Cloud / Audit
AzureActivity
Azure subscription-level management events including resource CRUD, RBAC changes, and service health
Recommendation
High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.
How the matrix worksC3 Identity, privilege, and configuration changes
Identity, privilege, and configuration changes: directory audit, cloud control plane, RBAC, Kubernetes API, security tool administration, virtualisation and MDM management
ACSC
- 2. Network device logsConfiguration changes
- 6. Virtualisation system logs
- 8. Cloud platform logging
- 9. Container logs
- 11. Mobile device management
CISA
- 1. Identity, credential, and access management (ICAM)1a Manage and track changes in attributes and credentials
- 4. Cloud environments (general logging)4a Any activity on breakglass accounts
- 5. Amazon Web Services (AWS)5a AWS CloudTrail
- 6. Cloud Azure6a-6b Azure Active Directory logs and Azure Activity
- 8. Google Cloud Platform (GCP)8a Admin audit
MITRE data sources
- Cloud Service: Cloud Service Modification
T1 Near-real-time detection
Generic detections need near-real-time matching on single events.
No lake support in the Azure Monitor table feature matrix
Fields detections use
High-value fields
Most used in public rules
TimeGenerated48Caller41OperationNameValue34CallerIpAddress33ActivityStatusValue22SubscriptionId17CorrelationId16ResourceGroup16ResourceId13CategoryValue12_ResourceId8OperationName7
Split hints
Rows to keep in Analytics with a split rule.
Keep write/delete operations and failures in Analytics; read-only success events to Data Lake
CategoryValue in ("Administrative", "Security", "Policy") or ActivityStatusValue == "Failed" or (OperationNameValue has "delete" or OperationNameValue has "write" or OperationNameValue has "action")Sources for this recommendation
- Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.