Microsoft Defender for Cloud を使用し、storage1 という名前のストレージ アカウントを含む Azure サブスクリプションがあります。 storage1 の BLOB に対して異常に大量の削除操作があったというアラートを受け取ります。どの BLOB が削除されたかを特定する必要があります。何を見直すべきですか?
正解:A
To identify which blobs were deleted, you should review the activity logs of the storage account. The activity logs contain information about all the operations that have taken place in the storage account, including delete operations. These logs can be accessed in the Azure portal by navigating to the storage account, selecting "Activity log" under the "Monitoring" section, and filtering by the appropriate time range. You can also use Azure Monitor and Log Analytics to query and analyze the activity logs data. References: * https://docs.microsoft.com/en-us/azure/storage/common/storage-activity-logs * https://docs.microsoft.com/en-us/azure/azure-monitor/platform/activity-log-azure-storage