AZT601-5.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "Rule Name": {
      "defaultValue": "AZT601.5 - Steal Managed Identity JsonWebToken - Automation Account Runbook",
      "type": "String"
    }
  },
  "variables": {},
  "resources": [
    {
      "type": "microsoft.insights/scheduledqueryrules",
      "apiVersion": "2022-06-15",
      "name": "[parameters('Rule Name')]",
      "location": "centralus",
      "properties": {
        "displayName": "[parameters('Rule Name')]",
        "description": "Will alert whenever a JWT is gathered via an AA Runbook",
        "severity": 2,
        "enabled": true,
        "evaluationFrequency": "PT15M",
        "Scopes": [
          "[subscription().id]"
        ],
        "windowSize": "PT15M",
        "criteria": {
          "allOf": [
            {
              "query": "AzureDiagnostics | where ResourceProvider == 'MICROSOFT.AUTOMATION' and ResultDescription has 'access_token'",
              "timeAggregation": "Count",
              "dimensions": [],
              "operator": "GreaterThanOrEqual",
              "threshold": 1,
              "failingPeriods": {
                "numberOfEvaluationPeriods": 1,
                "minFailingPeriodsToAlert": 1
              }
            }
          ]
        },
        "autoMitigate": false
      }
    }
  ]
}