Azureactivity Snapshot Of Monitored Azure Resource

KQL detection rule by ep3p · MIT

No description provided

let _MonitoredResources =
    _GetWatchlist("ResourceId-AuditAzureResources")
    | where Notes has "[Snapshot]"
    | project ResourceId, SubscriptionId, ResourceGroup, Resource
;
AzureActivity
| where OperationNameValue has_any ("/snapshots/beginGetAccess", "/snapshots/write") // "/snapshots/delete", "/snapshots/endGetAccess"
| where _ResourceId has_any (toscalar(_MonitoredResources | where isempty(Resource) | summarize make_list(ResourceId)))
    or _ResourceId has_any (toscalar(_MonitoredResources | where isnotempty(Resource) | extend ResourceId = replace_regex(ResourceId, @"^(.+?\/)[^\/]+(\/[^\/]+)$", @"\1snapshots\2") | summarize make_list(ResourceId)))
| extend PreferenceInteger = iff(ResourceProviderValue == toupper(ResourceProviderValue), 0, 1)
// Group together Start, Accept, Success... operations
| summarize hint.shufflekey=CorrelationId
    StartTime = min(TimeGenerated),
    EndTime = max(TimeGenerated),
    PropertiesDynamic = make_bag(pack(ActivityStatusValue, iff(PreferenceInteger == 1, todynamic(Properties), Properties_d))),
    EventDataId = array_sort_asc(make_list(EventDataId)),
    arg_max(TimeGenerated, *)
    by CorrelationId, ResourceProviderValue, OperationNameValue, _ResourceId
// Group together two kinds of logs (where ResourceProviderValue is all caps or title - e.g. MICROSOFT.AUTHORIZATION or Microsoft.Authorization)
| summarize hint.shufflekey=CorrelationId
    TimeGenerated = max(TimeGenerated),
    StartTime = min(StartTime),
    EndTime = max(EndTime),
    PropertiesDynamic = make_bag(pack(ResourceProviderValue, PropertiesDynamic)),
    EventDataId = make_bag(pack(ResourceProviderValue, EventDataId)),
    take_any(TenantId, SourceSystem, CategoryValue, SubscriptionId, Type),
    arg_min(PreferenceInteger, CallerIpAddress, Authorization, Authorization_d, Claims_d, Properties_d, EventSubmissionTimestamp, Hierarchy),
    arg_max(PreferenceInteger, Level, OperationNameValue, Caller, HTTPRequest, OperationId, ResourceGroup, ResourceProviderValue, ActivityStatusValue, ActivitySubstatusValue, OperationName, ActivityStatus, ActivitySubstatus, Category, ResourceId, ResourceProvider, Resource)
    by CorrelationId, _ResourceId
| project
    TimeGenerated,
    StartTime,
    EndTime,
    ResourceProvider,
    Category,
    CategoryValue,
    ResourceProviderValue,
    Level,
    CallerIpAddress,
    Caller,
    OperationName,
    OperationNameValue,
    ActivityStatusValue,
    //ActivityStatus,
    ActivitySubstatusValue,
    ActivitySubstatus,
    SubscriptionId,
    ResourceGroup,
    Resource,
    ResourceId,
    _ResourceId,
    Authorization,
    PropertiesDynamic,
    HTTPRequest,
    Authorization_d,
    Properties_d,
    Claims_d,
    Hierarchy,
    OperationId,
    CorrelationId,
    EventSubmissionTimestamp,
    EventDataId,
    Type

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

57bdc76f-b4c4-4e47-ac04-fd2ddb76eaa7

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion