Azure Resource Diagnostic Logs

Location

Description

Data-plane logs for individual Azure resources (Key Vault access, Storage Blob read/write, SQL audit, App Service HTTP logs) when diagnostic settings are configured to route to Log Analytics, Storage, or Event Hub.

Forensic Value

Resource logs provide data-plane visibility that Activity Logs lack. Key Vault access logs reveal which secrets, keys, and certificates were read or modified during a breach. Storage account logs show exact blob names accessed and by which identity. These logs are critical for understanding what data the attacker actually accessed versus what they merely had permissions to access.

Tools Required

Collection Commands

AzureDiagnostics | where TimeGenerated > ago(30d) | where ResourceType == "VAULTS" | where OperationName == "SecretGet" | project TimeGenerated, CallerIPAddress, identity_claim_upn_s, OperationName, id_s

az monitor diagnostic-settings list --resource <resource-id> --output json > diagnostic_settings.json

Get-AzDiagnosticSetting -ResourceId <resource-id> | ConvertTo-Json -Depth 10 > diagnostic_config.json

MITRE ATT&CK Techniques