services / Azure / Microsoft Sentinel setting

A Microsoft Sentinel workspace setting toggling detection features such as UEBA, anomalies, and entity-behavior (EyesOn) capabilities.

These settings enable whole detection features; turning them off removes coverage across the workspace, so the resource type is HIGH.

Microsoft.​SecurityInsights/​settings/​write

Updating a setting lets an attacker disable detection features (UEBA, anomalies, entity behavior), removing whole classes of coverage.

Risks

1. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links