Skip to content
Sign In
Telemetry

azure:activitylogs

Azure Activity Log (control plane)

Host type
Azure (platform and Entra ID)
Tier, as a whole
Minimum
Cost class
Included
Techniques
9
Rules listed
122
Events
15

Why this tier

CISA/ASD priority source; OMB M-26-14 A1 (Identity used; our analysis); OMB M-26-14 A5 (Infrastructure changes; our analysis)

Licensing

License or service
Azure Monitor
What is free
Free from ingestion charges; 90-day retention
What costs
Nothing (Activity Log type exempt)
Notes
"Azure Activity Logs are free from ingestion charges"
Vendor page
https://azure.microsoft.com/pricing/details/log-analytics/
As read on
2026-11-01

A vendor statement as read on the date shown; the cost class is the durable part.

Standards and guidance naming this source

RequirementRelationBasis
OMB M-26-14: Identity usedSupports an activityour analysis: caller on every control-plane operation
OMB M-26-14: Infrastructure changesSupports an activityour analysis: resource create delete and modify
ASD ACSC / CISA et al.: Priority enterprise log sourcespriority_sourcequoted (cloud): logs for administrative configuration changes

Techniques

Rules

Splunk 8
Sigma 35
Elastic 52
Microsoft Sentinel 27

Events

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.