Azure Policy Assignment Created
Incident Management is now generally available! Incident Management is now generally available!
<  Back to rules search

Azure Policy Assignment Created

azure

Classification:

compliance

Set up the azure integration.

Overview

Goal

Detect when an Azure policy assignment has been created.

Strategy

Monitor Azure activity logs and detect when the @evt.name is equal to MICROSOFT.AUTHORIZATION/POLICYASSIGNMENTS/WRITE and @evt.outcome is equal to Success.

Triage && Response

  1. Inspect the policy assignment and determine if an unsolicited change was made on any Azure resources.