Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Videos & KonferenzenTwo Minute Papers: Claude Opus 5.5 AI: A Massive Leap Forward(24.09.2026 um 10:40 Uhr)
Sicherheitslücken (CVE)USN-8805-1: Moodle vulnerability(23.09.2026 um 16:43 Uhr)
Sichere ProgrammierungI thought clipboard sync would be simple. Android had other plans.(24.09.2026 um 11:01 Uhr)
Sichere ProgrammierungAI-assisted genealogy, a follow-up(24.09.2026 um 11:02 Uhr)
Sicherheitslücken (CVE)Smart Contract Vulnerability Surface Analysis: HashKey Exchange(24.09.2026 um 11:02 Uhr)
Sichere ProgrammierungAI Agents Calling Your Existing Backend Without MCP Development(24.09.2026 um 11:06 Uhr)
Videos & KonferenzenTwo Minute Papers: Claude Opus 5.5 AI: A Massive Leap Forward(24.09.2026 um 10:40 Uhr)
Sicherheitslücken (CVE)USN-8805-1: Moodle vulnerability(23.09.2026 um 16:43 Uhr)
Sichere ProgrammierungI thought clipboard sync would be simple. Android had other plans.(24.09.2026 um 11:01 Uhr)
Sichere ProgrammierungAI-assisted genealogy, a follow-up(24.09.2026 um 11:02 Uhr)
Sicherheitslücken (CVE)Smart Contract Vulnerability Surface Analysis: HashKey Exchange(24.09.2026 um 11:02 Uhr)
Sichere ProgrammierungAI Agents Calling Your Existing Backend Without MCP Development(24.09.2026 um 11:06 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

Azure Logs Analytics for CosmosDB

Azure CosmosDB allows you to enable and store logs in Log Analytics, which is helpful for troubleshooting and performance analysis. Enabling Log Analytics on CosmosDB Access the CosmosDB account and, in the left panel, go…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Azure CosmosDB allows you to enable and store logs in Log Analytics, which is helpful for troubleshooting and performance analysis.









Enabling Log Analytics on CosmosDB




  1. Access the CosmosDB account and, in the left panel, go to Monitoring > Diagnostic Settings.



Image description




  1. A message will prompt you about enabling "Full Text Query." Click Not Now.



Image description




  1. If no Diagnostic Settings are enabled, click Add Diagnostic Settings.



Image description




  1. Select the logs you want to store in Log Analytics.



Image description






Key Categories of Logs
































Category Description
DataPlaneRequest Captures every data plane operation (e.g., create, update, delete, retrieve) for the CosmosDB account.
QueryRuntimeStatistics Details query operations executed against a SQL API account, with optional full-text query logging.
PartitionKeyStatistics Provides insights into logical partition keys with disproportionate storage utilization.
PartitionKeyRUConsumption Tracks RU consumption for logical partition keys in each region and identifies hot partitions.
ControlPlaneRequest Logs all control plane operations, including indexing policy updates, backups, and account modifications.


Important: While enabling logs is useful, it can incur additional costs in the Log Analytics workspace depending on database usage. Regularly monitor log consumption.






Checking Log Volume



Use the following KQL query to verify log volume:




AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DOCUMENTDB"
| summarize count() by Category
| order by count_ desc






Image description



For example, in a 24-hour period, over 112 million logs were stored in the DataPlaneRequest category.









Accessing Logs in CosmosDB



To access logs, navigate to Monitoring > Logs in the CosmosDB account.



Image description



Log Analytics provides pre-defined queries separated into Alerts and Diagnostics:






Alerts Queries



Image description






Diagnostics Queries



Image description






Sample Query



The following query identifies top operations by consumed RUs in the last 24 hours:




// Top operations by consumed Request Units (RUs) in last 24 hours
AzureDiagnostics
| where TimeGenerated >= ago(24h)
| where Category == "DataPlaneRequests"
| summarize numberOfOperations = count(), totalConsumedRU = sum(todouble(requestCharge_s)) by databaseName_s, collectionName_s, OperationName, requestResourceType_s, requestResourceId_s, _ResourceId
| extend averageRUPerOperation = totalConsumedRU / numberOfOperations
| order by numberOfOperations






Image description






Available Logs in CosmosDB



On the left panel, you can view logs available for CosmosDB:



Image description









Enabling Full Text Query



By default, CosmosDB does not enable full-text query logging. Enabling this feature improves query visibility.






Comparison



Default Logs (without full-text query):




SELECT c.p1, c.p2, c.p3 FROM c WHERE c.p1="123"






Logs with Full Text Query Enabled:




SELECT c.id, c.firstname, c.lastname FROM c WHERE c.id="123"









How to Enable Full Text Query




  1. Navigate to Diagnostic Settings.

  2. Click Go to Feature when prompted to enable full-text query logging.



Image description




  1. Click Diagnostics full-text query and enable it.



Image description









Conclusion



Log Analytics is a powerful tool for monitoring and troubleshooting CosmosDB. Enabling appropriate logs can help identify issues like hot partitions, query bottlenecks, and resource utilization patterns. However, it is crucial to balance the logs collected with the cost implications in Log Analytics. Using targeted queries and insights will maximize efficiency while keeping costs under control.



Future posts will delve into advanced troubleshooting techniques for CosmosDB.









References



CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Remote Code Execution (RCE) Defense
title: Detect Exploitation - Azure Logs Analytics for CosmosDB
id: a2ab3f38-62a8-4ff1-82d7-234077c4a290
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Azure Logs Analytics for Cosmo" ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Azure Logs Analytics for CosmosDB.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Azure Logs Analytics for CosmosDB

Thematisch verwandte Begriffe: Azure, Logs, Analytics, CosmosDB · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-97056 | SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when co…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick