services / Azure / Log Analytics saved search

A saved search query in a workspace; when paired with a schedule it forms a Log Analytics alert rule that drives detections.

Saved searches back scheduled alert rules, so tampering with or removing them degrades detection logic; HIGH.

Microsoft.​OperationalInsights/​workspaces/​savedSearches/​write

Rewriting a saved search can neuter the detection query behind an alert rule so malicious activity no longer matches.

Risks

1. Data manipulation (HIGH)
2. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links