services / Azure / Log Analytics table

A table within a Log Analytics workspace that stores a specific stream of log records; tables define schema, retention, and ingestion for their data.

A table holds a distinct class of security log evidence and controls its retention, so tampering with or dropping it removes specific detection data; HIGH.

Microsoft.​OperationalInsights/​workspaces/​tables/​write

Updating a table can cut its retention or alter its schema, silently dropping or truncating the log evidence it stores.

Risks

1. Data manipulation (HIGH)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links