azure:platformlogs
Azure resource/platform logs (diagnostic settings)
- Host type
- Azure (platform and Entra ID)
- Tier, as a whole
- Recommended
- Cost class
- Usage billed
- Techniques
- 0
- Rules listed
- 99
- Events
- 31
Licensing
- License or service
- Azure Monitor diagnostic settings
- What is free
- Configuration
- What costs
- Log Analytics ingestion+retention; kube-audit flagged as substantial cost
- Notes
- Use kube-audit-admin or Basic logs to cut cost
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Techniques
No ATT&CK analytic names this source.
Rules
Elastic 31
- Azure AD Graph Access with Suspicious User-Agent
- Azure AD Graph Access with Unusual Client and User
- Azure AD Graph Access with Unusual User and ASN
- Azure AD Graph High 4xx Error Ratio from User
- Azure AD Graph Potential Enumeration (ROADrecon)
- Azure AKS API Server Proxying Request to Kubelet
- Azure AKS Attempted User Exec into Pod
- Azure AKS Certificate Signing Request Created or Approved
- Azure AKS CoreDNS or Kube-DNS Configuration Modified
- Azure AKS Ephemeral Container Added to Pod
- Azure AKS Kubelet Proxy to Command Execution Endpoint
- Azure AKS Kubernetes Events Deleted
- Azure AKS Multi-Resource Setup Discovery
- Azure AKS Pod Exec Potential Reverse Shell
- Azure AKS Potential API Enumeration by User
- Azure AKS Secret get or list with Suspicious User Agent
- Azure AKS Service Account Token Created via TokenRequest API
- Azure AKS Suspicious Self-Subject Review by Service Account or Node Identity
- Azure Key Vault Excessive Secret or Key Retrieved
- Azure Key Vault Unusual Secret Key Usage
- Azure Storage Anonymous Blob Access to Unusual Resource
- Azure Storage Blob Retrieval via AzCopy
- Entra ID External Authentication Methods (EAM) Modified
- Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration
- Entra ID OAuth User Impersonation to Microsoft Graph
- Entra ID Sign-in BloodHound Suite User-Agent Detected
- Microsoft Graph Email Access by Unusual User and Client
- Microsoft Graph Multi-Category Reconnaissance Burst
- Microsoft Graph Request User Impersonation by Unusual Client
- Multiple Cloud Secrets Accessed by Source Address
- Splunk Enterprise PostgreSQL Recovery Endpoint Injection Artifacts
Microsoft Sentinel 68
- A potentially malicious web request was executed against a web server
- AFD WAF - Code Injection
- AFD WAF - Path Traversal Attack
- Abnormal Deny Rate for Source IP
- Abnormal Port to Protocol
- Affected rows stateful anomaly on database
- Anomaly found in Network Session Traffic (ASIM Network Session schema)
- App GW WAF - Code Injection
- App GW WAF - Path Traversal Attack
- App Gateway WAF - SQLi Detection
- App Gateway WAF - Scanner Detection
- App Gateway WAF - XSS Detection
- Application Gateway WAF - SQLi Detection
- Application Gateway WAF - XSS Detection
- Azure Key Vault access TimeSeries anomaly
- Azure WAF matching for Log4j vuln(CVE-2021-44228)
- Credential errors stateful anomaly on database
- DDoS Attack IP Addresses - PPS Threshold
- DDoS Attack IP Addresses - Percent Threshold
- DNS events related to ToR proxies (ASIM DNS Schema)
- DNS events related to mining pools (ASIM DNS Schema)
- Detect port misuse by anomaly based detection (ASIM Network Session schema)
- Detect port misuse by static threshold (ASIM Network Session schema)
- Drop attempts stateful anomaly on database
- Europium - Hash and IP IOCs - September 2022
- Excessive NXDOMAIN DNS Queries (ASIM DNS Schema)
- Excessive number of failed connections from a single source (ASIM Network Session schema)
- Execution attempts stateful anomaly on database
- Firewall errors stateful anomaly on database
- Firewall rule manipulation attempts stateful anomaly on database
- Front Door Premium WAF - SQLi Detection
- Front Door Premium WAF - XSS Detection
- GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)
- Known Forest Blizzard group domains - July 2019
- Log4j vulnerability exploit aka Log4Shell IP IOC
- Malformed user agent
- Mass secret retrieval from Azure Key Vault
- Mercury - Domain, Hash and IP IOCs - August 2022
- Multiple Sources Affected by the Same TI Destination
- NRT Sensitive Azure Key Vault operations
- Network Port Sweep from External Network (ASIM Network Session schema)
- OLE object manipulation attempts stateful anomaly on database
- Outgoing connection attempts stateful anomaly on database
- Port Scan
- Port Sweep
- Port scan detected (ASIM Network Session schema)
- Possible Phishing with CSL and Network Sessions
- Potential DGA detected (ASIM DNS Schema)
- Potential beaconing activity (ASIM Network Session schema)
- Response rows stateful anomaly on database
- Sensitive Azure Key Vault operations
- Several deny actions registered
- Star Blizzard C2 Domains August 2022
- Syntax errors stateful anomaly on database
- TI Map Domain entity to Dns Events (ASIM DNS Schema)
- TI Map IP Entity to Azure SQL Security Audit Events
- TI Map IP Entity to Azure SQL Security Audit Events
- TI Map IP entity to Azure Key Vault logs
- TI Map IP entity to AzureFirewall
- TI Map IP entity to DNS Events (ASIM DNS schema)
- TI Map IP entity to Network Session Events (ASIM Network Session schema)
- TI map Domain entity to Dns Events (ASIM DNS Schema)
- TI map IP entity to Azure Key Vault logs
- TI map IP entity to AzureFirewall
- TI map IP entity to DNS Events (ASIM DNS schema)
- TI map IP entity to Network Session Events (ASIM Network Session schema)
- User agent search for log4j exploitation attempt
- [Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022
Events
Listed (29)
- CertificateContactsGet
- CertificateGet
- CertificateGetDeleted
- CertificateIssuerGet
- CertificateIssuersList
- CertificateList
- CertificateListDeleted
- CertificateListVersions
- CertificatePolicyGet
- GetBlob
- GetBlobMetadata
- GetBlobProperties
- GetBlockList
- GetContainerAcl
- GetContainerMetadata
- GetContainerProperties
- GetPageRanges
- GetSecretValue
- KeyGetDeleted
- KeyList
- KeyListDeleted
- KeyListVersions
- ListBlobs
- QueryBlobContents
- SecretGetDeleted
- SecretList
- SecretListDeleted
- SecretListVersions
- VaultGet