services / Azure / Log Analytics scheduled search action

An action attached to a scheduled saved search that fires when the alert triggers, such as sending a notification or invoking a webhook.

Actions are how a triggered alert reaches responders; removing or altering them silences the response even when the detection fires; HIGH.

Microsoft.​OperationalInsights/​workspaces/​savedSearches/​schedules/​actions/​write

Rewriting an alert action can redirect or disable the notification/webhook, so a triggered detection never reaches responders.

Risks

1. Data manipulation (HIGH)
2. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links