Azure Storage Analytics & Diagnostic Logs

Location

Description

Storage account access logs recording every read, write, delete, and list operation on blobs, files, tables, and queues with authenticated identity, source IP, request URL, and response status.

Forensic Value

Storage analytics logs prove exactly which blobs and files were accessed or exfiltrated during a breach. Each log entry includes the authenticated caller identity, client IP address, and the specific object URL accessed. Bulk GetBlob operations indicate mass data download. ListBlob operations reveal reconnaissance of storage contents. Comparing access patterns against normal baseline identifies anomalous data access. These logs are critical for quantifying data exposure in breach notification.

Tools Required

Collection Commands

StorageBlobLogs | where TimeGenerated > ago(30d) | where OperationName == "GetBlob" | summarize DownloadCount=count(), TotalBytes=sum(ResponseBodySize) by CallerIpAddress, AccountName | sort by TotalBytes desc

az storage logging show --account-name <storage-account> --services b --output json > storage_logging_config.json

az storage blob list --account-name <storage-account> --container-name \$logs --output json > storage_analytics_logs.json

MITRE ATT&CK Techniques