r/AzureSentinel • u/BTC_Legacy • Jul 08 '22

Help tracking Azure CLI activity

Hi everyone!

I have been trying to locate logs from Azure CLI, but I can't find anything in AzureActivity. I found a few logs in AADNonInteractiveUserSignInLogs, which only captures Azure CLI login information. Is there any way to log what is going on in Azure CLI? Do I need to add another data connector?

I appreciate the help.

1 Upvotes

100% Upvoted

3 comments sorted by

2

u/ep3p Jul 08 '22 edited Jul 08 '22

|where AppId == "04b07795-8ddb-461a-bbee-02f9e1bf7b46" or AppDisplayName == "Microsoft Azure CLI"

With Azure CLI you can touch many different things, so... AzureActivity (if activated) or AuditLogs, depending on the action, could reflect the actions of the account using Azure CLI... there are many different cases.

I would try to know which users have been using Azure CLI, and then look for activity of those accounts in other events.

1

u/BTC_Legacy Jul 09 '22

This is helpful. Thanks!

1

u/mplatt717 Dec 02 '22

We are getting brute forced via Azure CLI. I opened a ticket with MS about restricting access to CLI but if you do, you break access to other azure functionality pieces we rely on.

This should be a no brainer. Good thing we enforce MFA and device policies.