services / Azure / Log Analytics scheduled search action

An action attached to a scheduled saved search that fires when the alert triggers, such as sending a notification or invoking a webhook.

Actions are how a triggered alert reaches responders; removing or altering them silences the response even when the detection fires; HIGH.

Microsoft.​OperationalInsights/​workspaces/​savedSearches/​schedules/​actions/​delete

Deleting an alert action leaves the detection firing silently with no notification or response.

Risks

1. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links