services / Azure / Microsoft Sentinel ML analytics setting

A machine-learning analytics setting in Microsoft Sentinel that powers behavioral/anomaly detections (e.g. UEBA-driven and Fusion ML models).

ML analytics settings back the anomaly-detection layer of the SIEM; disabling or weakening them removes behavioral detection coverage, so the resource type is HIGH.

Microsoft.​SecurityInsights/​securityMLAnalyticsSettings/​delete

Deleting an ML analytics setting removes a behavioral-detection model entirely, blinding the SOC to the anomalies it covered.

Risks

1. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links