microsoft-azure

Name: microsoft-azure
Availability: InStock
Author: opentide

Organize Azure Activity Log, RBAC, PIM, Key Vault, Storage, Compute, Network, and Defender signals for detection engineering.

4|1|Updated Apr 28, 2026

Search Tags:#azure #rbac #detection-engineering #incident-response #key-vault #activity-log #defender-for-cloud

Ready to run

npx skills add https://github.com/OpenTideHQ/AgentTide --skill microsoft-azure

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: microsoft-azure
Source: https://github.com/OpenTideHQ/AgentTide/tree/main/skills/microsoft-azure
Command: npx skills add https://github.com/OpenTideHQ/AgentTide --skill microsoft-azure

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Azure cloud infrastructure security telemetry is essential for building effective detections. This guide consolidates knowledge about Activity Logs, RBAC, PIM, Key Vault usage, Storage, Compute, Network, and Defender for Cloud signals to accelerate detection engineering and incident response.

Core Features & Use Cases

Understand Azure Activity Log fields and how they map to detections.
Model RBAC, PIM, and Managed Identities for privilege escalation and access control monitoring.
Detect common Azure threats across Key Vault, Storage, Compute, and Network, including Defender for Cloud signals and posture changes.
Use cases include privilege escalation attempts, secret access from unexpected principals, and misconfigurations leading to data exposure.

Quick Start

Load this skill to guide Azure infrastructure detections and reference its guidance during investigations.

Frequently Asked Questions about microsoft-azure

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect privilege escalation in Azure using RBAC and PIM activity logs?▼

Detect Azure privilege escalation by monitoring RBAC role assignments and PIM activations within Activity Logs. You track unexpected role modifications and privileged identity management events to identify unauthorized access control changes across your cloud infrastructure.

What Azure Activity Log fields are needed for building detection engineering content?▼

Azure Activity Log fields required for detection engineering include caller identity, operation name, resource ID, and event timestamp. You map these fields to identify unauthorized actions, correlate access patterns, and build alerts for suspicious infrastructure modifications.

Can I detect data exfiltration attempts targeting Azure Key Vault and Storage?▼

Detect data exfiltration from Azure Key Vault and Storage by analyzing access patterns and unexpected principal authentications. You monitor secret retrieval events and blob storage downloads to identify anomalous data access behavior indicating potential data theft.

Does Defender for Cloud provide telemetry for Azure network and compute misconfigurations?▼

Defender for Cloud provides telemetry for Azure network and compute misconfigurations by emitting posture change signals. You ingest these alerts to detect security baseline deviations and identify exposed virtual machines or unrestricted network interfaces.

What is the best way to investigate suspicious access patterns across Azure Managed Identities?▼

Investigate suspicious Azure Managed Identity access by correlating authentication events with RBAC permissions and Activity Logs. You trace token acquisition requests to determine if compromised identities are executing unauthorized compute or storage operations.

When should I use Azure Activity Logs instead of Defender for Cloud alerts for incident response?▼

Use Azure Activity Logs for detailed incident response when you need raw operational audit trails, and use Defender for Cloud alerts when you require pre-analyzed threat intelligence. You combine both telemetry sources to gain comprehensive visibility during investigations.