> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/azure-audit-log.md).

# Azure Audit Log

Alerts related to data source "Azure Audit Log".

| Alert                                                                                                                                                                                                                              |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [A cloud identity created or modified a security group](/analytics-alerts/alerts-by-name/a-cloud-identity-created-or-modified-a-security-group.md)                                                                                 |
| [A cloud identity executed an API call from an unusual country](/analytics-alerts/alerts-by-name/a-cloud-identity-executed-an-api-call-from-an-unusual-country.md)                                                                 |
| [A cloud identity had escalated its permissions](/analytics-alerts/alerts-by-name/a-cloud-identity-had-escalated-its-permissions.md)                                                                                               |
| [A cloud identity invoked IAM related persistence operations](/analytics-alerts/alerts-by-name/a-cloud-identity-invoked-iam-related-persistence-operations.md)                                                                     |
| [A cloud identity performed multiple unusual activities](/analytics-alerts/alerts-by-name/a-cloud-identity-performed-multiple-unusual-activities.md)                                                                               |
| [A cloud instance was stopped](/analytics-alerts/alerts-by-name/a-cloud-instance-was-stopped.md)                                                                                                                                   |
| [A cloud storage configuration was modified](/analytics-alerts/alerts-by-name/a-cloud-storage-configuration-was-modified.md)                                                                                                       |
| [A cloud storage object was copied to a foreign cloud account](/analytics-alerts/alerts-by-name/a-cloud-storage-object-was-copied-to-a-foreign-cloud-account.md)                                                                   |
| [A container registry was created or deleted](/analytics-alerts/alerts-by-name/a-container-registry-was-created-or-deleted.md)                                                                                                     |
| [A Kubernetes API operation was successfully invoked by an anonymous user](/analytics-alerts/alerts-by-name/a-kubernetes-api-operation-was-successfully-invoked-by-an-anonymous-user.md)                                           |
| [A Kubernetes cluster role binding was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-cluster-role-binding-was-created-or-deleted.md)                                                                           |
| [A Kubernetes cluster role was created](/analytics-alerts/alerts-by-name/a-kubernetes-cluster-role-was-created.md)                                                                                                                 |
| [A Kubernetes cluster was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-cluster-was-created-or-deleted.md)                                                                                                     |
| [A Kubernetes ConfigMap was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-configmap-was-created-or-deleted.md)                                                                                                 |
| [A Kubernetes Cronjob was created](/analytics-alerts/alerts-by-name/a-kubernetes-cronjob-was-created.md)                                                                                                                           |
| [A Kubernetes DaemonSet was created](/analytics-alerts/alerts-by-name/a-kubernetes-daemonset-was-created.md)                                                                                                                       |
| [A Kubernetes dashboard service account was used outside the cluster](/analytics-alerts/alerts-by-name/a-kubernetes-dashboard-service-account-was-used-outside-the-cluster.md)                                                     |
| [A Kubernetes deployment was created](/analytics-alerts/alerts-by-name/a-kubernetes-deployment-was-created.md)                                                                                                                     |
| [A Kubernetes ephemeral container was created](/analytics-alerts/alerts-by-name/a-kubernetes-ephemeral-container-was-created.md)                                                                                                   |
| [A Kubernetes namespace was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-namespace-was-created-or-deleted.md)                                                                                                 |
| [A Kubernetes node service account activity from external IP](/analytics-alerts/alerts-by-name/a-kubernetes-node-service-account-activity-from-external-ip.md)                                                                     |
| [A Kubernetes Pod was created with a sidecar container](/analytics-alerts/alerts-by-name/a-kubernetes-pod-was-created-with-a-sidecar-container.md)                                                                                 |
| [A Kubernetes Pod was deleted](/analytics-alerts/alerts-by-name/a-kubernetes-pod-was-deleted.md)                                                                                                                                   |
| [A Kubernetes ReplicaSet was created](/analytics-alerts/alerts-by-name/a-kubernetes-replicaset-was-created.md)                                                                                                                     |
| [A Kubernetes role binding was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-role-binding-was-created-or-deleted.md)                                                                                           |
| [A Kubernetes secret was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-secret-was-created-or-deleted.md)                                                                                                       |
| [A Kubernetes service account executed an unusual API call](/analytics-alerts/alerts-by-name/a-kubernetes-service-account-executed-an-unusual-api-call.md)                                                                         |
| [A Kubernetes service account has enumerated its permissions](/analytics-alerts/alerts-by-name/a-kubernetes-service-account-has-enumerated-its-permissions.md)                                                                     |
| [A Kubernetes service account was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-service-account-was-created-or-deleted.md)                                                                                     |
| [A Kubernetes service was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-service-was-created-or-deleted.md)                                                                                                     |
| [A Kubernetes StatefulSet was created](/analytics-alerts/alerts-by-name/a-kubernetes-statefulset-was-created.md)                                                                                                                   |
| [A new Azure email domain verification was requested](/analytics-alerts/alerts-by-name/a-new-azure-email-domain-verification-was-requested.md)                                                                                     |
| [A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment](/analytics-alerts/alerts-by-name/a-new-server-was-added-to-an-azure-active-directory-hybrid-health-adfs-environment.md)                       |
| [A Service Principal was created in Azure](/analytics-alerts/alerts-by-name/a-service-principal-was-created-in-azure.md)                                                                                                           |
| [A Service Principal was removed from Azure](/analytics-alerts/alerts-by-name/a-service-principal-was-removed-from-azure.md)                                                                                                       |
| [AI model discovery](/analytics-alerts/alerts-by-name/ai-model-discovery.md)                                                                                                                                                       |
| [AI safeguards deletion attempt](/analytics-alerts/alerts-by-name/ai-safeguards-deletion-attempt.md)                                                                                                                               |
| [AI safeguards were modified](/analytics-alerts/alerts-by-name/ai-safeguards-were-modified.md)                                                                                                                                     |
| [Allocation of multiple cloud compute resources](/analytics-alerts/alerts-by-name/allocation-of-multiple-cloud-compute-resources.md)                                                                                               |
| [An Azure application reached a throttling API rate](/analytics-alerts/alerts-by-name/an-azure-application-reached-a-throttling-api-rate.md)                                                                                       |
| [An Azure DNS Zone was modified](/analytics-alerts/alerts-by-name/an-azure-dns-zone-was-modified.md)                                                                                                                               |
| [An Azure Firewall policy deletion](/analytics-alerts/alerts-by-name/an-azure-firewall-policy-deletion.md)                                                                                                                         |
| [An Azure Firewall rule collection group was modified or deleted](/analytics-alerts/alerts-by-name/an-azure-firewall-rule-collection-group-was-modified-or-deleted.md)                                                             |
| [An Azure firewall rule group was modified](/analytics-alerts/alerts-by-name/an-azure-firewall-rule-group-was-modified.md)                                                                                                         |
| [An Azure Firewall was modified](/analytics-alerts/alerts-by-name/an-azure-firewall-was-modified.md)                                                                                                                               |
| [An Azure identity performed multiple actions that were denied](/analytics-alerts/alerts-by-name/an-azure-identity-performed-multiple-actions-that-were-denied.md)                                                                 |
| [An Azure Key Vault key was modified](/analytics-alerts/alerts-by-name/an-azure-key-vault-key-was-modified.md)                                                                                                                     |
| [An Azure Key Vault was modified](/analytics-alerts/alerts-by-name/an-azure-key-vault-was-modified.md)                                                                                                                             |
| [An Azure Kubernetes Cluster was created or deleted](/analytics-alerts/alerts-by-name/an-azure-kubernetes-cluster-was-created-or-deleted.md)                                                                                       |
| [An Azure Kubernetes Role or Cluster-Role was modified](/analytics-alerts/alerts-by-name/an-azure-kubernetes-role-or-cluster-role-was-modified.md)                                                                                 |
| [An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted](/analytics-alerts/alerts-by-name/an-azure-kubernetes-role-binding-or-cluster-role-binding-was-modified-or-deleted.md)                           |
| [An Azure Kubernetes Service Account was modified or deleted](/analytics-alerts/alerts-by-name/an-azure-kubernetes-service-account-was-modified-or-deleted.md)                                                                     |
| [An Azure Network Security Group was modified](/analytics-alerts/alerts-by-name/an-azure-network-security-group-was-modified.md)                                                                                                   |
| [An Azure Point-to-Site VPN was modified](/analytics-alerts/alerts-by-name/an-azure-point-to-site-vpn-was-modified.md)                                                                                                             |
| [An Azure SQL database was exported from a production subscription](/analytics-alerts/alerts-by-name/an-azure-sql-database-was-exported-from-a-production-subscription.md)                                                         |
| [An Azure Suppression Rule was created](/analytics-alerts/alerts-by-name/an-azure-suppression-rule-was-created.md)                                                                                                                 |
| [An Azure virtual network Device was modified](/analytics-alerts/alerts-by-name/an-azure-virtual-network-device-was-modified.md)                                                                                                   |
| [An Azure virtual network was modified](/analytics-alerts/alerts-by-name/an-azure-virtual-network-was-modified.md)                                                                                                                 |
| [An Azure VM snapshot SAS URL was generated](/analytics-alerts/alerts-by-name/an-azure-vm-snapshot-sas-url-was-generated.md)                                                                                                       |
| [An Azure VM snapshot SAS URL was generated for export from a production subscription](/analytics-alerts/alerts-by-name/an-azure-vm-snapshot-sas-url-was-generated-for-export-from-a-production-subscription.md)                   |
| [An Azure VPN Connection was modified](/analytics-alerts/alerts-by-name/an-azure-vpn-connection-was-modified.md)                                                                                                                   |
| [An identity accessed a backup cloud storage](/analytics-alerts/alerts-by-name/an-identity-accessed-a-backup-cloud-storage.md)                                                                                                     |
| [An identity accessed a cloud storage for the first time](/analytics-alerts/alerts-by-name/an-identity-accessed-a-cloud-storage-for-the-first-time.md)                                                                             |
| [An identity accessed Azure Kubernetes Secrets](/analytics-alerts/alerts-by-name/an-identity-accessed-azure-kubernetes-secrets.md)                                                                                                 |
| [An identity initiated a download of multiple cloud objects](/analytics-alerts/alerts-by-name/an-identity-initiated-a-download-of-multiple-cloud-objects.md)                                                                       |
| [An identity performed a suspicious download of multiple cloud storage objects](/analytics-alerts/alerts-by-name/an-identity-performed-a-suspicious-download-of-multiple-cloud-storage-objects.md)                                 |
| [An identity was granted permissions to manage user access to Azure resources](/analytics-alerts/alerts-by-name/an-identity-was-granted-permissions-to-manage-user-access-to-azure-resources.md)                                   |
| [An operation was performed by an identity from a domain that was not seen in the organization](/analytics-alerts/alerts-by-name/an-operation-was-performed-by-an-identity-from-a-domain-that-was-not-seen-in-the-organization.md) |
| [An unusual read activity of cloud object](/analytics-alerts/alerts-by-name/an-unusual-read-activity-of-cloud-object.md)                                                                                                           |
| [Attempted Azure application access from unknown tenant](/analytics-alerts/alerts-by-name/attempted-azure-application-access-from-unknown-tenant.md)                                                                               |
| [Authentication method was added to Azure account](/analytics-alerts/alerts-by-name/authentication-method-was-added-to-azure-account.md)                                                                                           |
| [Azure application removed](/analytics-alerts/alerts-by-name/azure-application-removed.md)                                                                                                                                         |
| [Azure Automation Account Creation](/analytics-alerts/alerts-by-name/azure-automation-account-creation.md)                                                                                                                         |
| [Azure Automation Runbook Creation/Modification](/analytics-alerts/alerts-by-name/azure-automation-runbook-creation-modification.md)                                                                                               |
| [Azure Automation Runbook Deletion](/analytics-alerts/alerts-by-name/azure-automation-runbook-deletion.md)                                                                                                                         |
| [Azure Automation Webhook creation](/analytics-alerts/alerts-by-name/azure-automation-webhook-creation.md)                                                                                                                         |
| [Azure Blob Container Access Level Modification](/analytics-alerts/alerts-by-name/azure-blob-container-access-level-modification.md)                                                                                               |
| [Azure conditional access policy creation or modification](/analytics-alerts/alerts-by-name/azure-conditional-access-policy-creation-or-modification.md)                                                                           |
| [Azure device code authentication flow used](/analytics-alerts/alerts-by-name/azure-device-code-authentication-flow-used.md)                                                                                                       |
| [Azure diagnostic configuration deletion](/analytics-alerts/alerts-by-name/azure-diagnostic-configuration-deletion.md)                                                                                                             |
| [Azure enumeration activity using Microsoft Graph API](/analytics-alerts/alerts-by-name/azure-enumeration-activity-using-microsoft-graph-api.md)                                                                                   |
| [Azure Event Hub Authorization rule creation/modification](/analytics-alerts/alerts-by-name/azure-event-hub-authorization-rule-creation-modification.md)                                                                           |
| [Azure Event Hub Deletion](/analytics-alerts/alerts-by-name/azure-event-hub-deletion.md)                                                                                                                                           |
| [Azure group creation/deletion](/analytics-alerts/alerts-by-name/azure-group-creation-deletion.md)                                                                                                                                 |
| [Azure Key Vault modification](/analytics-alerts/alerts-by-name/azure-key-vault-modification.md)                                                                                                                                   |
| [Azure Key Vault Secrets were modified](/analytics-alerts/alerts-by-name/azure-key-vault-secrets-were-modified.md)                                                                                                                 |
| [Azure Kubernetes events were deleted](/analytics-alerts/alerts-by-name/azure-kubernetes-events-were-deleted.md)                                                                                                                   |
| [Azure mailbox rule creation](/analytics-alerts/alerts-by-name/azure-mailbox-rule-creation.md)                                                                                                                                     |
| [Azure Monitor alert rule deleted](/analytics-alerts/alerts-by-name/azure-monitor-alert-rule-deleted.md)                                                                                                                           |
| [Azure Network Watcher Deletion](/analytics-alerts/alerts-by-name/azure-network-watcher-deletion.md)                                                                                                                               |
| [Azure permission delegation granted](/analytics-alerts/alerts-by-name/azure-permission-delegation-granted.md)                                                                                                                     |
| [Azure Resource Group Deletion](/analytics-alerts/alerts-by-name/azure-resource-group-deletion.md)                                                                                                                                 |
| [Azure route table creation or modification](/analytics-alerts/alerts-by-name/azure-route-table-creation-or-modification.md)                                                                                                       |
| [Azure Service principal/Application creation](/analytics-alerts/alerts-by-name/azure-service-principal-application-creation.md)                                                                                                   |
| [Azure storage account blob anonymous access is enabled](/analytics-alerts/alerts-by-name/azure-storage-account-blob-anonymous-access-is-enabled.md)                                                                               |
| [Azure storage account cross-tenant object replication was enabled](/analytics-alerts/alerts-by-name/azure-storage-account-cross-tenant-object-replication-was-enabled.md)                                                         |
| [Azure Storage Account key generated](/analytics-alerts/alerts-by-name/azure-storage-account-key-generated.md)                                                                                                                     |
| [Azure storage account was publicly shared](/analytics-alerts/alerts-by-name/azure-storage-account-was-publicly-shared.md)                                                                                                         |
| [Azure user creation/deletion](/analytics-alerts/alerts-by-name/azure-user-creation-deletion.md)                                                                                                                                   |
| [Azure user password reset](/analytics-alerts/alerts-by-name/azure-user-password-reset.md)                                                                                                                                         |
| [Azure virtual machine commands execution](/analytics-alerts/alerts-by-name/azure-virtual-machine-commands-execution.md)                                                                                                           |
| [Azure VM extension abuse attempt](/analytics-alerts/alerts-by-name/azure-vm-extension-abuse-attempt.md)                                                                                                                           |
| [Billing admin role was removed](/analytics-alerts/alerts-by-name/billing-admin-role-was-removed.md)                                                                                                                               |
| [Cloud activity from a high-risk IP address](/analytics-alerts/alerts-by-name/cloud-activity-from-a-high-risk-ip-address.md)                                                                                                       |
| [Cloud compute serial console access](/analytics-alerts/alerts-by-name/cloud-compute-serial-console-access.md)                                                                                                                     |
| [Cloud email infrastructure enumeration activity](/analytics-alerts/alerts-by-name/cloud-email-infrastructure-enumeration-activity.md)                                                                                             |
| [Cloud email service activity](/analytics-alerts/alerts-by-name/cloud-email-service-activity.md)                                                                                                                                   |
| [Cloud identity reached a throttling API rate](/analytics-alerts/alerts-by-name/cloud-identity-reached-a-throttling-api-rate.md)                                                                                                   |
| [Cloud instance creation attempt](/analytics-alerts/alerts-by-name/cloud-instance-creation-attempt.md)                                                                                                                             |
| [Cloud instance deletion attempt](/analytics-alerts/alerts-by-name/cloud-instance-deletion-attempt.md)                                                                                                                             |
| [Cloud penetration testing tool activity](/analytics-alerts/alerts-by-name/cloud-penetration-testing-tool-activity.md)                                                                                                             |
| [Cloud resource logging was disabled](/analytics-alerts/alerts-by-name/cloud-resource-logging-was-disabled.md)                                                                                                                     |
| [Cloud snapshot created or modified](/analytics-alerts/alerts-by-name/cloud-snapshot-created-or-modified.md)                                                                                                                       |
| [Cloud storage automatic backup disabled](/analytics-alerts/alerts-by-name/cloud-storage-automatic-backup-disabled.md)                                                                                                             |
| [Cloud storage delete protection disabled](/analytics-alerts/alerts-by-name/cloud-storage-delete-protection-disabled.md)                                                                                                           |
| [Cloud user performed multiple actions that were denied](/analytics-alerts/alerts-by-name/cloud-user-performed-multiple-actions-that-were-denied.md)                                                                               |
| [Compute activity in dormant cloud region](/analytics-alerts/alerts-by-name/compute-activity-in-dormant-cloud-region.md)                                                                                                           |
| [Credentials were added to Azure application](/analytics-alerts/alerts-by-name/credentials-were-added-to-azure-application.md)                                                                                                     |
| [Data exfiltration from cloud database](/analytics-alerts/alerts-by-name/data-exfiltration-from-cloud-database.md)                                                                                                                 |
| [Deletion of multiple cloud resources](/analytics-alerts/alerts-by-name/deletion-of-multiple-cloud-resources.md)                                                                                                                   |
| [Denied API call by a Kubernetes service account](/analytics-alerts/alerts-by-name/denied-api-call-by-a-kubernetes-service-account.md)                                                                                             |
| [External user invitation to Azure tenant](/analytics-alerts/alerts-by-name/external-user-invitation-to-azure-tenant.md)                                                                                                           |
| [Granting Access to an Account](/analytics-alerts/alerts-by-name/granting-access-to-an-account.md)                                                                                                                                 |
| [Impossible travel by a cloud identity](/analytics-alerts/alerts-by-name/impossible-travel-by-a-cloud-identity.md)                                                                                                                 |
| [Kubernetes admission controller activity](/analytics-alerts/alerts-by-name/kubernetes-admission-controller-activity.md)                                                                                                           |
| [Kubernetes cluster events deletion](/analytics-alerts/alerts-by-name/kubernetes-cluster-events-deletion.md)                                                                                                                       |
| [Kubernetes enumeration activity](/analytics-alerts/alerts-by-name/kubernetes-enumeration-activity.md)                                                                                                                             |
| [Kubernetes network policy modification](/analytics-alerts/alerts-by-name/kubernetes-network-policy-modification.md)                                                                                                               |
| [Kubernetes Pod Created with host Inter Process Communications (IPC) namespace](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-inter-process-communications-ipc-namespace.md)                                   |
| [Kubernetes Pod created with host process ID (PID) namespace](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-process-id-pid-namespace.md)                                                                       |
| [Kubernetes Pod Created With Sensitive Volume](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-sensitive-volume.md)                                                                                                   |
| [Kubernetes pod creation from unknown container image registry](/analytics-alerts/alerts-by-name/kubernetes-pod-creation-from-unknown-container-image-registry.md)                                                                 |
| [Kubernetes pod creation with host network](/analytics-alerts/alerts-by-name/kubernetes-pod-creation-with-host-network.md)                                                                                                         |
| [Kubernetes Privileged Pod Creation](/analytics-alerts/alerts-by-name/kubernetes-privileged-pod-creation.md)                                                                                                                       |
| [Kubernetes secrets enumeration for the first time](/analytics-alerts/alerts-by-name/kubernetes-secrets-enumeration-for-the-first-time.md)                                                                                         |
| [Kubernetes service account activity outside the cluster](/analytics-alerts/alerts-by-name/kubernetes-service-account-activity-outside-the-cluster.md)                                                                             |
| [Kubernetes vulnerability scanning tool usage](/analytics-alerts/alerts-by-name/kubernetes-vulnerability-scanning-tool-usage.md)                                                                                                   |
| [Mailbox enumeration activity by Azure application](/analytics-alerts/alerts-by-name/mailbox-enumeration-activity-by-azure-application.md)                                                                                         |
| [Microsoft 365 storage services exfiltration activity](/analytics-alerts/alerts-by-name/microsoft-365-storage-services-exfiltration-activity.md)                                                                                   |
| [Microsoft OneDrive enumeration activity](/analytics-alerts/alerts-by-name/microsoft-onedrive-enumeration-activity.md)                                                                                                             |
| [Microsoft OneNote enumeration activity](/analytics-alerts/alerts-by-name/microsoft-onenote-enumeration-activity.md)                                                                                                               |
| [Microsoft SharePoint enumeration activity](/analytics-alerts/alerts-by-name/microsoft-sharepoint-enumeration-activity.md)                                                                                                         |
| [Microsoft Teams enumeration activity](/analytics-alerts/alerts-by-name/microsoft-teams-enumeration-activity.md)                                                                                                                   |
| [Modification or Deletion of an Azure Application Gateway Detected](/analytics-alerts/alerts-by-name/modification-or-deletion-of-an-azure-application-gateway-detected.md)                                                         |
| [Multi region enumeration activity](/analytics-alerts/alerts-by-name/multi-region-enumeration-activity.md)                                                                                                                         |
| [Multiple cloud snapshots export](/analytics-alerts/alerts-by-name/multiple-cloud-snapshots-export.md)                                                                                                                             |
| [Multiple failed logins from a single IP](/analytics-alerts/alerts-by-name/multiple-failed-logins-from-a-single-ip.md)                                                                                                             |
| [Multiple risk indicators for a cloud identity](/analytics-alerts/alerts-by-name/multiple-risk-indicators-for-a-cloud-identity.md)                                                                                                 |
| [Network sniffing detected in Cloud environment](/analytics-alerts/alerts-by-name/network-sniffing-detected-in-cloud-environment.md)                                                                                               |
| [Object versioning was disabled](/analytics-alerts/alerts-by-name/object-versioning-was-disabled.md)                                                                                                                               |
| [OneDrive file download](/analytics-alerts/alerts-by-name/onedrive-file-download.md)                                                                                                                                               |
| [OneDrive file upload](/analytics-alerts/alerts-by-name/onedrive-file-upload.md)                                                                                                                                                   |
| [OneDrive folder creation](/analytics-alerts/alerts-by-name/onedrive-folder-creation.md)                                                                                                                                           |
| [Owner was added to Azure application](/analytics-alerts/alerts-by-name/owner-was-added-to-azure-application.md)                                                                                                                   |
| [PIM privilege member removal](/analytics-alerts/alerts-by-name/pim-privilege-member-removal.md)                                                                                                                                   |
| [Potential denial of wallet abusing AI services](/analytics-alerts/alerts-by-name/potential-denial-of-wallet-abusing-ai-services.md)                                                                                               |
| [Privileged role used by Azure application](/analytics-alerts/alerts-by-name/privileged-role-used-by-azure-application.md)                                                                                                         |
| [Remote usage of an Azure Managed Identity token](/analytics-alerts/alerts-by-name/remote-usage-of-an-azure-managed-identity-token.md)                                                                                             |
| [Remote usage of an Azure Service Principal token](/analytics-alerts/alerts-by-name/remote-usage-of-an-azure-service-principal-token.md)                                                                                           |
| [Removal of an Azure Owner from an Application or Service Principal](/analytics-alerts/alerts-by-name/removal-of-an-azure-owner-from-an-application-or-service-principal.md)                                                       |
| [Soft delete of cloud storage configuration was disabled](/analytics-alerts/alerts-by-name/soft-delete-of-cloud-storage-configuration-was-disabled.md)                                                                             |
| [Storage enumeration activity](/analytics-alerts/alerts-by-name/storage-enumeration-activity.md)                                                                                                                                   |
| [Suspicious activity indicating a potential abuse of a cloud-native email service](/analytics-alerts/alerts-by-name/suspicious-activity-indicating-a-potential-abuse-of-a-cloud-native-email-service.md)                           |
| [Suspicious AI Dataset Download](/analytics-alerts/alerts-by-name/suspicious-ai-dataset-download.md)                                                                                                                               |
| [Suspicious AI Dataset Label Modification](/analytics-alerts/alerts-by-name/suspicious-ai-dataset-label-modification.md)                                                                                                           |
| [Suspicious API call from a Tor exit node](/analytics-alerts/alerts-by-name/suspicious-api-call-from-a-tor-exit-node.md)                                                                                                           |
| [Suspicious Azure enumeration activity](/analytics-alerts/alerts-by-name/suspicious-azure-enumeration-activity.md)                                                                                                                 |
| [Suspicious cloud compute instance SSH keys modification attempt](/analytics-alerts/alerts-by-name/suspicious-cloud-compute-instance-ssh-keys-modification-attempt.md)                                                             |
| [Suspicious heavy allocation of compute resources - possible mining activity](/analytics-alerts/alerts-by-name/suspicious-heavy-allocation-of-compute-resources-possible-mining-activity.md)                                       |
| [Suspicious identity downloaded multiple objects from a bucket](/analytics-alerts/alerts-by-name/suspicious-identity-downloaded-multiple-objects-from-a-bucket.md)                                                                 |
| [Suspicious ML Model Download](/analytics-alerts/alerts-by-name/suspicious-ml-model-download.md)                                                                                                                                   |
| [Suspicious secrets dump activity](/analytics-alerts/alerts-by-name/suspicious-secrets-dump-activity.md)                                                                                                                           |
| [Uncommon Azure Cosmos DB master key read by identity](/analytics-alerts/alerts-by-name/uncommon-azure-cosmos-db-master-key-read-by-identity.md)                                                                                   |
| [Uncommon increase in Azure Microsoft Graph API request sizes](/analytics-alerts/alerts-by-name/uncommon-increase-in-azure-microsoft-graph-api-request-sizes.md)                                                                   |
| [Unusual access to Microsoft 365 storage services](/analytics-alerts/alerts-by-name/unusual-access-to-microsoft-365-storage-services.md)                                                                                           |
| [Unusual AI dataset modification](/analytics-alerts/alerts-by-name/unusual-ai-dataset-modification.md)                                                                                                                             |
| [Unusual certificate management activity](/analytics-alerts/alerts-by-name/unusual-certificate-management-activity.md)                                                                                                             |
| [Unusual cross projects activity](/analytics-alerts/alerts-by-name/unusual-cross-projects-activity.md)                                                                                                                             |
| [Unusual exec into a Kubernetes Pod](/analytics-alerts/alerts-by-name/unusual-exec-into-a-kubernetes-pod.md)                                                                                                                       |
| [Unusual key management activity](/analytics-alerts/alerts-by-name/unusual-key-management-activity.md)                                                                                                                             |
| [Unusual Kubernetes secret access](/analytics-alerts/alerts-by-name/unusual-kubernetes-secret-access.md)                                                                                                                           |
| [Unusual resource access by Azure application](/analytics-alerts/alerts-by-name/unusual-resource-access-by-azure-application.md)                                                                                                   |
| [Unusual resource modification by newly seen IAM user](/analytics-alerts/alerts-by-name/unusual-resource-modification-by-newly-seen-iam-user.md)                                                                                   |
| [Unusual secret management activity](/analytics-alerts/alerts-by-name/unusual-secret-management-activity.md)                                                                                                                       |
| [Unusual user-agent for a cloud identity](/analytics-alerts/alerts-by-name/unusual-user-agent-for-a-cloud-identity.md)                                                                                                             |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/azure-audit-log.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.