[Rule Tuning] Update Azure / M365 Rule Names and File Paths #5164
Description
We want to standardize rule titles across Azure, Entra ID, and Microsoft 365 to ensure consistency, clarity, and alignment with platform/service terminology. The following guidelines should be applied going forward:
Platform Prefix
Always start with the platform name:
- Azure → Covers cloud infrastructure (compute, storage, networking, automation, etc.)
- Entra ID → Covers identity, authentication, and authorization
- M365 → Covers SaaS-specific activity (Exchange, SharePoint, Teams, Graph, etc.)
- Do not duplicate platform names in the middle or suffix of titles.
Service or Domain Context
- After the platform, specify the service or functional area:
- Examples: Automation, Blob Storage, Key Vault, Kubernetes Services (AKS), OAuth, Conditional Access Policy
- Abbreviations are acceptable only if they are industry-standard (e.g., AKS, PIM, MFA).
Action or Behavior
Use a clear action-oriented phrase:
- Created / Deleted / Modified / Updated for config changes
- Sign-in / Request / Execution / Detected for operational or behavioral activity
- Excessive / Rare / Suspicious for anomaly-driven detections
- Prefer Created or Modified over “Created/Modified” to avoid slashes.
Entity or Object Affected
- Specify the object in scope:
- Examples: Runbook, Webhook, Authorization Rule, Role Assignment, Secret, VM Command
- Use singular unless the detection clearly applies to multiple objects (e.g., “Pods Deleted”).
Anomaly/Heuristic Qualifiers
- Place qualifiers at the end of the title for clarity:
- Examples: by Rare User, with Suspicious Properties, via Refresh Token, with Rare Client
- Keep heuristic descriptions short and consistent.
Consistency Rules
- Use Title Case (capitalize major words, lowercase minor words unless acronym).
- Avoid redundant words (e.g., don’t repeat “Azure” in both prefix and service).
While adjusting rule names, file paths should be adjusted as well as these typically reflect the rule name.