services / Azure / Microsoft Sentinel data connector

A Microsoft Sentinel data connector that ingests telemetry from a source (Azure services, endpoints, third-party products) into the workspace, feeding all downstream detection.

Connectors are the telemetry supply for the whole SIEM; cutting one stops the logs that every detection depends on, so the resource type is HIGH.

Microsoft.​SecurityInsights/​dataConnectors/​write

Reconfiguring or disabling a data connector halts the telemetry feeding the workspace, so security logs stop arriving and every detection built on that source goes dark.

Risks

1. Defense destruction (EVASION)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links