Forum Discussion

jjsantanna's avatar
jjsantanna
Brass Contributor
Apr 02, 2020

Where Cloudshell issued commands are logged?

Hi, I'm writing a monitoring rule (KQL) for identifying PowerShell and/or CloudShell issued commands. For the PowerShell, it is 'trivial' using "SecurityEvent" data. However, I didn't find how/where ...
KQL
Log Data
  • CliveWatson's avatar
    CliveWatson
    Apr 20, 2020

    jjsantanna 

     

    AFAIK it logs the session, user etc but not commands 

     

    Go to Log Analytics and run query

     

    AzureActivity
| where ResourceGroup startswith "CLOUD-SHELL"
| extend action_ = tostring(parse_json(Authorization).action) 
| summarize count() by ResourceGroup  , Caller , CallerIpAddress , ActivityStatusValue , ActivitySubstatusValue,  CategoryValue , action_

     

    // List sucess vs. failure 
AzureActivity
| where ResourceGroup startswith "CLOUD-SHELL"
| summarize count(ActivityStatus) by Caller, ActivityStatus
Rod_Trent's avatar
Rod_Trent
Icon for Microsoft rankMicrosoft
To close this out...here's a query that can be used by Microsoft Sentinel to track Cloud Shell usage using the AzureActivity table: https://cda.ms/3vJ
bijaykumar1857's avatar
bijaykumar1857
Copper Contributor
Jul 30, 2024

Rod_Trent  can you please provide the information about logging cloudhsell commands logs in log analytics

Resources