Azure Action Groups Deleted

AnalysisType: rule
Filename: azure_action_groups_deleted.py
RuleID: "Azure.MonitorActivity.ActionGroups.Deleted"
DisplayName: "Azure Action Groups Deleted"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Info
Description: >
  Detects when Azure action groups are deleted, which could disable alert notifications to security teams to prevent incident response.
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.008 # Defense Evasion: Impair Defenses - Disable Cloud Logs
Tags:
  - Defense Evasion
  - Impair Defenses
  - Disable Cloud Logs
Runbook: |
  1. Query Azure Monitor Activity logs for all action group and notification operations by the callerIpAddress in the 24 hours before and after this alert to identify if multiple notification channels are being deleted
  2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
  3. Search for other Azure alert rule deletions or monitoring infrastructure changes from the same user or IP in the past 7 days to assess if this is part of a defense evasion campaign
Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Action Group Deleted
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Insights/actionGroups/securityteam",
        "operationName": "Microsoft.Insights/actionGroups/delete",
        "operationVersion": "2019-06-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Case Insensitive Match
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T11:45:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/prod-rg/providers/Microsoft.Insights/actionGroups/oncallteam",
        "operationName": "microsoft.insights/actiongroups/delete",
        "operationVersion": "2019-06-01",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "f9e8d7c6-b5a4-3210-9876-fedcba098765",
        "location": "westus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T13:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Insights/actionGroups/securityteam",
        "operationName": "Microsoft.Insights/actionGroups/write",
        "operationVersion": "2019-06-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "d4e5f6a7-b8c9-0123-def0-234567890123",
        "location": "centralus",
        "tenantId": "87654321-4321-4321-4321-210987654321"
      }

# ------ paired body: azure_action_groups_deleted.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

ACTION_GROUPS_DELETE = "MICROSOFT.INSIGHTS/ACTIONGROUPS/DELETE"


def rule(event):
    return event.get(
        "operationName", ""
    ).upper() == ACTION_GROUPS_DELETE and azure_activity_success(event)


def title(event):
    resource_id = event.get("resourceId", "")

    action_group = extract_resource_name_from_id(
        resource_id, "actionGroups", default="<UNKNOWN_ACTION_GROUP>"
    )
    return f"Azure Action Group deleted [{action_group}]"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")

    action_group_name = extract_resource_name_from_id(resource_id, "actionGroups", default="")
    if action_group_name:
        context["action_group_name"] = action_group_name

    resource_group = extract_resource_name_from_id(resource_id, "resourceGroups", default="")
    if resource_group:
        context["resource_group"] = resource_group

    return context