Azure Portal Access for Infrastructure Discovery

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects HTTP requests to 'portal.azure.com', indicating access to the Azure management portal. A threshold is set to trigger an alert if 10 such requests are observed from the same source IP within 60 seconds. This activity is classified as a network scan, potentially for infrastructure discovery.