services / Azure / Microsoft Sentinel automation rule

A Microsoft Sentinel automation rule that orchestrates incident handling, applying conditions to run playbooks, assign owners, change status, or suppress incidents automatically.

Automation rules govern the SOAR response layer; tampering with them can disable auto-response or redirect it to attacker automation, so the resource type is HIGH.

Microsoft.​SecurityInsights/​automationRules/​write

Updating an automation rule can disable automated response or auto-close incoming incidents (defeating response), and can point the rule at an attacker-chosen playbook that then runs under its managed identity.

Risks

1. Lateral movement (BOOST)
2. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links