Deprecated operationnames used in MS built-in policies & absent log export-> "Microsoft.Security/securitySolutions/write" & "Microsoft.Security/securitySolutions/delete

BartDecker-8243 180 Reputation points
2023-07-10T10:48:34.0666667+00:00

Via MS Support is was confirmed that these two operationnames are deprecated

"Microsoft.Security/securitySolutions/write" & "Microsoft.Security/securitySolutions/delete

These are replaced by:

 "Microsoft.Security/locations/securitySolutions/write" and "Microsoft.Security/locations/securitySolutions/delete

However the support desk could not help me with the following 2 problems the above change creates:

  • These opreationnames are used in the following (among others) policy which is part oft the CIS Benchmark)
       [https://www.azadvertizer.net/azpolicyadvertizer/3b980d31-7904-4bb7-8575-5665739a8052.html](https://www.azadvertizer.net/azpolicyadvertizer/3b980d31-7904-4bb7-8575-5665739a8052.html)
    
  • The activity logs related to both actions by creating and deleting a security solution are not send to log analytics when all categories are ticked in the diagnosticrule on the subscription. So these two new actions seem not to be part of the "security category of the diagnostic rule logs.

All boxes ticked.

User's image

After creating and security solution the only item found (by correlation id) in the LA workspace is the "semi-integrated solution creation. The Delete secrutiy solution and the write security solution are not exported to the LA workspace.

User's image

I guess the change in operationname was not implemented across "the azure landscape"

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,645 questions
Azure Policy
Azure Policy
An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
1,014 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.