Skip to content
Get packs

Azure Activity Log Threat Hunting

Queries Azure logs with KQL to spot suspicious admin changes, privilege escalation and odd sign-ins.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill gives an AI agent a playbook for hunting threats in Microsoft Azure. Once installed, the agent knows how to query Azure Monitor activity logs and sign-in logs using KQL (a query language) to look for risky actions such as role assignment changes, changes to resource groups, network security rules, and Key Vault access from new IP addresses. It also includes a Python script that runs these queries against a Log Analytics workspace and returns the results.

Great for

  • SOC analysts who want an agent to draft or run Azure threat-hunting queries
  • Cloud security engineers building detections for Azure tenants
  • Teams validating monitoring coverage for MITRE ATT&CK techniques in Azure

Skip it if

  • Users without authorised access to the Azure tenant or Log Analytics workspace, since the queries need real credentials and could expose sensitive logs
  • Production environments run without review, because the script reads live logs and the query examples are partial and untested

Try asking

  • “Check my Azure workspace for role assignment changes in the last 24 hours and flag anything unusual.”
  • “Write a KQL query that detects new Global Administrator assignments.”
  • “Build a detection for Key Vault secret access from IP addresses we have not seen before.”
Step-by-step guide: how to use Azure Activity Log Threat HuntingInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-azure-activity-logs-for-threats.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-azure-activity-logs-for-threats.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-azure-activity-logs-for-threats.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run it against a test or lab workspace first, and use read-only credentials where possible.
  • Review the KQL queries before running them, since the examples in SKILL.md are short excerpts and may need tuning for your tenant.
  • Pass service principal credentials through environment variables or a secrets manager rather than pasting them into prompts.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.