Identity / Authentication and sign-in

AADCustomSecurityAttributeAuditLogs

Entra audit events for custom security attribute definition and assignment changes (add, update, delete)

Analytics Data lake Primary Secondary Primary · Analytics365 days retention

High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.

How the matrix works

C3 Identity, privilege, and configuration changes

Identity, privilege, and configuration changes: directory audit, cloud control plane, RBAC, Kubernetes API, security tool administration, virtualisation and MDM management

ACSC

2. Network device logsConfiguration changes
6. Virtualisation system logs
8. Cloud platform logging
9. Container logs
11. Mobile device management

CISA

1. Identity, credential, and access management (ICAM)1a Manage and track changes in attributes and credentials
4. Cloud environments (general logging)4a Any activity on breakglass accounts
5. Amazon Web Services (AWS)5a AWS CloudTrail
6. Cloud Azure6a-6b Azure Active Directory logs and Azure Activity
8. Google Cloud Platform (GCP)8a Admin audit

MITRE data sources

None recorded

T1 Near-real-time detection

Generic detections need near-real-time matching on single events.

Lake supported in the Azure Monitor table feature matrix

Sources for this recommendation

Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.