by ACloud.Solutions
AzClean Detections: Sentinel Drift & Escalation
Twelve Microsoft Sentinel detections for configuration drift and privilege escalation — the misconfigurations AzClean reports at rest, caught as they happen.
PowerShell 5.1 or 7+ · Log Analytics Reader to validate · the validator creates nothing
AzClean Detections // Workspace validation by ACloud.Solutions ------------------------------------ [*] Validating 12 detection(s) against workspace 41 table(s) with data in the last 7 days VALID, QUIET NSG opened to the internet VALID, QUIET Storage public blob access enabled FIRES NOW Privileged Azure role assigned (2 row(s)) VALID, QUIET Service principal credential added VALID, QUIET Conditional Access policy changed VALID, QUIET Diagnostic settings deleted FIRES NOW Daily ingestion cap reached (1 row(s)) TABLE MISSING Sentinel automation failing 11 usable, 1 waiting on a data source, 0 broken
Sentinel will accept a broken rule and never tell you
A scheduled analytics rule whose query is invalid is saved without complaint, and then simply never fires. Nothing warns you. A detection you have not proven against your own data is not a control, it is a hope.
Every query validated
All twelve were parsed and semantically analysed with Microsoft's own KQL parser against a Sentinel schema. Tables, columns, functions and syntax. 12 of 12 pass.
And proven in your workspace
The included validator runs each query against your data and reports whether it parses, whether the tables exist, and whether it returns rows now.
Read-only to check
Validation creates nothing. Deployment is a separate script with -WhatIf, -Disabled and single-rule options.
Not a threat pack. The gap Microsoft leaves.
Microsoft's built-in analytics are better at threat detection than anything sold alongside them. These cover what they do not: somebody changing your configuration.
NSG opened to the internet
Inbound allow from any source, including rules written as port ranges. Pairs with Test-NSGRules.
Storage made public
allowBlobPublicAccess flipped on. Pairs with Find-PublicStorageAccounts.
Owner granted
Privileged Azure role assignment by role GUID. Pairs with Get-StaleRBAC.
Credential added to an SP
The standard persistence step. Pairs with Get-UnusedServicePrincipals.
Conditional Access weakened
Policy created, changed or disabled, with the state transition reported.
Diagnostic settings deleted
Removing the log pipeline before acting, which also ends your visibility.
Guest privileged fast
A guest invited and given a directory role inside 24 hours.
Break-glass account used
Any sign-in by an emergency access account. Needs your UPNs adding.
Telemetry you can trust
A connector that silently stopped, an ingestion spike, and a daily total sitting flat, which is a cap and dropped data rather than a measurement.
Pick your licence
Same files in every tier. What changes is what you are allowed to do with them. Lifetime updates on all three, with no subscription and no renewal.
Single Organisation
For your own estate
$79
one-time · lifetime updates
- Everything in the pack
- Your own tenants and subsidiaries
- Modify it freely, commercial use included
- Lifetime updates
Consultant
For client engagements
$199
one-time · lifetime updates
- Everything in Single Organisation
- Deploy them into client Sentinel workspaces
- Hand clients the validation output
Redistribution
For building on
$749
one-time · lifetime updates
- Everything in Consultant
- Embed the detections in what you sell
- Ship to any number of your customers
A licence to build on, not to resell as-is.
Get RedistributionNot sure which tier? Ask us.
Questions
Five that come up.
Do these duplicate the built-in rules?
No. The built-ins cover threat activity; these cover configuration change and telemetry integrity. Five of the twelve map to an AzClean at-rest check, so you get the drift and the standing state from the same view.
Have they been tested against real data?
Every query has been parsed and semantically validated, which catches bad tables, columns, functions and syntax. Whether a given Properties payload has the shape a query assumes is a runtime question, and that is exactly what the included validator answers against your workspace. That distinction is stated plainly in the readme rather than glossed over.
What has to be tuned?
The break-glass detection ships with placeholder UPNs and will never fire until you replace them; the deploy script warns about that specific rule. Also worth reviewing: the 10x spike factor, the 20-hour reliability floor, and the 24-hour guest window.
What permissions do I need?
Log Analytics Reader is enough to validate. Sentinel Contributor to create the rules. The validator never writes.
Do I need AzClean too?
No, this stands alone. They complement each other: five detections have an at-rest equivalent in the toolkit, so you can catch a change and then confirm the standing state.
Stop trusting rules you have never seen fire
Twelve detections, a validator that proves them in your workspace, and a deployer with -WhatIf.