Azure活动日志威胁分析
原名：analyzing-azure-activity-logs-for-threats
使用 azure-monitor-query 查询 Azure Monitor 的活动日志和登录日志。
- 分类
- 数据分析
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 0
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-08-25
- TRACE 评分
- 3.4 / 5
内容概览
- When investigating security incidents that require analyzing azure activity logs for threats - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques - Familiarity with security operations concepts and tools - Access to a test or lab environment for safe execution - Python 3.8+ with required dependencies installed - Appropriate authorization for any testing activities Use azure-monitor-query to execute KQL queries against Azure Log Analytics workspaces, detecting suspicious admin operations and sign-in anomalies. Key detection queries: 1. Role assignment changes (privilege escalation) 2. Resource group and subscription modifications 3. Key vault secret access from new IPs 4. Network security group rule changes 5. Conditional…