Azure Log Types

Overview:

The following section provides a list of the common log types that are utilized within Azure for security and threat hunting.

Log Types:

1. Azure Activity Logs

• Purpose: Records all management operations performed on resources within your Azure subscription.

• Use Cases:

  • Monitor Administrative Actions: Track who made changes to critical resources, such as network security groups, virtual machines, or identity configurations.

  • Detect Unauthorized Access: Identify suspicious administrative actions, like creating new users, granting roles, or disabling security features.

2. Azure Entra ID Logs

• Sign-in Logs:

  • Purpose: Logs all sign-in activities within Azure AD.

  • Use Cases:

    • Identify Suspicious Logins: Look for sign-ins from unfamiliar locations, impossible travel scenarios, or sign-ins using legacy authentication protocols.

    • Compromised Accounts: Detect anomalies in user sign-in behavior, such as repeated failed attempts or unusual login times.

• Audit Logs:

  • Purpose: Provides a record of all changes made within Azure AD, including changes to users, groups, applications, and directory settings.

  • Use Cases:

    • Detect Changes to Privileged Roles: Monitor changes to roles that could grant elevated permissions.

    • Track Directory Changes: Watch for unusual modifications, such as adding a new application or changing group memberships.

3. Azure Security Center (Defender for Cloud) Alerts and Logs

• Purpose: Provides a unified view of security alerts and recommendations across your Azure environment.

• Use Cases:

  • Detect Threats: Review alerts for potential threats, such as detected malware, unauthorized access attempts, or risky configurations.

  • Remediation Tracking: Track how security recommendations are being addressed and whether security configurations are improving over time.

4. Azure Resource Logs (formerly Diagnostic Logs)

• Purpose: Logs generated by Azure resources, such as virtual machines, application gateways, and databases.

• Use Cases:

  • Monitor VM Activity: Analyze logs from Azure VMs to detect unusual activity like high CPU usage, unexpected processes, or unauthorized access.

  • Web Application Firewall (WAF) Logs: Investigate logs from Application Gateways to detect and analyze potential web attacks, like SQL injections or cross-site scripting (XSS) attempts.

5. Azure Key Vault Logs

• Purpose: Tracks access and usage of Azure Key Vaults, where sensitive information such as encryption keys and secrets are stored.

• Use Cases:

  • Monitor Access to Secrets: Look for unauthorized access attempts or unusual patterns of access to critical secrets or keys.

  • Audit Key Usage: Ensure that encryption keys are being used according to policy and that no suspicious activities are occurring, such as key deletions or unauthorized exports.

6. Azure Network Watcher Logs

• Flow Logs:

  • Purpose: Captures network traffic flowing in and out of network security groups (NSGs).

  • Use Cases:

    • Analyze Traffic Patterns: Detect anomalies in traffic, such as unexpected IP addresses communicating with your environment, or unusual port usage.

    • Identify Malicious Traffic: Look for signs of data exfiltration, lateral movement, or communication with known bad IP addresses.

• Next Hop and Connection Troubleshoot:

  • Purpose: Helps identify and troubleshoot network issues.

  • Use Cases:

    • Trace Suspicious Network Activity: Use these logs to trace the path of suspicious traffic and identify potential breaches in network security.

7. Azure Storage Logs

• Purpose: Captures data related to access and operations on Azure storage accounts, including Blob, Queue, Table, and File storage.

• Use Cases:

  • Monitor Access to Sensitive Data: Track who accessed specific storage containers or files, especially those containing sensitive data.

  • Detect Anomalies in Data Access: Identify unusual patterns in data access, such as large data downloads or access from unexpected locations.

9. Azure SQL Database Logs

• Purpose: Logs related to Azure SQL Database activities, including database connections, query execution, and security events.

• Use Cases:

  • Database Access Monitoring: Identify unauthorized or suspicious access to databases.

  • SQL Injection Detection: Analyze query logs for patterns indicative of SQL injection attacks or other database-related threats.