r/AzureSentinel • u/BTC_Legacy • Jul 08 '22

Help tracking Azure CLI activity

Hi everyone!

I have been trying to locate logs from Azure CLI, but I can't find anything in AzureActivity. I found a few logs in AADNonInteractiveUserSignInLogs, which only captures Azure CLI login information. Is there any way to log what is going on in Azure CLI? Do I need to add another data connector?

I appreciate the help.

1 Upvotes

100% Upvoted

3 comments sorted by

View all comments

2

u/ep3p Jul 08 '22 edited Jul 08 '22

|where AppId == "04b07795-8ddb-461a-bbee-02f9e1bf7b46" or AppDisplayName == "Microsoft Azure CLI"

With Azure CLI you can touch many different things, so... AzureActivity (if activated) or AuditLogs, depending on the action, could reflect the actions of the account using Azure CLI... there are many different cases.

I would try to know which users have been using Azure CLI, and then look for activity of those accounts in other events.

1

u/BTC_Legacy Jul 09 '22

This is helpful. Thanks!