Skip to content
Azure Forensics

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.

Posts tagged: #incident-response

← Back to all posts
Azure log forensics limits: retention and missing logs
Azure Activity Log retention is 90 days and resource logs are off by default. What each Azure log cannot tell you, and how to write an honest conclusion.
azureloggingincident-responseactivity-log
An Azure breach, walked through (fictional case)
A fictional Azure breach investigated end to end: leaked app secret, self-assigned role, Run Command, stolen managed identity token, Key Vault and blob theft.
azureincident-responsecase-studyactivity-log
Key Vault audit logs: who read which secret, and when
Use Azure Key Vault audit logs (AuditEvent) to find who read which secret: SecretGet and SecretList, access policy changes, new principals and enumeration.
azurekey-vaultincident-responsemitre-attack
Azure Activity Log analysis, step by step, in your browser
Step-by-step Azure Activity Log analysis with the free Azure Forensics analyzer: load exports, read the verdict, findings, timeline and entities, export.
azureactivity-logincident-responsehow-to
Azure subscription compromised? An incident response guide
Think your Azure subscription is compromised? Which logs to preserve first, the operations that betray an attacker, and how to go from Activity Log to verdict.
azureincident-responseactivity-logmitre-attack

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.