I am trying to create alert when someone changes the IAM RBAC roles or permissions on azure storage accounts using Kusto query. Can anyone help me in correcting the below KQL query.

Question

| where OperationNameValue ==

AzureActivity

| where ResourceProviderValue contains "Microsoft.storage" and CategoryValue contains "Administrative"

| where OperationNameValue ==

"Microsoft.Authorization/roleAssignments/write" or

"Microsoft.Authorization/roleAssignments/delete" or 

"Microsoft.Authorization/roleDefinitions/write" or 

"Microsoft.Authorization/roleDefinitions/delete"

| where ActivityStatusValue in (""Started", "Succeeded", "Failed")

| project TimeGenerated, ResourceId, OperationNameValue, ActivityStatusValue

Answer 1

did you try? what error do you face?

AzureActivity | where ResourceProviderValue contains "Microsoft.storage" | where CategoryValue == "Administrative" | where OperationNameValue in ( "Microsoft.Authorization/roleAssignments/write", "Microsoft.Authorization/roleAssignments/delete", "Microsoft.Authorization/roleDefinitions/write", "Microsoft.Authorization/roleDefinitions/delete" ) | where ActivityStatusValue in ("Started", "Succeeded", "Failed") | project TimeGenerated, ResourceId, OperationNameValue, ActivityStatusValue

Answer 2

@Sahith Thatipalli You can use below Kusto query for identifying the operations related to role assignments or role definitions.

AzureActivity
| where Category has "Administrative"
| where OperationName has "role assignment" or OperationName has "role definition"
| where ActivityStatus in ("Started", "Succeeded", "Failed")
| where ResourceId has "Microsoft.Storage/storageAccounts/"
| project OperationName, ActivityStatus, ResourceId, ResourceGroup, TimeGenerated

To create log alert, you can refer this document.