analyzing-azure-activity-logs-for-threats

Name: analyzing-azure-activity-logs-for-threats
Availability: InStock
Author: Axxxxxxaaann

Query Azure Monitor logs with KQL to detect unauthorized Azure activity.

Updated Aug 23, 2026

Search Tags:#logs #azure #analyze #threat-detection #siem #kql #security-operations

Ready to run

npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-azure-activity-logs-for-threats-axxxxxxaaann

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: analyzing-azure-activity-logs-for-threats
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-azure-activity-logs-for-threats
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-azure-activity-logs-for-threats-axxxxxxaaann

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires azure-identity, azure-monitor-query, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This capability helps security teams quickly identify suspicious Azure activity by querying Azure Monitor logs to surface privilege changes, abnormal sign-ins, and resource modifications.

Core Features & Use Cases

Prebuilt KQL queries for common threat scenarios across AzureActivity, SigninLogs, AuditLogs, and AzureDiagnostics.
Scriptable detection agent that runs queries against a Log Analytics workspace and returns structured findings.
Use cases include privilege escalation detection, impossible travel, NSG rule changes, Key Vault access anomalies, and mass deletion events.

Quick Start

Run the agent against your Azure Log Analytics workspace to generate a threat detection report.

Frequently Asked Questions about analyzing-azure-activity-logs-for-threats

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect privilege escalation in Azure activity logs?▼

Detect privilege escalation in Azure activity logs by running prebuilt KQL queries against Azure Monitor to surface role changes and unauthorized resource modifications. The scriptable agent queries AzureActivity and AuditLogs to return structured threat findings for SOC analysts.

What is the best way to monitor Azure sign-in anomalies across tenants?▼

The best way to monitor Azure sign-in anomalies across tenants is querying SigninLogs in a Log Analytics workspace with KQL. Prebuilt detection queries identify impossible travel and abnormal access patterns, returning structured findings for threat hunters.

Can I use Python to query Azure Monitor logs for threat detection?▼

Yes, you can use Python to query Azure Monitor logs for threat detection. The capability uses azure-identity and azure-monitor-query dependencies to run KQL-based detection queries against Log Analytics workspaces and return structured findings automatically.

How do I detect mass resource deletion events in AzureActivity logs?▼

Detect mass resource deletion events in AzureActivity logs by executing prebuilt KQL queries through a scriptable detection agent. The agent queries Azure Monitor to identify suspicious resource modifications and returns structured findings for cloud administrators.

Do I need a Log Analytics workspace to run KQL threat detection queries?▼

Yes, you need a Log Analytics workspace to run KQL threat detection queries. The detection agent requires valid Azure credentials and workspace access to query AzureActivity, SigninLogs, AuditLogs, and AzureDiagnostics for privilege changes and sign-in anomalies.