analyzing-azure-activity-logs-for-threats

name	analyzing-azure-activity-logs-for-threats
description	Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.
domain	cybersecurity
subdomain	security-operations
tags	["azure","cloud-security","azure-monitor","kql","threat-hunting","activity-logs"]
version	1.0
author	mahipal
license	Apache-2.0