security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Azure Virtual Network Device Modified or Deleted (#1679)

Browse Source 
* Update impact_virtual_network_device_modified.toml

* Change case

(cherry picked from commit fdeb8cb1de)
This commit is contained in:
Jonhnathan
2022-01-27 09:15:22 -03:00
committed by github-actions[bot]
parent 9e5c68a04c
commit 9fd1c14450
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/azure/impact_virtual_network_device_modified.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/12"
maturity = "production"
updated_date = "2020/08/12"
updated_date = "2021/12/30"
integration = "azure"
[rule]
@@ -37,7 +37,7 @@ type = "query"
query = '''
event.dataset:azure.activitylogs and azure.activitylogs.operation_name:("MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE" or
"MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE" or "MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE" or
"MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION" or "MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE"or
"MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION" or "MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE" or
"MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE" or "MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE" or
"MICROSOFT.NETWORK/VIRTUALHUBS/DELETE" or "MICROSOFT.NETWORK/VIRTUALHUBS/WRITE" or
"MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE" or "MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE") and