Spot suspicious activity in your Azure logs.
What it does
Finds potential threats in Azure administrative and sign-in logs using targeted KQL queries.
When to use it
Use when investigating suspicious Azure tenant activity or developing cloud security detections.
How to use it
Give it access to a Log Analytics workspace through arguments or environment settings; it runs threat queries and saves a JSON report.
Uses
Latest review
What you need · 7
Requires Python 3.8 or later with the required dependencies installed.
Requires the query library to execute KQL against Log Analytics workspaces.
Requires the identity library for default credentials or client-secret authentication.
Access · 1
This skill
Azure Monitor
Read
Queries your Azure logs