Skip to content
Azure Forensics

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.

Glossary

Diagnostic setting

The Azure Monitor configuration that sends a resource's logs (or the subscription's Activity Log) to Log Analytics, a storage account or Event Hubs.

A diagnostic setting tells Azure Monitor to send a resource's logs and metrics — for example Key Vault AuditEvent or storage StorageRead — to a Log Analytics workspace, a storage account or Event Hubs. At subscription scope, it exports the Activity Log beyond its 90-day retention.

Without one, resource logs are simply not collected, and nothing can be recovered later. Deleting one (microsoft.insights/diagnosticSettings/delete) is a classic defense-evasion step, recorded in the Activity Log. Microsoft's reference: Diagnostic settings in Azure Monitor.

Investigating deletions: Azure defense evasion.

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.