Azure Log Analytics Workspace Deleted

AnalysisType: rule
Filename: azure_log_analytics_workspace_deleted.py
RuleID: "Azure.MonitorActivity.LogAnalyticsWorkspace.Deleted"
DisplayName: "Azure Log Analytics Workspace Deleted"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Medium
Description: >
  Detects when an Azure Log Analytics Workspace is deleted.
  Deleting a Log Analytics Workspace destroys centralized logging infrastructure and is a defense evasion technique.
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.008 # Defense Evasion: Impair Defenses - Disable Cloud Logs
    - TA0040:T1485 # Impact: Data Destruction
Tags:
  - Defense Evasion
  - Impact
  - Impair Defenses
  - Disable Cloud Logs
  - Data Destruction
Runbook: |
  1. Query Azure Monitor Activity logs for all Log Analytics and monitoring operations by the callerIpAddress in the 24 hours before this alert to identify if this is part of a larger attack on monitoring infrastructure
  2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
  3. Search for other Azure monitoring resource deletions or security tool disablements from the same user or IP in the past 7 days to assess the scope of defense evasion
Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/delete-workspace?tabs=azure-portal
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Workspace Deleted
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.OperationalInsights/workspaces/myworkspace",
        "operationName": "Microsoft.OperationalInsights/workspaces/delete",
        "operationVersion": "2021-06-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Case Insensitive Match
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T11:45:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/prod-rg/providers/Microsoft.OperationalInsights/workspaces/prodworkspace",
        "operationName": "microsoft.operationalinsights/workspaces/delete",
        "operationVersion": "2021-06-01",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "f9e8d7c6-b5a4-3210-9876-fedcba098765",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T13:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.OperationalInsights/workspaces/myworkspace",
        "operationName": "Microsoft.OperationalInsights/workspaces/write",
        "operationVersion": "2021-06-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "203.0.113.75",
        "correlationId": "d4e5f6a7-b8c9-0123-def0-234567890123",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-210987654321"
      }

# ------ paired body: azure_log_analytics_workspace_deleted.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

WORKSPACE_DELETE = "MICROSOFT.OPERATIONALINSIGHTS/WORKSPACES/DELETE"


def rule(event):
    return event.get("operationName", "").upper() == WORKSPACE_DELETE and azure_activity_success(
        event
    )


def title(event):
    resource_id = event.get("resourceId", "")
    workspace = extract_resource_name_from_id(
        resource_id, "workspaces", default="<UNKNOWN_WORKSPACE>"
    )

    return f"Azure Log Analytics Workspace deleted [{workspace}]"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")

    workspace_name = extract_resource_name_from_id(resource_id, "workspaces", default="")
    if workspace_name:
        context["workspace_name"] = workspace_name

    resource_group = extract_resource_name_from_id(resource_id, "resourceGroups", default="")
    if resource_group:
        context["resource_group"] = resource_group

    return context