services / Azure / Log Analytics data source

A data source configuration under a workspace that defines what telemetry (event logs, performance counters, syslog, etc.) agents collect and forward into the workspace.

Data sources govern what telemetry is collected, so altering or removing them stops new security logs from arriving; HIGH.

Microsoft.​OperationalInsights/​workspaces/​datasources/​delete

Removing a data source halts collection of that telemetry, so subsequent activity in its scope goes unlogged.

Risks

1. Defense destruction (EVASION)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links