Skip to content
Get packs

Guide · Agent skill

How to use the Azure Activity Log Threat Hunting agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains the analyzing-azure-activity-logs-for-threats agent skill, a playbook that teaches an AI agent how to hunt for threats in Microsoft Azure using Azure Monitor activity logs and sign-in logs. It is written for readers who have not used agent skills before. By the end you will know what the skill does, how to install it, how to ask for it in plain language, and what you need and should check before running anything against a live tenant.

Azure Activity Log Threat Huntingmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download the ZIP. Download the skill ZIP from this page. The skill folder is analyzing-azure-activity-logs-for-threats.
  2. 2Unzip into a skills folder. Unzip the file into ~/.claude/skills/ for a personal install, or into a project's .claude/skills/ folder to limit it to that project.
  3. 3Or upload in the Claude apps. Alternatively, go to Settings, then Capabilities, then Skills, and upload the ZIP.
  4. 4Prepare Python and libraries. Install Python 3.8 or later, plus the azure-identity and azure-monitor-query libraries.
  5. 5Set up Azure credentials and workspace access. Provide DefaultAzureCredential or a service principal with client ID, secret and tenant ID, and confirm you can reach your Log Analytics workspace.
  6. 6Ask for a hunt in plain language. Describe the threat you want to check, such as role assignment changes over 24 hours, and review the KQL the agent proposes before running it.

What does the analyzing-azure-activity-logs-for-threats skill make the agent do?

An agent skill is a folder of instructions and optional scripts that an AI agent can load when a task matches it. This one covers threat hunting in Azure. Once installed, the agent knows how to query Azure Monitor activity logs and sign-in logs with KQL (Kusto Query Language), the query language used for Azure log tables.

The skill lists five key detection queries: role assignment changes (privilege escalation), resource group and subscription modifications, Key Vault secret access from new IP addresses, network security group rule changes, and conditional access policy modifications. It also includes a Python script that runs these queries against a Log Analytics workspace and returns the results.

  • Log tables covered include AzureActivity, SigninLogs, AuditLogs, AzureDiagnostics and SecurityAlert.
  • The skill's description also mentions detecting impossible travel and privilege escalation.

How do you install the Azure threat hunting skill?

Download the ZIP file from this page and unzip it. For a personal install, place the skill folder inside ~/.claude/skills/. To limit it to one project, place it inside that project's .claude/skills/ folder instead.

You can also upload the ZIP in the Claude apps. Go to Settings, then Capabilities, then Skills, and upload the file there.

How do you trigger the skill with natural requests?

You do not need to type a special command. The skill is meant to be used when you are investigating suspicious Azure tenant activity or building cloud SIEM detections, so describe that task in your own words and name Azure where it helps.

Requests that fit the skill look like the examples below. Be specific about the time window and the kind of risk you care about, and say which workspace you are working with so the agent knows the context.

  • Write KQL to find role assignment changes in AzureActivity over the last 24 hours.
  • Check our Log Analytics workspace for network security group rule changes this week.
  • Draft a detection for Key Vault secret access from IP addresses we have not seen before.
  • Help me check whether our Azure monitoring covers MITRE ATT&CK technique T1098.003.

What do you need before the skill can run queries?

The skill needs Python 3.8 or later, the azure-identity and azure-monitor-query Python libraries, and Azure credentials. The credentials can be DefaultAzureCredential, or a service principal made of a client ID, a secret and a tenant ID. You also need access to an Azure Log Analytics workspace.

The skill's own prerequisites also ask for a test or lab environment for safe execution and appropriate authorisation for any testing. Confirm both before you connect to real logs.

  • Python 3.8+
  • azure-identity Python library
  • azure-monitor-query Python library
  • Azure credentials: DefaultAzureCredential, or a service principal client ID, secret and tenant ID
  • Access to an Azure Log Analytics workspace
from azure.identity import DefaultAzureCredential from azure.monitor.query import LogsQueryClient from datetime import timedelta credential = DefaultAzureCredential() client = LogsQueryClient(credential) response = client.query_workspace( workspace_id="WORKSPACE_ID", query="AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10", timespan=timedelta(hours=24), )

What does an example hunting query look like?

The skill's example targets Azure AD audit events. It looks for the 'Add member to role' operation in AuditLogs where the new value includes the Global Administrator role. The query is a starting point and is partial, so test it against your own data before relying on it.

The skill's reference file also shows how to read the results: it checks the response status and prints each row as a dictionary of column names and values.

query = ''' AuditLogs | where OperationName == "Add member to role" | where TargetResources[0].modifiedProperties[0].newValue has "Global Administrator" '''

What safety points should you check before running the skill?

This skill runs scripts and uses the network. The script reads live logs from your Log Analytics workspace, so it needs real credentials and can expose sensitive logs. Read scripts/agent.py before running it, and use an account with only the access the task needs.

The query examples are partial and untested. Do not run them in production without review. Keep a copy of the results in a controlled location, since they can include identities and IP addresses.

  • Only use the skill on a tenant and workspace you are authorised to access.
  • Review the script and queries before running them against live data.
  • Prefer a test or lab environment first.
  • Do not run unreviewed queries in production environments.

What people use it for

  • Drafting KQL to find role assignment changes that could indicate privilege escalation.
  • Checking whether resource group, subscription or network security group changes are visible in your logs.
  • Drafting detections for Key Vault secret access from IP addresses not seen before.
  • Validating whether your Azure monitoring covers MITRE ATT&CK techniques such as T1098.003 and T1078.004.

Frequently asked questions

Is the Azure activity log threat hunting skill free?

The skill is licensed under Apache-2.0. This page does not state any price for the skill. Azure Monitor and Log Analytics costs depend on your own Azure account, so check your billing arrangements.

What do I need to run the analyzing-azure-activity-logs-for-threats skill?

You need Python 3.8 or later, the azure-identity and azure-monitor-query libraries, Azure credentials (DefaultAzureCredential or a service principal), and access to an Azure Log Analytics workspace. You also need authorisation to access that tenant.

Where do I put the skill folder in Claude?

For a personal install, unzip it into ~/.claude/skills/. For a single project, use that project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.

Why does the script fail or return no results?

This page does not list specific troubleshooting steps. Check that your credentials are valid, that your account can reach the Log Analytics workspace, and that the workspace contains the tables the query uses, such as AzureActivity or SigninLogs. The skill's reference notes that query results are checked for a success status before reading rows.

Can I use this skill in production?

The source warns against running it in production without review, because the script reads live logs and the query examples are partial and untested. Review the code and queries and test in a lab first.

How does this compare with other Azure threat hunting tools?

This page does not compare the skill with other tools. The skill is a set of instructions and a script for an AI agent that writes and runs KQL against Azure Monitor and Log Analytics data, so it suits people who want an agent to draft those queries.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits SOC analysts, cloud security engineers and teams checking Azure monitoring coverage who want an AI agent to draft and run KQL threat hunts. It is a poor fit for anyone without authorised access to the tenant or workspace, or for production use without careful review, because the queries are partial and the script reads live logs.

Download the skill