analyzing-azure-activity-logs-for-threats

What problem does it solve?

This Skill helps security teams identify threats by querying Azure Monitor activity logs and sign-in logs to surface suspicious administrative operations, impossible travel, privilege escalation, and resource modifications.

Core Features & Use Cases

• Query Azure Monitor tables (AzureActivity, SigninLogs, AuditLogs, AzureDiagnostics) to surface indicators of compromise and operational anomalies.
• Detect privilege escalations, unusual sign-ins, NSG rule changes, Key Vault access anomalies, and mass resource modifications.
• Provide structured outputs for security operations workflows, supporting both human-readable reports and machine-readable payloads for automation.

Quick Start

Execute the agent against your Azure workspace to begin threat hunting across the monitored logs.