analyzing-azure-activity-logs-for-threats

通过 azure-monitor-query 查询 Azure Monitor 活动日志和登录日志，检测可疑管理操作、不可能的地理旅行（Impossible Travel）、权限提升和资源修改。为 Azure 环境的威胁狩猎构建 KQL 查询。适用于调查可疑的 Azure 租户活动或构建云 SIEM 检测规则。

Skill by killvxk

IndexedApache-2.0★ 57

Write a review

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/killvxk-analyzing-azure-activity-logs-for-threats

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Use cases: cloud

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found
Runs as: Python package

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/analyzing-azure-activity-logs-for-threats

What's inside

Skill name: analyzing-azure-activity-logs-for-threats
Description: 通过 azure-monitor-query 查询 Azure Monitor 活动日志和登录日志，检测可疑管理操作、不可能的地理旅行（Impossible Travel）、权限提升和资源修改。为 Azure 环境的威胁狩猎构建 KQL 查询。适用于调查可疑的 Azure 租户活动或构建云 SIEM 检测规则。
License: Apache-2.0
Instructions: 40 lines in SKILL.md · view on GitHub

Before installing

Ships executable scripts

Files (4)

LICENSE
SKILL.md
api-reference.md · references/
agent.py · scripts/

SKILL.md (first lines)

# 分析 Azure 活动日志中的威胁

## 使用说明

使用 azure-monitor-query 对 Azure Log Analytics 工作区执行 KQL 查询，检测可疑管理操作和登录异常。

```python
from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient
from datetime import timedelta

credential = DefaultAzureCredential()
client = LogsQueryClient(credential)

response = client.query_workspace(
    workspace_id="WORKSPACE_ID",
    query="AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10",
    timespan=timedelta(hours=24),
)
```

关键检测查询：
1. 角色分配变更（权限提升）
2. 资源组和订阅修改
3. 来自新 IP 的密钥保管库访问
4. 网络安全组规则变更
5. 条件访问策略修改

## 示例

```python
# 检测新的全局管理员角色分配
query = '''
AuditLogs
| where OperationName == "Add member to role"
| where TargetResources[0].modifiedProperties[0].newValue has "Global Administrator"
'''
```

From killvxk/cybersecurity-skills-zh, Apache-2.0.

Signals

Stars: 57
Forks: 14
Open issues: 1
Last commit (this folder): Mar 17, 2026 (7 months ago)

From GitHub (fetched Oct 24, 2026).

Details

License: Apache-2.0
Repository: github.com/killvxk/cybersecurity-skills-zh
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from killvxk

Cite this page

analyzing-azure-activity-logs-for-threats skill. Agent Mart. https://agentmart.dev/skills/killvxk-analyzing-azure-activity-logs-for-threats (last updated 2026-10-24)