Azure Dev Ops Log Audit Events

# Azure DevOps - Organization Policy - Log Audit Events ## Query Information ### MITRE ATT&CK Technique(s) | Technique ID | Title | Link | | --- | --- | --- | | T1562.008 | Defense Evasion: Impair Defenses: Disable or Modify Cloud Logs | https://attack.mitre.org/techniques/T1562/008/ | ### Description Keeping track of activities within your Azure DevOps environment is crucial for security and compliance. Auditing helps you monitor and log these activities, providing transparency and accountability Use the below query to identify when Log Audit Events is disabled in Azure DevOps #### References - [Access, export, and filter audit logs](https://learn.microsoft.com/en-us/azure/devops/organizations/audit/azure-devops-auditing?view=azure-devops&tabs=preview-page) - [DevOps threat matrix](https://www.microsoft.com/en-us/security/blog/2023/04/06/devops-threat-matrix/) ### Microsoft Sentinel ```kql AzureDevOpsAuditing | where OperationName == "OrganizationPolicy.PolicyValueUpdated" | extend PolicyName = tostring(Data.PolicyName) | extend PolicyValue = tostring(Data.PolicyValue) | where PolicyValue == "OFF" | where PolicyName == "Policy.LogAuditEvents" | project TimeGenerated, ActorUPN, IpAddress, PolicyName, PolicyValue, ScopeDisplayName ```

Explanation

This query is designed to monitor Azure DevOps for security and compliance purposes by identifying instances where logging of audit events has been disabled. It specifically looks for changes in the organization policy related to audit logging.

Here's a simple breakdown of what the query does:

Data Source: It uses the AzureDevOpsAuditing table, which contains audit logs for Azure DevOps activities.
Filter by Operation: The query filters the logs to find entries where the operation name is "OrganizationPolicy.PolicyValueUpdated". This indicates a change in an organization policy.
Extract Policy Details: It extracts the policy name and value from the log data to focus on specific policy changes.
Check for Disabled Logging: The query further filters the results to find cases where the policy value is set to "OFF" for the policy named "Policy.LogAuditEvents". This means that audit logging has been turned off.
Select Relevant Information: Finally, it selects and displays key information such as the time the change was made, the user who made the change (ActorUPN), their IP address, the policy name, the policy value, and the scope of the change.

This query helps in identifying potential security risks by alerting when audit logging is disabled, which could be an attempt to evade detection of unauthorized activities.

KQL Search

Azure Dev Ops Log Audit Events

Query

Explanation

Details

Actions