Azure Storage data protection settings disabled
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Goal
Detect when Azure Storage data protection settings such as soft delete or immutability policies are disabled or removed.
Strategy
This rule monitors Azure Storage logs for two categories of data protection removal. The first tracks the disabling of soft delete with MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/WRITE events, where @properties.requestbody.properties.deleteRetentionPolicy.enabled or @properties.requestbody.properties.containerDeleteRetentionPolicy.enabled is set to false. The second tracks the removal of immutability policies with MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/IMMUTABILITYPOLICIES/DELETE events or MICROSOFT.STORAGE/STORAGEACCOUNTS/WRITE events, where @properties.requestbody.properties.immutabilityPolicy.state is set to Disabled. Disabling these protections removes safeguards that prevent data from being deleted or overwritten.
Triage and response
- Verify if
{{@usr.id}} had a legitimate reason to modify data protection settings on the affected storage account. - Identify which specific protection mechanism was disabled (soft delete, container soft delete, or immutability policy) and on which storage account.
- Review subsequent activity on the affected storage account for signs of mass deletion or data exfiltration.
- Check for other suspicious activity from the same user or IP address.
- Re-enable the data protection settings if the change was unauthorized and verify no data loss has occurred.
