SecurityInsight settings · Settings > Sign-in & Azure resources
Risk Analysis rule resource group
| Key | SI_RiskAnalysis_DcrResourceGroup |
|---|---|
| Where | Settings > Sign-in & Azure resources |
| Type | Text |
| Default | Uses SI_DcrResourceGroup (then DcrResourceGroup); if none is set, the standard SecurityInsight rules group. |
| Edition | Community |
What it does
Resource group holding the data collection rules Risk Analysis uses to send its results to Log Analytics, when it should differ from the solution-wide one.
When set
Risk Analysis looks up, and creates if missing, its two collection rules in this resource group. A wrong group means new rules are created there, separate from the rest of the solution.
When blank or default
Left blank, the default applies: Uses SI_DcrResourceGroup (then DcrResourceGroup); if none is set, the standard SecurityInsight rules group.
Risk and how to reverse it
Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.
Requires
Read by: risk-analysis.
Recommended
Keep the default. Change it when: Rarely; only when Risk Analysis must ingest through rules kept apart from the other engines.
Documented for SecurityInsight 3.0.79. Written by the SecurityInsight team; Invardia publishes it. · All settings · Security review pack