Skip to content

[Deprecation] Deprecating Azure Virtual Network Device Modified or Deleted #4559

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
terrancedejesus merged 4 commits into from
Mar 27, 2025
Merged

[Deprecation] Deprecating Azure Virtual Network Device Modified or Deleted #4559

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
921dbd7
deprecating 'Azure Virtual Network Device Modified or Deleted'
terrancedejesus Mar 24, 2025
51664f5
Merge branch 'main' into deprecate-azure-virtual-network-device-modified
terrancedejesus Mar 25, 2025
259aefe
Merge branch 'main' into deprecate-azure-virtual-network-device-modified
terrancedejesus Mar 26, 2025
5660a84
Merge branch 'main' into deprecate-azure-virtual-network-device-modified
terrancedejesus Mar 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions rules/integrations/azure/impact_virtual_network_device_modified.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,15 @@
creation_date = "2020/08/12"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/03/24"

[rule]
author = ["Austin Songer"]
description = """
Identifies when a virtual network device is modified or deleted. This can be a network virtual appliance, virtual hub,
or virtual router.

**Deprecated Notice** - This rule has been deprecated in favor of other rules that provide more contextual threat behavior for Azure Virtual Network.
"""
false_positives = [
"""
Expand All @@ -22,13 +24,15 @@ from = "now-25m"
index = ["filebeat-*", "logs-azure*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure Virtual Network Device Modified or Deleted"
name = "Deprecated - Azure Virtual Network Device Modified or Deleted"
note = """## Triage and analysis

**Deprecated Notice** - This rule has been deprecated in favor of other rules that provide more contextual threat behavior for Azure Virtual Network.

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Azure Virtual Network Device Modified or Deleted
### Investigating Deprecated - Azure Virtual Network Device Modified or Deleted

Azure virtual network devices, such as network interfaces, virtual hubs, and routers, are crucial for managing network traffic and connectivity in cloud environments. Adversaries may target these devices to disrupt services or reroute traffic for malicious purposes. The detection rule monitors specific Azure activity logs for operations indicating modifications or deletions of these devices, helping identify potential unauthorized changes that could signify an attack.

Expand Down