services / Azure / Log Analytics data export

A data export rule that continuously ships ingested log data from selected tables to a destination such as a storage account or Event Hub.

An export rule streams a live copy of ingested logs to an external destination; it can be abused to exfiltrate all telemetry or, when removed, to cut a downstream SIEM feed; HIGH.

Microsoft.​OperationalInsights/​workspaces/​dataexports/​delete

Deleting an export rule cuts the downstream feed (e.g. to an external SIEM or archive), blinding detections and long-term retention that depend on it.

Risks

1. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links