Detection rules › By event

Azure-Microsoft.Network

Event	Rules
Microsoft.Network/applicationGateways/delete	1
Microsoft.Network/applicationGateways/write	1
Microsoft.Network/applicationSecurityGroups/delete	1
Microsoft.Network/applicationSecurityGroups/write	1
Microsoft.Network/azureFirewalls/applicationRuleCollections/delete	1
Microsoft.Network/azureFirewalls/applicationRuleCollections/write	1
Microsoft.Network/azurefirewalls/delete	1
Microsoft.Network/azureFirewalls/natRuleCollections/delete	1
Microsoft.Network/azureFirewalls/natRuleCollections/write	1
Microsoft.Network/azureFirewalls/networkRuleCollections/delete	1
Microsoft.Network/azureFirewalls/networkRuleCollections/write	1
Microsoft.Network/azurefirewalls/write	1
Microsoft.Network/firewallPolicies/certificates/action	1
Microsoft.Network/firewallPolicies/delete	3
Microsoft.Network/firewallPolicies/join/action	1
Microsoft.Network/firewallPolicies/ruleCollectionGroups/delete	1
Microsoft.Network/firewallPolicies/ruleCollectionGroups/write	1
Microsoft.Network/firewallPolicies/ruleGroups/delete	1
Microsoft.Network/firewallPolicies/ruleGroups/write	1
Microsoft.Network/firewallPolicies/write	1
Microsoft.Network/frontDoorWebApplicationFirewallPolicies/delete	1
Microsoft.Network/networkInterfaces/delete	1
Microsoft.Network/networkInterfaces/join/action	1
Microsoft.Network/networkInterfaces/tapConfigurations/delete	1
Microsoft.Network/networkInterfaces/tapConfigurations/write	1
Microsoft.Network/networkInterfaces/write	1
Microsoft.Network/networkSecurityGroups/delete	2
Microsoft.Network/networkSecurityGroups/join/action	2
Microsoft.Network/networksecuritygroups/providers/Microsoft.Insights/diagnosticSettings/write	2
Microsoft.Network/networkSecurityGroups/securityRules/delete	2
Microsoft.Network/networkSecurityGroups/securityRules/write	3
Microsoft.Network/networkSecurityGroups/write	4
Microsoft.Network/networkVirtualAppliances/delete	1
Microsoft.Network/networkVirtualAppliances/write	1
Microsoft.Network/networkWatchers/delete	2
Microsoft.Network/p2sVpnGateways/delete	1
Microsoft.Network/p2sVpnGateways/disconnectp2svpnconnections/action	1
Microsoft.Network/p2sVpnGateways/generatevpnprofile/action	1
Microsoft.Network/p2sVpnGateways/providers/Microsoft.Insights/diagnosticSettings/write	1
microsoft.network/p2sVpnGateways/reset/action	1
Microsoft.Network/p2sVpnGateways/write	1
Microsoft.Network/publicIPAddresses/write	1
Microsoft.Network/virtualHubs/delete	1
Microsoft.Network/virtualHubs/write	1
Microsoft.Network/virtualNetworks/delete	1
Microsoft.Network/virtualRouters/delete	1
Microsoft.Network/virtualRouters/write	1
microsoft.network/vpnGateways/vpnConnections/delete	1
microsoft.network/vpnGateways/vpnConnections/write	1

Microsoft.Network/applicationGateways/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Application Gateway Modified or Deleted severity medium

Microsoft.Network/applicationGateways/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Application Gateway Modified or Deleted severity medium

Microsoft.Network/applicationSecurityGroups/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Application Security Group Modified or Deleted severity medium

Microsoft.Network/applicationSecurityGroups/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Application Security Group Modified or Deleted severity medium

Microsoft.Network/azureFirewalls/applicationRuleCollections/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Firewall Rule Collection Modified or Deleted severity medium T1686, T1686.001

Microsoft.Network/azureFirewalls/applicationRuleCollections/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Firewall Rule Collection Modified or Deleted severity medium T1686, T1686.001

Microsoft.Network/azurefirewalls/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Firewall Modified or Deleted severity medium T1686, T1686.001

Microsoft.Network/azureFirewalls/natRuleCollections/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Firewall Rule Collection Modified or Deleted severity medium T1686, T1686.001

Microsoft.Network/azureFirewalls/natRuleCollections/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Firewall Rule Collection Modified or Deleted severity medium T1686, T1686.001

Microsoft.Network/azureFirewalls/networkRuleCollections/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Firewall Rule Collection Modified or Deleted severity medium T1686, T1686.001

Microsoft.Network/azureFirewalls/networkRuleCollections/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Firewall Rule Collection Modified or Deleted severity medium T1686, T1686.001

Microsoft.Network/azurefirewalls/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Firewall Modified or Deleted severity medium T1686, T1686.001

Microsoft.Network/firewallPolicies/certificates/action

1 detection rules reference this event. View event page.

Sigma (1)

Azure Network Firewall Policy Modified or Deleted severity medium T1686, T1686.001

Microsoft.Network/firewallPolicies/delete

3 detection rules reference this event. View event page.

Sigma (1)

Azure Network Firewall Policy Modified or Deleted severity medium T1686, T1686.001

Elastic (1)

Azure VNet Firewall Policy Deleted severity low T1685, T1686.001

Panther (1)

Azure Firewall Policy Deleted severity high T1686

Microsoft.Network/firewallPolicies/join/action

1 detection rules reference this event. View event page.

Sigma (1)

Azure Network Firewall Policy Modified or Deleted severity medium T1686, T1686.001

Microsoft.Network/firewallPolicies/ruleCollectionGroups/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Firewall Rule Configuration Modified or Deleted severity medium

Microsoft.Network/firewallPolicies/ruleCollectionGroups/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Firewall Rule Configuration Modified or Deleted severity medium

Microsoft.Network/firewallPolicies/ruleGroups/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Firewall Rule Configuration Modified or Deleted severity medium

Microsoft.Network/firewallPolicies/ruleGroups/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Firewall Rule Configuration Modified or Deleted severity medium

Microsoft.Network/firewallPolicies/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Network Firewall Policy Modified or Deleted severity medium T1686, T1686.001

Microsoft.Network/frontDoorWebApplicationFirewallPolicies/delete

1 detection rules reference this event. View event page.

Elastic (1)

Azure VNet Firewall Front Door WAF Policy Deleted severity low T1685, T1686.001

Microsoft.Network/networkInterfaces/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Virtual Network Device Modified or Deleted severity medium

Microsoft.Network/networkInterfaces/join/action

1 detection rules reference this event. View event page.

Sigma (1)

Azure Virtual Network Device Modified or Deleted severity medium

Microsoft.Network/networkInterfaces/tapConfigurations/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Virtual Network Device Modified or Deleted severity medium

Microsoft.Network/networkInterfaces/tapConfigurations/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Virtual Network Device Modified or Deleted severity medium

Microsoft.Network/networkInterfaces/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Virtual Network Device Modified or Deleted severity medium

Microsoft.Network/networkSecurityGroups/delete

2 detection rules reference this event. View event page.

Sigma (1)

Azure Network Security Configuration Modified or Deleted severity medium

Panther (1)

Azure Network Security Configuration Modified or Deleted severity medium T1485, T1686.001

Microsoft.Network/networkSecurityGroups/join/action

2 detection rules reference this event. View event page.

Sigma (1)

Azure Network Security Configuration Modified or Deleted severity medium

Panther (1)

Azure Network Security Configuration Modified or Deleted severity medium T1485, T1686.001

Microsoft.Network/networksecuritygroups/providers/Microsoft.Insights/diagnosticSettings/write

2 detection rules reference this event. View event page.

Sigma (1)

Azure Network Security Configuration Modified or Deleted severity medium

Panther (1)

Azure Network Security Configuration Modified or Deleted severity medium T1485, T1686.001

Microsoft.Network/networkSecurityGroups/securityRules/delete

2 detection rules reference this event. View event page.

Sigma (1)

Azure Network Security Configuration Modified or Deleted severity medium

Panther (1)

Azure Network Security Configuration Modified or Deleted severity medium T1485, T1686.001

Microsoft.Network/networkSecurityGroups/securityRules/write

3 detection rules reference this event. View event page.

Sigma (2)

Azure Network Security Configuration Modified or Deleted severity medium
Network Security Group Rule Created severity informational

Panther (1)

Azure Network Security Configuration Modified or Deleted severity medium T1485, T1686.001

Microsoft.Network/networkSecurityGroups/write

4 detection rules reference this event. View event page.

Sigma (2)

Azure Network Security Configuration Modified or Deleted severity medium
Rare Subscription-level Operations In Azure severity medium T1003

Kusto (1)

Rare subscription-level operations in Azure severity low T1003, T1098

Panther (1)

Azure Network Security Configuration Modified or Deleted severity medium T1485, T1686.001

Microsoft.Network/networkVirtualAppliances/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Virtual Network Device Modified or Deleted severity medium

Microsoft.Network/networkVirtualAppliances/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Virtual Network Device Modified or Deleted severity medium

Microsoft.Network/networkWatchers/delete

2 detection rules reference this event. View event page.

Elastic (1)

Azure VNet Network Watcher Deleted severity medium T1685, T1685.002

Panther (1)

Azure Network Watcher Deleted severity medium T1685

Microsoft.Network/p2sVpnGateways/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Point-to-site VPN Modified or Deleted severity medium

Microsoft.Network/p2sVpnGateways/disconnectp2svpnconnections/action

1 detection rules reference this event. View event page.

Sigma (1)

Azure Point-to-site VPN Modified or Deleted severity medium

Microsoft.Network/p2sVpnGateways/generatevpnprofile/action

1 detection rules reference this event. View event page.

Sigma (1)

Azure Point-to-site VPN Modified or Deleted severity medium

Microsoft.Network/p2sVpnGateways/providers/Microsoft.Insights/diagnosticSettings/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Point-to-site VPN Modified or Deleted severity medium

microsoft.network/p2sVpnGateways/reset/action

1 detection rules reference this event. View event page.

Sigma (1)

Azure Point-to-site VPN Modified or Deleted severity medium

Microsoft.Network/p2sVpnGateways/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Point-to-site VPN Modified or Deleted severity medium

Microsoft.Network/publicIPAddresses/write

1 detection rules reference this event. View event page.

Sigma (1)

Public IP Created severity informational

Microsoft.Network/virtualHubs/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Virtual Network Device Modified or Deleted severity medium

Microsoft.Network/virtualHubs/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Virtual Network Device Modified or Deleted severity medium

Microsoft.Network/virtualNetworks/delete

1 detection rules reference this event. View event page.

Panther (1)

Azure Virtual Network Deleted severity high T1485, T1499

Microsoft.Network/virtualRouters/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure Virtual Network Device Modified or Deleted severity medium

Microsoft.Network/virtualRouters/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure Virtual Network Device Modified or Deleted severity medium

microsoft.network/vpnGateways/vpnConnections/delete

1 detection rules reference this event. View event page.

Sigma (1)

Azure VPN Connection Modified or Deleted severity medium

microsoft.network/vpnGateways/vpnConnections/write

1 detection rules reference this event. View event page.

Sigma (1)

Azure VPN Connection Modified or Deleted severity medium