A sophisticated security analysis tool for identifying threat patterns and attack timelines within Azure Activity Logs and Sentinel data.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install activity-log-detector
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install activity-log-detector using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Azure Activity Log & Sentinel Threat Detector?
The Azure Activity Log & Sentinel Threat Detector is a high-performance diagnostic agent designed to serve as a virtual SOC analyst. As a standout entry in the Openclaw Skills directory, it provides deep forensic insights into Azure environments without requiring direct account access. This skill specializes in parsing exported forensic records to identify high-risk operation patterns such as unauthorized role assignments, security policy deletions, and mass resource modifications.
By leveraging the analytical power of Openclaw Skills, this tool bridges the gap between raw telemetry and actionable security intelligence. It evaluates events against the MITRE ATT&CK framework and provides structured containment recommendations, making it an essential asset for security professionals who need to maintain a read-only, data-driven investigative posture.
Azure Activity Log & Sentinel Threat Detector Use Cases
- Investigating subscription-level role assignment changes for potential privilege escalation
- Auditing security policy modifications (Microsoft.Security/policies/write) and unauthorized deletions
- Detecting mass resource deletions that may indicate a destructive attack or 'scorched earth' tactic
- Identifying Key Vault access attempts from unexpected geolocations or suspicious IP addresses
- Monitoring for Entra ID role elevations that occur outside of standard business hours
How Azure Activity Log & Sentinel Threat Detector Works
- The user exports forensic data from the Azure Portal or via the Azure CLI as a JSON or CSV file.
- This skill parses the Activity Log events to isolate high-risk operation names and security-critical activities.
- Related events are logically chained together to reconstruct a comprehensive attack timeline.
- Identified activities are mapped to specific MITRE ATT&CK Cloud techniques for standardized reporting.
- The agent generates a threat summary, containment CLI commands, and proactive KQL queries for future detection.
Azure Activity Log & Sentinel Threat Detector Setup
To utilize this agent within the Openclaw Skills framework, you must first export your logs. This skill is instruction-only and does not require your Azure credentials. Use the following bash command to prepare your data:
az monitor activity-log list \
--start-time 2025-03-15T00:00:00Z \
--end-time 2025-03-16T00:00:00Z \
--output json > activity-log.json
Ensure you have at least the Monitoring Reader role assigned to perform the export before providing the file to the agent for analysis.
Azure Activity Log & Sentinel Threat Detector Data Schema & Taxonomy
The Azure Activity Log & Sentinel Threat Detector organizes findings into a structured taxonomy common to professional Openclaw Skills. The output follows this schema:
| Component | Content Detail |
|---|---|
| Threat Summary | Quantitative count of Critical, High, and Medium findings |
| Findings Table | Tabular data including Principal, IP, Operation, and MITRE mapping |
| Attack Narrative | A plain-English reconstruction of the suspicious sequence of events |
| Containment Actions | Actionable Azure CLI commands to revoke access or lock resources |
| Sentinel KQL | Custom detection logic to prevent future occurrences |
Azure Activity Log & Sentinel Threat Detector Advanced Features
- Intelligent correlation of IP addresses with known threat intelligence databases
- Behavioral flagging for service principals operating outside their designated resource scopes
- Automated detection of shortened log retention periods (less than the default 90 days)
- Generation of production-ready KQL queries for Microsoft Sentinel integration
- Multi-source data synthesis combining Activity Logs with Microsoft Sentinel incident exports
SKILL.md
Loading
Related Openclaw Skills
Solo Leveling
A ruthless life RPG system that transforms real-world habits into an addictive progression system with AI-verified accountability.
Skill Cortex
Skill Cortex is an autonomous capability management system that enables agents to discover and master new Openclaw Skills on demand.
Healthcheck Readiness Starter Skill
A diagnostic utility that performs rapid risk posture assessments and security status reporting for your host environment.
Kuvera
A read-only CLI tool for tracking Indian market data and managing your Kuvera investment portfolio.
AWS Anomaly Explainer
An automated AWS cost incident responder that translates complex billing spikes into actionable root cause analysis and containment steps.
Azure Bandwidth Optimizer
A specialized AI tool for identifying and eliminating hidden Azure networking and data egress costs through intelligent data analysis.
Featured*
