services / Azure / Log Analytics table data deletion

Deletes data from a table in a Log Analytics workspace.

Table-granular deletion of log records is the same anti-forensics class as workspace purge, applied to a single evidence stream; HIGH.

Microsoft.​OperationalInsights/​workspaces/​tables/​deleteData/​action

Deletes log records from a table, erasing specific evidence and defeating the detections that read from it.

Risks

1. Defense destruction (EVASION)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links