Network logs tell you what traffic hit a machine. Activity logs tell you when it was created and modified. But neither tells you what happened inside the operating system — which processes ran, which accounts authenticated locally, which files were accessed. For that level of detail, you need OS-level logs, and in Azure collecting those requires an agent running on the VM itself. The upside is significant: Azure's diagnostic agent lets you pull Windows event logs and Linux sy

If the previous article covered the logs you are likely to find turned on when you arrive at a scene, this one covers the logs you need but probably will not find. NSG flow logs, storage account access logs, and the forensic trails for tracking data exfiltration — all off by default. That means you either find them already configured or you turn them on immediately and accept that prior activity may be gone forever. The good news: when these logs were configured, they hold so

A complete, no-fluff technical walkthrough — from zero infrastructure to a live, multi-region phishing drill hitting larger set of employees across multiple countries. -------------------------------------------------------------------------------------------------------- 1. What Is This and Why Are We Building It? Alright, let's kick things off. What exactly is a phishing simulation drill? In plain English: it's a controlled, authorized test where your own security team se

Logs are the heartbeat of any Azure investigation. But Azure's logging architecture is not a single flat file you download and read — it is a multi-layered system where different types of activity are captured in different log sources, stored in different places, and queried in different ways. Miss a layer and you miss evidence. The Five Log Sources You Need to Know Azure organizes its logs into five categories. Understanding these upfront prevents the confusion of wondering

When you are called into an Azure incident, there is a good chance a virtual machine is at the center of it. Either the VM itself was compromised, it was used as a launching pad, or the attacker deployed new VMs to run their own workloads. Understanding how Azure's compute and networking layer works — and how it differs from on-premises environments — will save you from costly mistakes and missed evidence. Azure Virtual Machines: Not All VMs Are Equal Azure offers a wide vari