Managed Sentinel – Alert 198
| Alert ID | MS-A198 |
| Alert Name | Rare subscription-level operations in Azure |
| Description | This alert looks for sensitive subscription-level events based on Azure Activity Logs. |
| Severity Level | Low |
| Threat Indicator | |
| MITRE ATT&CK Tactics | Defense Evasion Discovery |
| Log sources | AzureActivity |
| False Positives | |
| Recommendations |