Stats
Actions
Tags
Queries Azure activity and sign-in logs with azure-monitor-query and KQL to detect suspicious admin operations, impossible travel, privilege escalation, and resource modifications. For Azure threat hunting and SIEM rules.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersecurity-skills-zh:analyzing-azure-activity-logs-for-threatsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
使用 azure-monitor-query 对 Azure Log Analytics 工作区执行 KQL 查询，检测可疑管理操作和登录异常。
使用 azure-monitor-query 对 Azure Log Analytics 工作区执行 KQL 查询，检测可疑管理操作和登录异常。
from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient
from datetime import timedelta
credential = DefaultAzureCredential()
client = LogsQueryClient(credential)
response = client.query_workspace(
workspace_id="WORKSPACE_ID",
query="AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10",
timespan=timedelta(hours=24),
)
关键检测查询：
# 检测新的全局管理员角色分配
query = '''
AuditLogs
| where OperationName == "Add member to role"
| where TargetResources[0].modifiedProperties[0].newValue has "Global Administrator"
'''
npx claudepluginhub killvxk/cybersecurity-skills-zhQueries Azure Monitor activity and sign-in logs via azure-monitor-query to detect suspicious admin operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments.
Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious admin operations, impossible travel, privilege escalation. Use for Azure threat hunting or building cloud SIEM detections.
Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious admin operations, impossible travel, privilege escalation. Use for Azure threat hunting or building cloud SIEM detections.