
Summary
This rule is designed to detect modifications or deletions of secrets within Azure Key Vault, which is part of Azure's security framework for managing sensitive information. It tracks various operations such as writing, deleting, backing up, purging, updating, recovering, restoring, and setting secrets in Azure Key Vault. A set of defined operation names triggers alerts when any secret is modified or deleted, helping security teams monitor unauthorized changes that could indicate malicious activity. The emphasis on identifying such changes stems from the critical nature of secrets management within cloud environments, where improper handling may lead to information leakage or breaches. This rule aims to protect against such risks, ensuring that any unexpected modifications or deletions are promptly flagged for review.
Categories
- Cloud
- Azure
Data Sources
- Cloud Service
- Application Log
Created: 2021-08-16