services / Azure / Microsoft Sentinel case (legacy incident)

A legacy Microsoft Sentinel case, the predecessor to incidents, holding aggregated alerts and investigation/response state.

Cases are the legacy investigation and response record; deleting or tampering with them destroys the attack audit trail, mirroring incidents, so the resource type is HIGH.

Microsoft.​SecurityInsights/​cases/​delete

Deleting a case destroys the legacy investigation and response record, erasing the audit trail it documented.

Risks

1. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links