Azure Monitor Audit

What it does

This skill allows an AI agent to query and interpret Azure Monitor Audit Logs. It can retrieve information about user activity, resource changes, and security events within an Azure environment. The agent can then summarize these logs or extract specific details based on provided criteria, aiding in compliance checks and incident investigation.

When to use it

• Compliance Auditing: Generate reports demonstrating adherence to regulatory requirements by extracting relevant audit log data.
• Security Incident Response: Quickly identify the root cause of a security event by analyzing user actions and resource modifications around the time of the incident.
• Resource Change Tracking: Determine who made changes to specific Azure resources (e.g., virtual machines, storage accounts) and when those changes occurred.
• User Activity Monitoring: Track user logins, access attempts, and other activities within an Azure tenant for security monitoring purposes.

Key capabilities

• Query Azure Monitor Audit Logs
• Filter logs by time range, resource type, or user identity
• Summarize audit log data
• Extract specific details from audit events

Example prompts

• "Show me all login attempts to the Azure portal in the last 24 hours."
• "What changes were made to the 'my-vm' virtual machine yesterday?"
• "Generate a report of user activity on storage accounts for compliance purposes."

Tips & gotchas

• Requires appropriate Azure permissions (e.g., Reader, Contributor) to access Audit Logs.
• Audit logs retention period is limited; ensure sufficient retention policies are in place if historical data is needed.