[New Rule] Azure Storage Account Key Regenerated

[bm11100]

Description

Identifies a rotation to your storage account access keys in Azure. Regenerating access keys can affect any applications or Azure services that are dependent on the storage account key.

False Positive Info

It's recommended that you rotate your access keys periodically to help keep your storage account secure. Normal key rotation can be exempted from the rule. An abnormal time frame and/or a key rotation from unfamiliar users, hosts, or locations should be investigated.

Required Info

• Eventing Sources:
  filebeat-*

• Platforms
  azure

• Target ECS Version: 1.5.0

• New fields required in ECS for this?

• Related issues or PRs

Optional Info

• References:
  https://docs.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal

Syntax

event.module:azure and event.dataset:azure.activitylogs and event.category:Administrative and azure.activitylogs.operation_name:MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION and event.outcome:Success

Example Data