Анализ логов Azure Monitor для поиска угроз

★ 8.4 · security

analyzing-azure-activity-logs-for-threats is a Claude Code skill that queries Azure Monitor activity logs and sign-in logs via the azure-monitor-query library to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. It builds KQL queries against Azure Log Analytics workspaces and covers five core detection scenarios: role assignment changes, resource group and subscription modifications, Key Vault secret access from new IPs, Network Security Group rule changes, and conditional access policy modifications. SOC analysts can use it both for investigating active incidents in an Azure tenant and for building cloud SIEM detection rules. The skill requires Python 3.8+, a configured Log Analytics Workspace ID, and appropriate Azure permissions.