Skip to content
appsgit

Analyzing Azure Activity Logs For Threats

Analyzing Azure Activity Logs For Threats is an agent skill (a SKILL.md file) from mukul975/Anthropic-Cybersecurity-Skills. It queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege… It works with Claude Code, Codex, Cursor, Gemini CLI and GitHub Copilot and has 35,033 GitHub stars across a repository of 6 listed skills.

github.com/mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-azure-activity-logs-for-threats (opens in a new tab)

Data as of from the GitHub API; description from the skill's SKILL.md. Report an error

View on GitHub (opens in a new tab)

Add this skill

Claude

This repository is a Claude Code plugin marketplace. In Claude Code:

/plugin marketplace add mukul975/Anthropic-Cybersecurity-Skills
/plugin install cybersecurity-skills@anthropic-cybersecurity-skills

In the Claude apps, zip the analyzing-azure-activity-logs-for-threats folder and upload it under Customize > Skills > + > Upload a skill (code execution must be on).

ChatGPT / Codex

Codex reads skills from .agents/skills/ in a repo or ~/.agents/skills/ for every project:

git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
cp -r Anthropic-Cybersecurity-Skills/skills/analyzing-azure-activity-logs-for-threats .agents/skills/analyzing-azure-activity-logs-for-threats   # repo; ~/.agents/skills for all projects

Standalone skills also load in the ChatGPT desktop app.

Cursor

Cursor loads skills from .cursor/skills/ (or ~/.cursor/skills/) and also reads .claude/skills/:

git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
cp -r Anthropic-Cybersecurity-Skills/skills/analyzing-azure-activity-logs-for-threats .cursor/skills/analyzing-azure-activity-logs-for-threats   # project; ~/.cursor/skills for all projects

Source (checked Oct 7, 2026): code.claude.com/docs/en/skills (opens in a new tab), code.claude.com/docs/en/plugin-marketplaces (opens in a new tab), support.claude.com/en/articles/12512180-using-skills-in-claude (opens in a new tab), learn.chatgpt.com/docs/build-skills (opens in a new tab), cursor.com/docs/context/skills (opens in a new tab)

What this skill does

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections. Use azure-monitor-query to execute KQL queries against Azure Log Analytics workspaces, detecting suspicious admin operations and sign-in anomalies.

When it triggers

  • Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.

More skills in mukul975/Anthropic-Cybersecurity-Skills

6 skills are listed from this repository.

Similar skills

More devops & cloud skills

All DevOps & cloud

FAQ

Analyzing Azure Activity Logs For Threats FAQ

Still curious? Email info@appsgit.com.

How do I install the Analyzing Azure Activity Logs For Threats skill?

In Claude Code, run /plugin marketplace add mukul975/Anthropic-Cybersecurity-Skills and then /plugin install cybersecurity-skills@anthropic-cybersecurity-skills. For Codex or Cursor, copy the analyzing-azure-activity-logs-for-threats folder into .agents/skills/ or .cursor/skills/.

Is the Analyzing Azure Activity Logs For Threats skill free?

Yes. The repository is open source under the Apache-2.0 license.

Is Analyzing Azure Activity Logs For Threats maintained?

The repository's most recent commit was on Aug 31, 2026. Its latest release is v1.3.0. appsgit only lists skills from repositories with a commit in the last six months.