Microsoft Azure virtual machine (VM) activity reporting

Microsoft Azure enables users to deploy Azure virtual machines (VM) in an organization. Logging is crucial when using VMs, as it allows IT administrators to effectively manage the platform and helps security administrators track actions that have been performed. VM activity logs not only prove useful for specific security incidents, but also on a day-to-day basis.

Cloud Security Plus easily captures and analyzes VM activity logs to generate reports on VM activity. These reports record actions such as the creation, deletion, and modification of VMs. This information is useful during security incidents because it points towards the cause of security problems. Tracking VM activity is also useful on a day-to-day basis because knowing which VMs haven't been used for a long period of time can help organizations reduce costs.

From a security perspective, if a user's VM has mysteriously stopped, the security administrator can look up the VM activity report from Cloud Security Plus to quickly identify who performed the action that caused it to stop and when.

Azure VM activity reports

VM activity reports provide details such as the resource ID, the group the resource belongs to, the caller who performed the action, the status of the action, and the time the action was performed. Cloud Security Plus offers various Azure VM activity reports on:

• Created virtual machines
• Restarted virtual machines
• Deleted virtual machines
• Modified virtual machines
• Virtual machines that have been started
• Virtual machines that have been stopped