services / Azure / Log Analytics workspace diagnostic setting

The diagnostic setting on the workspace itself, controlling whether the workspace's own resource logs and metrics (including audit events) are emitted.

This governs the workspace's self-telemetry, including its own audit trail; disabling it hides administrative actions taken against the log store; HIGH.

Microsoft.​OperationalInsights/​workspaces/​providers/​Microsoft.​Insights/​diagnosticSettings/​Write

Overwriting the workspace's diagnostic setting can disable its own diagnostic/audit logging, hiding the attacker's actions against the log store itself.

Risks

1. Defense destruction (EVASION)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links