Detection rules › By event

Azure-Microsoft.Automation

Event	Rules
Microsoft.Automation/automationAccounts/jobs/write	1
Microsoft.Automation/automationAccounts/runbooks/delete	2
Microsoft.Automation/automationAccounts/runbooks/draft/write	2
Microsoft.Automation/automationAccounts/runbooks/publish/action	2
Microsoft.Automation/automationAccounts/runbooks/write	3
Microsoft.Automation/automationAccounts/schedules/write	1
Microsoft.Automation/automationAccounts/webhooks/action	2
Microsoft.Automation/automationAccounts/webhooks/write	3
Microsoft.Automation/automationAccounts/write	3

Microsoft.Automation/automationAccounts/jobs/write

1 detection rules reference this event. View event page.

Panther (1)

Azure Serverless Script Execution severity informational T1059, T1651

Microsoft.Automation/automationAccounts/runbooks/delete

2 detection rules reference this event. View event page.

Elastic (1)

Azure Automation Runbook Deleted severity low T1485

Panther (1)

Azure Automation Runbook Deleted severity informational T1070

Microsoft.Automation/automationAccounts/runbooks/draft/write

2 detection rules reference this event. View event page.

Elastic (1)

Azure Automation Runbook Created or Modified severity low T1053, T1648

Panther (1)

Azure Automation Runbook Created or Modified severity informational T1059, T1078.004

Microsoft.Automation/automationAccounts/runbooks/publish/action

2 detection rules reference this event. View event page.

Elastic (1)

Azure Automation Runbook Created or Modified severity low T1053, T1648

Panther (1)

Azure Automation Runbook Created or Modified severity informational T1059, T1078.004

Microsoft.Automation/automationAccounts/runbooks/write

3 detection rules reference this event. View event page.

Elastic (1)

Azure Automation Runbook Created or Modified severity low T1053, T1648

Splunk (1)

Azure Automation Runbook Created severity medium T1136, T1136.003

Panther (1)

Azure Automation Runbook Created or Modified severity informational T1059, T1078.004

Microsoft.Automation/automationAccounts/schedules/write

1 detection rules reference this event. View event page.

Panther (1)

Azure Automation Schedule Created or Modified severity informational T1053.005, T1068

Microsoft.Automation/automationAccounts/webhooks/action

2 detection rules reference this event. View event page.

Elastic (1)

Azure Automation Webhook Created severity low T1546, T1608

Panther (1)

Azure Automation Webhook Created severity informational T1546, T1608

Microsoft.Automation/automationAccounts/webhooks/write

3 detection rules reference this event. View event page.

Elastic (1)

Azure Automation Webhook Created severity low T1546, T1608

Splunk (1)

Azure Runbook Webhook Created severity medium T1078, T1078.004

Panther (1)

Azure Automation Webhook Created severity informational T1546, T1608

Microsoft.Automation/automationAccounts/write

3 detection rules reference this event. View event page.

Elastic (1)

Azure Automation Account Created severity low T1078

Splunk (1)

Azure Automation Account Created severity medium T1136, T1136.003

Panther (1)

Azure Automation Account Created severity informational T1078