---
name: Azure Activity Log Threat Analysis
slug: azure-activity-log-threat-analysis
category: DevOps
description: Azure Activity Log Threat Analysis queries Azure Monitor activity logs and sign-in logs via the azure-monitor-query Python library to detect suspicious admin operations and sign-in anomalies. Use it when investigating security incidents or building threat hunting queries for Azure environments.
github: "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-azure-activity-logs-for-threats"
language: Python
stars: 27758
forks: 3369
install: "npx degit https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-azure-activity-logs-for-threats ~/.claude/skills/analyzing-azure-activity-logs-for-threats"
installs_to: ~/.claude/skills/analyzing-azure-activity-logs-for-threats
source_path: skills/analyzing-azure-activity-logs-for-threats/SKILL.md
collection_size: 25
category_size: 798
collection_url: "https://dirskills.com/collections/mukul975/Anthropic-Cybersecurity-Skills"
added: 2026-08-14T07:11:57.189Z
last_synced: 2026-08-14T07:11:57.189Z
canonical_url: "https://dirskills.com/skills/azure-activity-log-threat-analysis"
---

# Azure Activity Log Threat Analysis

Azure Activity Log Threat Analysis queries Azure Monitor activity logs and sign-in logs via the azure-monitor-query Python library to detect suspicious admin operations and sign-in anomalies. Use it when investigating security incidents or building threat hunting queries for Azure environments.

**Install:**

```bash
npx degit https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-azure-activity-logs-for-threats ~/.claude/skills/analyzing-azure-activity-logs-for-threats
```

## README

# Analyzing Azure Activity Logs for Threats


## When to Use

- When investigating security incidents that require analyzing azure activity logs for threats
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques

## Prerequisites

- Familiarity with security operations concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities

## Instructions

Use azure-monitor-query to execute KQL queries against Azure Log Analytics workspaces,
detecting suspicious admin operations and sign-in anomalies.

```python
from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient
from datetime import timedelta

credential = DefaultAzureCredential()
client = LogsQueryClient(credential)

response = client.query_workspace(
    workspace_id="WORKSPACE_ID",
    query="AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10",
    timespan=timedelta(hours=24),
)
```

Key detection queries:
1. Role assignment changes (privilege escalation)
2. Resource group and subscription modifications
3. Key vault secret access from new IPs
4. Network security group rule changes
5. Conditional access policy modifications

## Examples

```python
# Detect new Global Admin role assignments
query = '''
AuditLogs
| where OperationName == "Add member to role"
| where TargetResources[0].modifiedProperties[0].newValue has "Global Administrator"
'''
```