services / Azure / Microsoft Sentinel automation rule

A Microsoft Sentinel automation rule that orchestrates incident handling, applying conditions to run playbooks, assign owners, change status, or suppress incidents automatically.

Automation rules govern the SOAR response layer; tampering with them can disable auto-response or redirect it to attacker automation, so the resource type is HIGH.

Microsoft.​SecurityInsights/​automationRules/​delete

Deleting an automation rule removes the automated incident-response orchestration it provided, so triggered incidents no longer drive a reaction.

Risks

1. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links