Microsoft Defender for Cloud を使用し、storage1 という名前のストレージ アカウントを含む Azure サブスクリプションがあります。storage1 の BLOB に対して、異常に大量の削除操作があったというアラートを受け取りました。削除された BLOB を特定する必要があります。何を確認すればよいでしょうか。
正解:A
To identify which blobs were deleted, you should review the activity logs of the storage account. The activity logs contain information about all the operations that have taken place in the storage account, including delete operations. These logs can be accessed in the Azure portal by navigating to the storage account, selecting "Activity log" under the "Monitoring" section, and filtering by the appropriate time range. You can also use Azure Monitor and Log Analytics to query and analyze the activity logs data. References: https://docs.microsoft.com/en-us/azure/storage/common/storage-activity-logs https://docs.microsoft.com/en-us/azure/azure-monitor/platform/activity-log-azure-storage