# Analyzing Azure Activity Logs For Threats (agent skill)

> Analyzing Azure Activity Logs For Threats is an agent skill (a SKILL.md file) from mukul975/Anthropic-Cybersecurity-Skills. It queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege… It works with Claude Code, Codex, Cursor, Gemini CLI and GitHub Copilot and has 35,033 GitHub stars across a repository of 6 listed skills.

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections. Use azure-monitor-query to execute KQL queries against Azure Log Analytics workspaces, detecting suspicious admin operations and sign-in anomalies.

## Key facts

| Fact | Value |
|---|---|
| Repository | https://github.com/mukul975/Anthropic-Cybersecurity-Skills |
| Skill path | skills/analyzing-azure-activity-logs-for-threats/SKILL.md |
| Skill name | analyzing-azure-activity-logs-for-threats |
| GitHub stars | 35,033 |
| Installs on skills.sh | not listed |
| License | Apache-2.0 |
| Skills in repo | 6 |
| Plugin marketplace | anthropic-cybersecurity-skills |
| Official | no |
| Works with | Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot |
| Category | DevOps & cloud |
| Last commit | Aug 31, 2026 |

## When it triggers

- Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.

## Add this skill

### Claude Code

```sh
/plugin marketplace add mukul975/Anthropic-Cybersecurity-Skills
/plugin install cybersecurity-skills@anthropic-cybersecurity-skills
```

In the Claude apps, zip the skill folder and upload it under Customize > Skills > + > Upload a skill (code execution must be on).

### ChatGPT / Codex

```sh
git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
cp -r Anthropic-Cybersecurity-Skills/skills/analyzing-azure-activity-logs-for-threats .agents/skills/analyzing-azure-activity-logs-for-threats   # repo; ~/.agents/skills for all projects
```

### Cursor

```sh
git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
cp -r Anthropic-Cybersecurity-Skills/skills/analyzing-azure-activity-logs-for-threats .cursor/skills/analyzing-azure-activity-logs-for-threats   # project; ~/.cursor/skills for all projects
```

Sources (checked 2026-10-07): https://code.claude.com/docs/en/skills, https://support.claude.com/en/articles/12512180-using-skills-in-claude, https://learn.chatgpt.com/docs/build-skills, https://cursor.com/docs/context/skills

---

Canonical page: https://appsgit.com/skills/mukul975-analyzing-azure-activity-logs-for-threats
Source: appsgit (https://appsgit.com), the app store for github. Data from the GitHub API, refreshed daily.
Machine access: JSON API https://appsgit.com/api/v1/apps (OpenAPI: https://appsgit.com/openapi.json), MCP server https://mcp.appsgit.com/mcp, full index https://appsgit.com/llms-full.txt.