microsoft-azure

Detect Azure privilege escalation by monitoring RBAC role assignments and PIM activations within Activity Logs. You track unexpected role modifications and privileged identity management events to identify unauthorized access control changes across your cloud infrastructure.

Azure Activity Log fields required for detection engineering include caller identity, operation name, resource ID, and event timestamp. You map these fields to identify unauthorized actions, correlate access patterns, and build alerts for suspicious infrastructure modifications.

Detect data exfiltration from Azure Key Vault and Storage by analyzing access patterns and unexpected principal authentications. You monitor secret retrieval events and blob storage downloads to identify anomalous data access behavior indicating potential data theft.

Defender for Cloud provides telemetry for Azure network and compute misconfigurations by emitting posture change signals. You ingest these alerts to detect security baseline deviations and identify exposed virtual machines or unrestricted network interfaces.

Investigate suspicious Azure Managed Identity access by correlating authentication events with RBAC permissions and Activity Logs. You trace token acquisition requests to determine if compromised identities are executing unauthorized compute or storage operations.

Use Azure Activity Logs for detailed incident response when you need raw operational audit trails, and use Defender for Cloud alerts when you require pre-analyzed threat intelligence. You combine both telemetry sources to gain comprehensive visibility during investigations.