From 9fd1c14450c650ccdcbfa1dce3201faae25584b2 Mon Sep 17 00:00:00 2001 From: Jonhnathan Date: Thu, 27 Jan 2022 09:15:22 -0300 Subject: [PATCH] [Rule Tuning] Azure Virtual Network Device Modified or Deleted (#1679) * Update impact_virtual_network_device_modified.toml * Change case (cherry picked from commit fdeb8cb1dee38643ac9c0376a3b9d0c7d0019069) --- .../azure/impact_virtual_network_device_modified.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/integrations/azure/impact_virtual_network_device_modified.toml b/rules/integrations/azure/impact_virtual_network_device_modified.toml index cc20a5f2f..aa188fa2b 100644 --- a/rules/integrations/azure/impact_virtual_network_device_modified.toml +++ b/rules/integrations/azure/impact_virtual_network_device_modified.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2020/08/12" maturity = "production" -updated_date = "2020/08/12" +updated_date = "2021/12/30" integration = "azure" [rule] @@ -37,7 +37,7 @@ type = "query" query = ''' event.dataset:azure.activitylogs and azure.activitylogs.operation_name:("MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE" or "MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE" or "MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE" or -"MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION" or "MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE"or +"MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION" or "MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE" or "MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE" or "MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE" or "MICROSOFT.NETWORK/VIRTUALHUBS/DELETE" or "MICROSOFT.NETWORK/VIRTUALHUBS/WRITE" or "MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE" or "MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE") and