SecOps - 41217 - Security tables are provisioned on the appropriate Log Analytics storage plan (Analytics, Basic, or Auxiliary)

[aahmed-spec]

No description provided.

[Copilot]

Pull request overview

Adds a new SecOps assessment (41217) to evaluate whether key Microsoft Sentinel / Log Analytics security tables are configured on the appropriate table plan (Analytics vs. Basic/Auxiliary), and reports findings per workspace and per table to help balance detection capability and cost.

Changes:

• Introduces Test-Assessment-41217 PowerShell test to enumerate Sentinel-onboarded workspaces, query table plan assignments, classify results, and generate a markdown report.
• Adds accompanying Test-Assessment.41217.md documentation content and embeds %TestResult% output.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/powershell/tests/Test-Assessment.41217.ps1	New assessment logic to query table plans per Sentinel workspace and produce summarized + detailed markdown results.
src/powershell/tests/Test-Assessment.41217.md	New documentation page explaining why table plan selection matters and linking to remediation steps.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (7)

src/powershell/tests/Test-Assessment.41217.ps1:92

• No Log Analytics workspaces is an absent-service case and should use the framework's NotApplicable skip outcome. Test-Assessment.41212.ps1:64-67 establishes this behavior for the same helper result; reporting Investigate here incorrectly creates a finding.

    if ($allWorkspaces -eq 'NoWorkspaces') {
        $params = @{
            TestId       = '41217'
            Title        = 'Security tables are provisioned on the appropriate Log Analytics storage plan (Analytics, Basic, or Auxiliary)'
            Status       = $false
            Result       = '⚠️ The check could not evaluate any table — no Sentinel-onboarded workspace was found, no detection-critical table was present, a plan value was indeterminate, or a query failed.'

src/powershell/tests/Test-Assessment.41217.ps1:188

• Unlike detection-critical tables, an absent or unrecognized plan on a high-volume table falls through as Pass. This masks the indeterminate-plan condition and can let the workspace pass; validate the same plan enum before accepting Basic or Auxiliary.

                elseif ($tableName -in $highVolumeTables) {
                    $classification = 'High-volume'
                    $expectedPlan   = 'Basic or Auxiliary'
                    $rowStatus      = if ($actualPlan -eq 'Analytics') { 'Investigate' } else { 'Pass' }

src/powershell/tests/Test-Assessment.41217.ps1:26

• MinimumLicense is deprecated for assessment metadata. New or changed assessments must use CompatibleLicense; otherwise license-driven framework handling will continue to depend on the legacy field.

        MinimumLicense     = ('Consumption-based: Microsoft Sentinel'),

src/powershell/tests/Test-Assessment.41217.ps1:85

• A successful query returning no enabled subscriptions means this Azure/Sentinel assessment is not applicable, not indeterminate. The neighboring Sentinel assessment uses the framework skip outcome for this exact helper result (Test-Assessment.41212.ps1:58-61); returning Investigate here creates a tenant finding when there is nothing to assess.

This issue also appears on line 87 of the same file.

    if ($allWorkspaces -eq 'NoSubscriptions') {
        $params = @{
            TestId       = '41217'
            Title        = 'Security tables are provisioned on the appropriate Log Analytics storage plan (Analytics, Basic, or Auxiliary)'
            Status       = $false
            Result       = '⚠️ The check could not evaluate any table — no Sentinel-onboarded workspace was found, no detection-critical table was present, a plan value was indeterminate, or a query failed.'

src/powershell/tests/Test-Assessment.41217.ps1:124

• When onboarding checks completed successfully and confirmed no Sentinel workspace, the assessment is not applicable. Other Sentinel checks using this helper skip in this branch (Test-Assessment.41212.ps1:88-92); emitting Investigate here reports an evaluability problem even though the absence was conclusively determined.

This issue also appears on line 185 of the same file.

        else {
            $params = @{
                TestId       = '41217'
                Title        = 'Security tables are provisioned on the appropriate Log Analytics storage plan (Analytics, Basic, or Auxiliary)'
                Status       = $false
                Result       = '⚠️ The check could not evaluate any table — no Sentinel-onboarded workspace was found, no detection-critical table was present, a plan value was indeterminate, or a query failed.'

src/powershell/tests/Test-Assessment.41217.ps1:160

• The blanket high-volume classification can recommend weakening active detections. CommonSecurityLog, Syslog, and DeviceNetworkEvents may be referenced by enabled scheduled analytics rules, while this assessment never inspects those dependencies; it therefore flags Analytics as Investigate even when Analytics is required. Only recommend Basic/Auxiliary after proving that no enabled detection or UEBA dependency uses the table, or remove this cost recommendation from the assessment.

    # High-volume verbose tables: any plan is acceptable; Analytics is flagged as cost-optimization.
    $highVolumeTables = @(
        'CommonSecurityLog', 'Syslog', 'WindowsFirewall', 'DeviceNetworkEvents',
        'AzureDiagnostics', 'AzureMetrics'
    )

src/powershell/tests/Test-Assessment.41217.ps1:22

• This new assessment introduces substantial branching for helper sentinel values, partial workspace failures, table-plan classification, tenant roll-up, and report truncation, but no Pester coverage was added. Add tests comparable to code-tests/test-assessments/Test-Assessment.41215.Tests.ps1, including mixed successful/error workspaces and null or unknown plans, to prevent false Pass/Fail regressions.

function Test-Assessment-41217 {