Deprecated operationnames used in MS built-in policies & absent log export-> "Microsoft.Security/securitySolutions/write" & "Microsoft.Security/securitySolutions/delete
Via MS Support is was confirmed that these two operationnames are deprecated
"Microsoft.Security/securitySolutions/write" & "Microsoft.Security/securitySolutions/delete
These are replaced by:
"Microsoft.Security/locations/securitySolutions/write" and "Microsoft.Security/locations/securitySolutions/delete
However the support desk could not help me with the following 2 problems the above change creates:
- These opreationnames are used in the following (among others) policy which is part oft the CIS Benchmark)
[https://www.azadvertizer.net/azpolicyadvertizer/3b980d31-7904-4bb7-8575-5665739a8052.html](https://www.azadvertizer.net/azpolicyadvertizer/3b980d31-7904-4bb7-8575-5665739a8052.html)
- The activity logs related to both actions by creating and deleting a security solution are not send to log analytics when all categories are ticked in the diagnosticrule on the subscription. So these two new actions seem not to be part of the "security category of the diagnostic rule logs.
All boxes ticked.
After creating and security solution the only item found (by correlation id) in the LA workspace is the "semi-integrated solution creation. The Delete secrutiy solution and the write security solution are not exported to the LA workspace.
I guess the change in operationname was not implemented across "the azure landscape"