Azure SQL Server Firewall Rules Created or Modified

Classification:

attack

Tactic:

Technique:

Set up the azure integration.

Goal

Detect when an Azure network security rule has been created, modified, or deleted.

Monitor Azure activity logs and detect when the @evt.name is equal to any of the following names:

and @evt.outcome is equal to Success.

Inspect the security rule and determine if it exposes any Azure resources that should not be made public.