refactor: first bigger log source refactoring

see discussion here: https://github.com/SigmaHQ/sigma/discussions/2835

rules/cloud/azure/azure_aadhybridhealth_adfs_new_server.yml

@@ -1,7 +1,7 @@
 title: Azure Active Directory Hybrid Health AD FS New Server
 id: 288a39fc-4914-4831-9ada-270e9dc12cb4
 description: |
-  This detection uses AzureActivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service.
+  This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service.
   A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.
   This can be done programmatically via HTTP requests to Azure.
 status: experimental
@@ -14,7 +14,7 @@ references:
   - https://o365blog.com/post/hybridhealthagent/
 logsource:
   product: azure
-  service: AzureActivity
+  service: azureactivity
 detection:
   selection:
     CategoryValue: 'Administrative'

rules/cloud/azure/azure_aadhybridhealth_adfs_service_delete.yml

@@ -1,7 +1,7 @@
 title: Azure Active Directory Hybrid Health AD FS Service Delete
 id: 48739819-8230-4ee3-a8ea-e0289d1fb0ff
 description: |
-  This detection uses AzureActivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.
+  This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.
   A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.
   The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.
 status: experimental
@@ -14,7 +14,7 @@ references:
   - https://o365blog.com/post/hybridhealthagent/
 logsource:
   product: azure
-  service: AzureActivity
+  service: azureactivity
 detection:
   selection:
     CategoryValue: 'Administrative'

rules/cloud/azure/azure_account_lockout.yml

@@ -8,7 +8,7 @@ references:
   - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts
 logsource:
   product: azure
-  service: azure.signinlogs
+  service: signinlogs
 detection:
   selection:
     ResultType: 50053

rules/cloud/azure/azure_app_credential_modification.yml

@@ -8,7 +8,7 @@ references:
     - https://www.cloud-architekt.net/auditing-of-msi-and-service-principals/
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 'Update application - Certificates and secrets management'

rules/cloud/azure/azure_application_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#application-proxy
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message:

rules/cloud/azure/azure_application_gateway_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_application_security_group_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_change_to_authentication_method.yml

@@ -8,7 +8,7 @@ references:
   - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts
 logsource:
   product: azure
-  service: azure.auditlogs
+  service: auditlogs
 detection:
   selection:
     LoggedByService: 'Authentication Methods'

rules/cloud/azure/azure_container_registry_created_or_deleted.yml

@@ -12,7 +12,7 @@ references:
     - https://attack.mitre.org/matrices/enterprise/cloud/
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_creating_number_of_resources_detection.yml

@@ -1,15 +1,15 @@
 title: Number Of Resource Creation Or Deployment Activities
 id: d2d901db-7a75-45a1-bc39-0cbf00812192
 status: test
-description: Number of VM creations or deployment activities occur in Azure via the AzureActivity log.
+description: Number of VM creations or deployment activities occur in Azure via the azureactivity log.
 author: sawwinnnaung
 references:
-  - https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AzureActivity/Creating_Anomalous_Number_Of_Resources_detection.yaml
+  - https://github.com/Azure/Azure-Sentinel/blob/master/Detections/azureactivity/Creating_Anomalous_Number_Of_Resources_detection.yaml
 date: 2020/05/07
 modified: 2021/11/27
 logsource:
   product: azure
-  service: AzureActivity
+  service: azureactivity
 detection:
   keywords:
     - Microsoft.Compute/virtualMachines/write

rules/cloud/azure/azure_device_no_longer_managed_or_compliant.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#core-directory
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_device_or_configuration_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#core-directory
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_dns_zone_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message|startswith: MICROSOFT.NETWORK/DNSZONES

rules/cloud/azure/azure_federation_modified.yml

@@ -8,7 +8,7 @@ references:
     - https://attack.mitre.org/techniques/T1078
 logsource:
   product: azure
-  service: azure.signinlogs
+  service: signinlogs
 detection:
     selection:
         properties.message: Set federation settings on domain

rules/cloud/azure/azure_firewall_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_firewall_rule_collection_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_granting_permission_detection.yml

@@ -4,12 +4,12 @@ status: test
 description: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
 author: sawwinnnaung
 references:
-  - https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml
+  - https://github.com/Azure/Azure-Sentinel/blob/master/Detections/azureactivity/Granting_Permissions_To_Account_detection.yaml
 date: 2020/05/07
 modified: 2021/11/27
 logsource:
   product: azure
-  service: AzureActivity
+  service: azureactivity
 detection:
   keywords:
     - Microsoft.Authorization/roleAssignments/write

rules/cloud/azure/azure_keyvault_key_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_keyvault_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_keyvault_secrets_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_kubernetes_admission_controller.yml

@@ -9,7 +9,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection1:
           properties.message|startswith:

rules/cloud/azure/azure_kubernetes_cluster_created_or_deleted.yml

@@ -12,7 +12,7 @@ references:
     - https://attack.mitre.org/matrices/enterprise/cloud/
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_kubernetes_cronjob.yml

@@ -11,7 +11,7 @@ references:
     - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
 logsource:
     product: azure
-    service: azure.activitylogs
+    service: activitylogs
 detection:
     selection1:
           properties.message|startswith:

rules/cloud/azure/azure_kubernetes_events_deleted.yml

@@ -9,7 +9,7 @@ references:
     - https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection_operation_name:
           properties.message: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE

rules/cloud/azure/azure_kubernetes_network_policy_change.yml

@@ -12,7 +12,7 @@ references:
     - https://attack.mitre.org/matrices/enterprise/cloud/
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_kubernetes_pods_deleted.yml

@@ -9,7 +9,7 @@ references:
     - https://github.com/elastic/detection-rules/blob/065bf48a9987cd8bd826c098a30ce36e6868ee46/rules/integrations/azure/impact_kubernetes_pod_deleted.toml
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection_operation_name:
           properties.message: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE

rules/cloud/azure/azure_kubernetes_role_access.yml

@@ -12,7 +12,7 @@ references:
     - https://attack.mitre.org/matrices/enterprise/cloud/
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_kubernetes_rolebinding_modified_or_deleted.yml

@@ -12,7 +12,7 @@ references:
     - https://attack.mitre.org/matrices/enterprise/cloud/
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_kubernetes_secret_or_config_object_access.yml

@@ -12,7 +12,7 @@ references:
     - https://attack.mitre.org/matrices/enterprise/cloud/
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_kubernetes_service_account_modified_or_deleted.yml

@@ -12,7 +12,7 @@ references:
     - https://attack.mitre.org/matrices/enterprise/cloud/
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_login_to_disabled_account.yml

@@ -8,7 +8,7 @@ references:
   - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts
 logsource:
   product: azure
-  service: azure.signinlogs
+  service: signinlogs
 detection:
   selection:
     ResultType: 50057

rules/cloud/azure/azure_mfa_disabled.yml

@@ -9,7 +9,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates
 logsource:
     product: azure
-    service: azure.activitylogs
+    service: activitylogs
 detection:
     selection:
         eventSource: AzureActiveDirectory

rules/cloud/azure/azure_mfa_interrupted.yml

@@ -8,7 +8,7 @@ references:
   - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts
 logsource:
   product: azure
-  service: azure.signinlogs
+  service: signinlogs
 detection:
   selection:
     ResultType: 50074

rules/cloud/azure/azure_network_firewall_policy_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_network_firewall_rule_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message:

rules/cloud/azure/azure_network_p2s_vpn_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message:

rules/cloud/azure/azure_network_security_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message:

rules/cloud/azure/azure_network_virtual_device_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message:

rules/cloud/azure/azure_new_cloudshell_created.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: MICROSOFT.PORTAL/CONSOLES/WRITE

rules/cloud/azure/azure_owner_removed_from_application_or_service_principal.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#application-proxy
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_rare_operations.yml

@@ -4,12 +4,12 @@ status: test
 description: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
 author: sawwinnnaung
 references:
-  - https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AzureActivity/RareOperations.yaml
+  - https://github.com/Azure/Azure-Sentinel/blob/master/Detections/azureactivity/RareOperations.yaml
 date: 2020/05/07
 modified: 2021/11/27
 logsource:
   product: azure
-  service: AzureActivity
+  service: azureactivity
 detection:
   keywords:
     - Microsoft.DocumentDB/databaseAccounts/listKeys/action

rules/cloud/azure/azure_service_principal_created.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#application-proxy
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 'Add service principal'

rules/cloud/azure/azure_service_principal_removed.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#application-proxy
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: Remove service principal

rules/cloud/azure/azure_subscription_permissions_elevation_via_activitylogs.yml

@@ -8,7 +8,7 @@ references:
   - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftauthorization
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection1:
         properties.message: 

rules/cloud/azure/azure_subscription_permissions_elevation_via_auditlogs.yml

@@ -8,7 +8,7 @@ references:
   - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#assignment-and-elevation
 logsource:
   product: azure
-  service: azure.auditlogs
+  service: auditlogs
 detection:
   selection:
     Category: 'Administrative'

rules/cloud/azure/azure_suppression_rule_created.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: 

rules/cloud/azure/azure_unusual_authentication_interruption.yml

@@ -8,7 +8,7 @@ references:
   - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts
 logsource:
   product: azure
-  service: azure.signinlogs
+  service: signinlogs
 detection:
     selection1:
           ResultType: 50097

rules/cloud/azure/azure_user_login_blocked_by_conditional_access.yml

@@ -8,7 +8,7 @@ references:
   - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts
 logsource:
   product: azure
-  service: azure.signinlogs
+  service: signinlogs
 detection:
   selection:
     ResultType: 53003

rules/cloud/azure/azure_virtual_network_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message|startswith:

rules/cloud/azure/azure_vpn_connection_modified_or_deleted.yml

@@ -8,7 +8,7 @@ references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
 logsource:
   product: azure
-  service: azure.activitylogs
+  service: activitylogs
 detection:
     selection:
         properties.message: