Analyzing Azure Activity Logs
FreeDetect threats in Azure activity logs using KQL queries.
Free · Opens the source repo
What Analyzing Azure Activity Logs does
The Analyzing Azure Activity Logs for Threats skill is designed for security professionals who need to investigate suspicious activities within Azure environments. By utilizing the azure-monitor-query library, this skill allows users to execute Kusto Query Language (KQL) queries against Azure Log Analytics workspaces, enabling them to identify potential security threats such as privilege escalations, unauthorized resource modifications, and anomalous sign-in attempts. This is particularly useful for Security Operations Center (SOC) analysts and threat hunters who require structured procedures for analyzing Azure activity logs.
This skill is built around the common security operations practices and provides key detection queries that can be customized to fit specific needs. For instance, users can detect changes in role assignments that may indicate privilege escalation or monitor for modifications to critical resources like network security groups and key vaults. The skill also facilitates the validation of security monitoring coverage, ensuring that organizations are prepared for various attack techniques.
To effectively use this skill, users should have a solid understanding of security operations concepts and tools, as well as access to a suitable testing environment. The skill requires Python 3.8+ and appropriate authorization for testing activities. The provided examples guide users in crafting their own KQL queries, making it easier to adapt the skill to their specific security needs.
In summary, this skill is an essential tool for those tasked with monitoring Azure environments for security threats, providing the necessary capabilities to perform effective threat hunting and incident investigation.
When to use it
Use this skill when investigating security incidents or building detection rules for Azure activity logs.
When not to use it
This skill is not suitable for environments outside Azure or for users unfamiliar with KQL and security operations.
What you can build with it
Investigating Privilege Escalation
Use the skill to query Azure activity logs for changes in role assignments that may indicate unauthorized privilege escalation.
Building Detection Rules
Leverage the skill to create structured KQL queries that can be implemented as detection rules in a cloud SIEM.
Validating Security Coverage
Employ the skill to assess whether your security monitoring effectively covers various attack techniques in Azure.
How to install Analyzing Azure Activity Logs
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-azure-activity-logs-for-threats --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing Azure Activity Logs for Threats
When to Use
- When investigating security incidents that require analyzing azure activity logs for threats
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Familiarity with security operations concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
Use azure-monitor-query to execute KQL queries against Azure Log Analytics workspaces, detecting suspicious admin operations and sign-in anomalies.
from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient
from datetime import timedelta
credential = DefaultAzureCredential()
client = LogsQueryClient(credential)
response = client.query_workspace(
workspace_id="WORKSPACE_ID",
query="AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10",
timespan=timedelta(hours=24),
)
Key detection queries:
- Role assignment changes (privilege escalation)
- Resource group and subscription modifications
- Key vault secret access from new IPs
- Network security group rule changes
- Conditional access policy modifications
Examples
# Detect new Global Admin role assignments
query = '''
AuditLogs
| where OperationName == "Add member to role"
| where TargetResources[0].modifiedProperties[0].newValue has "Global Administrator"
'''
Frequently asked questions about Analyzing Azure Activity Logs
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.