Azure Activity Log

az monitor activity-log list --resource-group <rg>

Query the Azure Activity Log with the CLI, reviewing control plane operations on subscription resources.

Run it when you need Azure control plane activity: az monitor activity-log list returns registered operations — resource creation and modification, policy changes, management logons — with the user, status, and detail. It's the source of administrative activity for the subscription: the resource created by the attacker (the mining VM, the malicious function), the configuration change, the access by a user with permissions. In Azure IR, the Activity Log is the CloudTrail equivalent: the attacker's operation chain is reconstructed from here.

Don't use it as a complete source: the Activity Log covers the control plane (management operations) — data events (blob access, queries) are in resource logs and diagnostic logs. The default retention for the Activity Log is 90 days (long-term history requires sending to Log Analytics). And watch out for filtering: the CLI lists with simple filters (date, group, operation) — for aggregations and correlations, the KQL query on the AzureActivity table in Log Analytics is the way. The event shows the operation, not the context — correlation with other logs (Sentinel) completes the analysis. Operation failures (Failed status) are also reviewed: the attacker's failed attempt is information.