LoFP LoFP / virtual network being modified or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

Techniques

Sample rules

Azure Virtual Network Modified or Deleted

Description

Identifies when a Virtual Network is modified or deleted in Azure.

Detection logic

condition: selection
selection:
  operationName|endswith:
  - /WRITE
  - /DELETE
  operationName|startswith:
  - MICROSOFT.NETWORK/VIRTUALNETWORKGATEWAYS/
  - MICROSOFT.NETWORK/VIRTUALNETWORKS/