Investigate Azure Full Network Packet Capture Detected

[cavokz]

https://github.com/elastic/geneve/blob/main/tests/reports/alerts_from_rules.md#azure-full-network-packet-capture-detected

[cavokz]

The problem with this rules is in its query:

event.dataset:azure.activitylogs and azure.activitylogs.operation_name:
    (
        "MICROSOFT.NETWORK/*/STARTPACKETCAPTURE/ACTION" or
        "MICROSOFT.NETWORK/*/VPNCONNECTIONS/STARTPACKETCAPTURE/ACTION" or
        "MICROSOFT.NETWORK/*/PACKETCAPTURES/WRITE"
    ) and 
event.outcome:(Success or success)

Specifically this part:

    (
        "MICROSOFT.NETWORK/*/STARTPACKETCAPTURE/ACTION" or
        "MICROSOFT.NETWORK/*/VPNCONNECTIONS/STARTPACKETCAPTURE/ACTION" or
        "MICROSOFT.NETWORK/*/PACKETCAPTURES/WRITE"
    )

Double quotes should not be there otherwise the query expects them in the value of the field, unless I totally misunderstood the rule and quotes actually need to be part of the field value. Checking with @Mikaayenson whether this is the case or not.

Removing the double quotes makes the query find the documents generated by Geneve.

[cavokz]

Already fixed in stacks >= 8.5.0, will not be fixed in older stacks.