInterfaces/write, Microsoft.Network/networkVirtualAppliances/delete, Microsoft.Network/networkVirtualAppliances/write, Microsoft.Network/virtualHubs/delete, Microsoft.Network/virtualRouters/delete, Microsoft.Network/virtualRouters/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/virtualRouters/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a Virtual Router resource.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Virtual Network Device Modified or Deleted source medium: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.↳ also matches Microsoft.Network/networkInterfaces/delete, Microsoft.Network/networkInterfaces/join/action, Microsoft.Network/networkInterfaces/tapConfigurations/delete, Microsoft.Network/networkInterfaces/tapConfigurations/write, Microsoft.Network/networkInterfaces/write, Microsoft.Network/networkVirtualAppliances/delete, Microsoft.Network/networkVirtualAppliances/write, Microsoft.Network/virtualHubs/delete, Microsoft.Network/virtualHubs/write, Microsoft.Network/virtualRouters/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/virtualRouters/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates a Virtual Router resource.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure Virtual Network Device Modified or Deleted source medium: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.↳ also matches Microsoft.Network/networkInterfaces/delete, Microsoft.Network/networkInterfaces/join/action, Microsoft.Network/networkInterfaces/tapConfigurations/delete, Microsoft.Network/networkInterfaces/tapConfigurations/write, Microsoft.Network/networkInterfaces/write, Microsoft.Network/networkVirtualAppliances/delete, Microsoft.Network/networkVirtualAppliances/write, Microsoft.Network/virtualHubs/delete, Microsoft.Network/virtualHubs/write, Microsoft.Network/virtualRouters/delete

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/vpnGateways/vpnConnections/delete

Resource provider: Azure-Microsoft.Network

Description

Deletes a VPN connection from a Virtual WAN VPN gateway.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure VPN Connection Modified or Deleted source medium: Identifies when a VPN connection is modified or deleted.↳ also matches Microsoft.Network/vpnGateways/vpnConnections/write

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

Microsoft.Network/vpnGateways/vpnConnections/write

Resource provider: Azure-Microsoft.Network

Description

Creates or updates a VPN connection on a Virtual WAN VPN gateway.

Fields #

Name	Description
`OperationName`	Localized display name of the ARM operation. Sentinel also exposes OperationNameValue (the uppercase ARM operation string the catalog keys on).
`OperationNameValue`	The ARM operation string (e.g. MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE). The per-event discriminator; case-insensitive.
`ResourceProvider`	The Azure resource-provider namespace (e.g. Microsoft.Compute).
`ResourceId`	Full ARM resource id the operation acted on.
`Caller`	Identity that initiated the operation (UPN, object id, or service principal).
`CallerIpAddress`	IP address of the caller.
`ActivityStatusValue`	Operation status (Started, Succeeded, Failed, Accepted).
`Level`	Severity level of the activity record (Informational, Warning, Error, Critical).
`Authorization`	RBAC authorization context: the action evaluated, scope, and role assignment.
`Properties`	Operation-specific properties bag; shape varies by operation.
`SubscriptionId`	GUID of the subscription the resource belongs to.
`TimeGenerated`	UTC timestamp when the event was recorded.

Detection Rules #

View all rules referencing this event →

Sigma #

Azure VPN Connection Modified or Deleted source medium: Identifies when a VPN connection is modified or deleted.↳ also matches Microsoft.Network/vpnGateways/vpnConnections/delete

References #

Azure resource provider operations reference https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Azure Monitor AzureActivity table schema https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/azureactivity

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)