Cloud API events where logging services are stopped, deleted, or modified in a way that disables audit visibility. Defender view: unauthorized StopLogging, DeleteTrail, or UpdateSink operations correlated with privileged user activity.
| Data Component | Name | Channel |
|---|---|---|
| Cloud Service Disable (DC0090) | AWS:CloudTrail | Stop logging for an existing CloudTrail |
| Cloud Service Modification (DC0069) | gcp:config | UpdateSink request modifying log export destinations |
| Field | Description |
|---|---|
| AdminRoles | Define which roles are authorized to stop or modify logging. |
| RegionScope | Adjust monitoring to ensure multi-region logging tampering is caught. |
Disabling or modifying sign-in or audit log collection for user activities. Defender view: policy or configuration updates removing logging coverage for critical accounts.
| Data Component | Name | Channel |
|---|---|---|
| Cloud Service Modification (DC0069) | azure:policy | DisableAuditLogs or ConditionalAccess logging changes |
| Field | Description |
|---|---|
| CriticalAccounts | Tune to prioritize logging changes that affect administrative or high-value accounts. |
Disabling mailbox or tenant-level audit logging, often using Set-MailboxAuditBypassAssociation or downgrading license tiers. Defender view: sudden absence of mailbox activity logging for monitored users.
| Data Component | Name | Channel |
|---|---|---|
| User Account Modification (DC0010) | m365:unified | Set-MailboxAuditBypassAssociation or disabling Advanced Auditing |
| Field | Description |
|---|---|
| UserScope | Tune alerts for users where mailbox auditing should always remain enabled. |
Disabling or altering security and audit logs in SaaS admin panels (e.g., Slack, Zoom, Salesforce). Defender view: API calls or admin console changes that stop event exports or logging integrations.
| Data Component | Name | Channel |
|---|---|---|
| Cloud Service Disable (DC0090) | saas:audit | Log export integration removed or disabled |
| Field | Description |
|---|---|
| IntegrationScope | Define which SaaS log integrations are required and alert if removed. |