analyzing-azure-activity-logs-for-threats

Detect privilege escalation in Azure activity logs by running prebuilt KQL queries against Azure Monitor to surface role changes and unauthorized resource modifications. The scriptable agent queries AzureActivity and AuditLogs to return structured threat findings for SOC analysts.

The best way to monitor Azure sign-in anomalies across tenants is querying SigninLogs in a Log Analytics workspace with KQL. Prebuilt detection queries identify impossible travel and abnormal access patterns, returning structured findings for threat hunters.

Yes, you can use Python to query Azure Monitor logs for threat detection. The capability uses azure-identity and azure-monitor-query dependencies to run KQL-based detection queries against Log Analytics workspaces and return structured findings automatically.

Detect mass resource deletion events in AzureActivity logs by executing prebuilt KQL queries through a scriptable detection agent. The agent queries Azure Monitor to identify suspicious resource modifications and returns structured findings for cloud administrators.

Yes, you need a Log Analytics workspace to run KQL threat detection queries. The detection agent requires valid Azure credentials and workspace access to query AzureActivity, SigninLogs, AuditLogs, and AzureDiagnostics for privilege changes and sign-in anomalies.