Azure Logs are being stored in a Storage account. How do I access and review logs, currently stored, for an incident investigation?

Question

Currently, we have Azure Diagnostic logs exported to a storage account. these logs include:

• AuditLogs
• SignInLogs
• NonInteractiveUserSignInLogs
• ServicePrincipalSignInLogs
• ManagedIdentitySignInLogs
• ProvisioningLogs
• ADFSSignInLogs
• RiskyUsers
• UserRiskEvents
• NetworkAccessTrafficLogs
• RiskyServicePrincipals
• ServicePrincipalRiskEvents
• EnrichedOffice365AuditLogs
• MicrosoftGraphActivityLogs we currently have data stored over a year. My question is... how do I ( as an admin ) gain access to the log and be able to query them to use in support of an investigation? What is the Best way to accomplish this?

Answer 1

@Charlie G Thanks for posting your query on Microsoft Q&A.

Q: How to access, review and query logs stored in Azure Storage account?

A: The best way to accomplish this would be using Azure Data Explorer.

You can use Azure Data Explorer to ingest logs from storage account to query them. Here is a great article describing the steps: Ingest data from a container into Azure Data Explorer

Azure Data Explorer uses the Kusto Query Language, which is an expressive, intuitive, and highly productive query language. It offers a smooth transition from simple one-liners to complex data processing scripts, and supports querying structured, semi-structured, and unstructured (text search) data. There's a wide variety of query language operators and functions (aggregation, filtering, time series functions, geospatial functions, joins, unions, and more) in the language. KQL supports cross-cluster and cross-database queries, and is feature rich from a parsing (json, XML, and more) perspective. The language also natively supports advanced analytics.

You can use the web application to run, review, and share queries and results. You can also send queries programmatically (using an SDK) or to a REST API endpoint. If you're familiar with SQL, get started with the SQL to Kusto cheat sheet.

Additional Reading:

• Quickstart: Query data in Azure Data Explorer web UI
• Write queries for Azure Data Explorer using Kusto Query Language

If you have any questions at all, let me know in the "comments". Comment is the fastest way of notifying the experts.

If this answer helped or steered you in the right direction, don't forget to 'Accept answer' and hit 'Yes' to 'was this ans helpful', wherever the information provided helps you, as this can be beneficial to other community members for remediation of similar issues.