services / Azure / Log Analytics data source

A data source configuration under a workspace that defines what telemetry (event logs, performance counters, syslog, etc.) agents collect and forward into the workspace.

Data sources govern what telemetry is collected, so altering or removing them stops new security logs from arriving; HIGH.

Microsoft.​OperationalInsights/​workspaces/​datasources/​write

Reconfiguring a data source can narrow or suppress the telemetry collected, silently creating blind spots in future logging.

Risks

1. Defense destruction (EVASION)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links