Azure Activity Logs

Azure Activity Logs provide a record of operations performed on Azure resources, offering insights into control plane actions such as resource creation, modification, and deletion. These logs include details like the user who initiated the action, the timestamp, and the result of the operation. Azure Activity Logs are crucial for auditing changes, monitoring resource management, and ensuring compliance with organizational governance and security policies.

Ingest Methods

Azure activity logs can be ingested using either an Azure storage bucket or pushed to RunReveal using a webhook.

Azure storage buckets are inherently cheaper than using the webhook method but logs can be delayed by up to an hour. The webhook ingestion imports logs as soon as they are generated, but using an event hub can become more expensive if there are lots of logs.

• Azure Blob Storage
• Webhook Ingestion

Setup

Azure Blob StorageWebhook Ingestion

After creating your storage account and other resources, you will need to setup activity logs to forward to it.

On the Activity Log resource page, click on the "Export Activity Logs" button.

On the diagnostic settings page, add a new diagnostic setting. Give the diagnostic setting a name, choose the categories you wish to include in your events, and select "Archive to a storage account" selecting the storage account that was created.

Verify It's Working

Once added the source logs should begin flowing within a minute.

You can validate we are receiving your logs by running the following SQL query.

SELECT * FROM runreveal.logs WHERE sourceType = 'azure-activity' LIMIT 1

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.