Microsoft Defender for Cloud を使用する Azure サブスクリプションがあり、storage1 というストレージ アカウントが含まれています。storage1 内の BLOB に対して、異常に多くの削除操作が発生したというアラートを受け取りました。 削除された BLOB を特定する必要があります。 何をレビューすべきでしょうか?
正解:A
To identify which blobs were deleted in an Azure Storage account, you must review Azure Storage Analytics logs, which record all operations (including DeleteBlob and DeleteContainer requests) made against the storage service. These logs contain details such as timestamp, requester IP, operation type, and object name-allowing you to pinpoint the exact blobs deleted. * Activity logs (Option B) record control-plane operations (e.g., resource creation or configuration changes), not data-plane operations like blob deletions. * Alert details and related entities (Options C and D) summarize detection context but do not include full operation-level details. # Correct answer: A. the Azure Storage Analytics logs