Identity / Authentication and sign-in
MicrosoftGraphActivityLogs
Microsoft Graph API request activity logs showing API calls made by applications and users
Recommendation
High-value events at high volume detected through aggregation or jobs, or high-value context used mainly in investigations.
How the matrix worksC7 Data access
Data access: storage, database audit and queries, API data access, directory queries, and audit log access
ACSC
- 6. Virtualisation system logsAudit log access
- 8. Cloud platform loggingStorage and cloud API logs
- 9. Container logsAudit log access
- 10. Database logsDatabases and audit log access
- 14. Apple MacOS endpoint logsAudit log access
CISA
No event type
MITRE data sources
- Application Log: Application Log Content
T3 High-volume aggregation
Primary, high or very-high volume, and the generic detection use is aggregation, threat-intelligence matching, baselining, or investigation.
Lake supported in the Azure Monitor table feature matrix
Sources for this recommendation
- Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.