Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-azure-activity-logs-for-threatsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-azure-activity-logs-for-threats -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-azure-activity-logs-for-threats -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/analyzing-azure-activity-logs-for-threatsgh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-azure-activity-logs-for-threatsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-azure-activity-logs-for-threats ~/.claude/skills/analyzing-azure-activity-logs-for-threats # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-azure-activity-logs-for-threats ~/.agents/skills/analyzing-azure-activity-logs-for-threats # Codex, Cursor, Gemini CLI, Copilot, OpenCode