Azure Cosmos NoSQL

Service Name: Azure Cosmos DB

Service Description: Azure Cosmos DB is Microsoft's globally distributed, multi-model database service designed for scalable and high-performance applications. The NoSQL API provides a schema-agnostic JSON database implementation.

Service Address: https://azure.microsoft.com/en-us/products/cosmos-db/

Cosmos NoSQL

COSMOS_NOSQL

• Validation Type: API Auth
• IP Allow list: Does not exist
• Secret Access Scope: Grants access to Azure Cosmos DB NoSQL resources, allowing read/write operations on documents, containers, and databases.
• Secret Revokement URL: https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/how-to-setup-rbac
• Secret Example: https://mycosmosaccount.documents.azure.com

Suspicious Activity Investigation Instructions:

• Review Azure Activity Logs for unauthorized access patterns
• Check Azure Monitor for unusual query patterns or data access
• Examine request logs for unexpected IP addresses or user agents
• Monitor for unusual data throughput or request unit consumption
• Look for unauthorized database or container creation/deletion

Mitigation Instructions:

• Rotate the Cosmos DB access keys immediately in the Azure Portal
• Navigate to your Cosmos DB account in the Azure Portal
• Select "Keys" under Settings - Click "Regenerate Primary Key" or "Regenerate Secondary Key"
• Update applications with the new connection strings
• Consider implementing Azure Private Link for network isolation
• Enable Azure AD authentication and RBAC for more granular access control