Azure Monitor log analytics sample queries.

Azure Monitor resource logs are logs emitted by Azure services that describe the operation of those services or resources. When exported to a Log Analytics workspace the logs are stored in tables. This set of articles contains sample queries to retrieve data from the log analytics tables. The queries are also available in the Log Analytics workspace.

• Most recent delete key-value operations
• Most recent client error

• Throttled Requests
• Most common server errors
• Most Active Clients by IP Address

• User's custom security attribute audits

• Show logs from AADDomainServicesAccountLogon table

• Show logs from AADDomainServicesAccountManagement table

• Show logs from AADDomainServicesDirectoryServiceAccess table

• Show logs from AADDomainServicesLogonLogoff table

• Show logs from AADDomainServicesPolicyChange table

• Show logs from AADDomainServicesPrivilegeUse table

• Most active managed identities

• Users with multiple cities
• Most active ip addresses

• Provisioning actions for the last week
• Provisioning errors
• Provisioned objects by day

• High risk users

• Active service principal risk detections

• Most active service principals
• Inactive service principals

• Recent user risk events
• Active user risk detections

• ABAP audit log multiple IP logons
• ABAP audit log file downloads

• Clients To Direct Line Channel
• Bot To Channels
• Channels To Bot
• Requests From Facebook To Azure Bot Service
• Requests From Azure Bot Service To Facebook API
• Activities Sent from Clients to Direct Line
• Direct Line Channel Logs
• Failed Requests
• Direct Line Channel Response Codes Line Chart
• Requests Duration Line Chart
• Response Codes Line Chart
• Response Codes PieChart
• Request Operations PieChart

• How many times a resource was granted grants per pipeline run?
• What entitlements was granted to my resource?
• What resources was granted accessed by an entitlement?
• Which participants was granted accessed to my resource?

• Unique Redis client IP addresses
• Redis client connections per hour

• Microsoft Entra authentication audit log

• Advanced Messaging operations
• Advanced Messaging operation duration percentiles
• Advanced Messaging top 5 IP addresses per operation
• Advanced Messaging operational errors
• Advanced Messaging operation result counts
• Advanced Messaging channel activity
• Advanced Messaging message status count

• List distinct auth operations
• Calculate auth operation duration percentiles
• Top 5 IP addresses per auth operation
• Auth operational errors
• Auth operation result counts

• Get long calls
• Usage breakdown
• Record count breakdown
• Participant Phone Numbers

• Call Automation operations
• Calculate Call Automation operation duration percentiles
• Top 5 IP addresses per Call Automation operation
• Call Automation operational errors
• Call Automation operation result counts
• Call Automation logs for call connection ID
• Call Automation API operations on a call
• CallDiagnostics log for CallAutomation API call
• CallSummary log for CallAutomation API call

• Loop play success rate
• Play to participant success rate
• Recognize success rate
• Success rate by sub operation name

• Metrics per each media type
• Metric histogram per media type and direction

• Count client operations by type
• Outgoing call failure reasons
• Search calls by keyword
• Search all user facing diagnostics in a call
• Search all participants in a call
• Search all client operations in a call

• Streams per call
• Streams per call histogram
• Media type ratio
• Transport type ratio
• Average telemetry values
• Jitter average histogram
• Jitter max histogram
• Packet loss rate average histogram
• Packet loss rate max histogram
• Round trip time average histogram
• Round trip time max histogram
• Jitter quality ratio
• Packet loss rate quality ratio
• Round trip time quality ratio
• CallDiagnostics log for CallAutomation API call
• Search calls by keyword
• Search all participants in a call

• Call Recording operations
• Calculate Call Recording operation duration percentiles
• Top 5 IP addresses per Call Recording operation
• Call Recording operational errors
• Call Recording operation result counts
• Call Recording logs by ID

• Call Recording duration histogram
• Call Recording duration percentiles
• Call Recording's end reason ratio
• Daily Call Recordings
• Hourly Call Recordings
• Call Recording's mode ratio

• Participants per call
• Participant Phone Numbers
• Participants per group call
• Call type ratio
• Call duration histogram
• Call duration percentiles
• Daily calls
• Hourly calls
• Endpoints per call
• SDK version ratio
• OS version ratio
• CallSummary log for CallAutomation API call
• Search calls by keyword
• Search all participants in a call
• Search all client operations in a call

• Call duration percentiles

• Overall call rating
• Audio rating
• Video rating
• Screenshare rating
• Overall call issues
• Audio issues
• Video issues
• Screenshare issues
• Search calls by keyword
• Search all participants in a call

• Chat operations
• Calculate chat operation duration percentiles
• Top 5 IP addresses per chat operation
• Chat operational errors
• Chat operation result counts

• Email Send Request Summary

• Email failed deliveries by recipient ID
• Email Failed Deliveries by Message Id
• Email Bounced and Suppressed Recipients

• Job Router operations
• Calculate Job Router operation duration percentiles
• Top 5 IP addresses per Job Router operation
• Job Router operational errors
• Job Router operation result counts

• Rooms operational errors
• Rooms operation result counts
• Rooms operation summary

• List distinct SMS operations
• Calculate SMS operation duration percentiles
• Top 5 IP addresses per SMS operation
• SMS operational errors
• SMS operation result counts

• AD Recommendations by Focus Area
• AD Recommendations by Computer
• AD Recommendations by Forest
• AD Recommendations by Domain
• AD Recommendations by DomainController
• AD Recommendations by AffectedObjectType
• How many times did each unique AD Recommendation trigger?
• High priority AD Assessment security recommendations

• Activity Runs Availability
• Activity runs latest Status

• PipelineRuns Availability
• Pipeline runs latest Status

• Top ADFS account lockouts

• TriggerRuns Availability
• Trigger runs latest Status

• Data History operation failure logs
• Data History egress latency

• DigitalTwin Error Summary
• DigitalTwin API Usage

• EventRoutes API Usage

• Model Error Summary
• Model API Usage

• Query Error Summary

• Ingestion batching size
• Ingestion batching summary
• Ingestion batching duration timechart

• Table usage by number of queries
• Table usage by application
• Table data scanned - top time windows
• Table data scanned - top tables

• AEWComputePipelinesLogs get daily tasks count
• AEWComputePipelinesLogs get failed tasks detail
• AEWComputePipelinesLogs get long running jobs
• AEWComputePipelinesLogs get task E2E latency time

• Variant assignment counts by features
• Latest scorecard metadata for a given feature
• Latest scorecard results for a given feature

• Latest scorecard results for a given feature

• Latest scorecard metadata for a given feature
• Latest scorecard results for a given feature

• Aggregate operations query
• Unauthorized requests query

• Client requests per hour
• 5xx HTTP responses per hour
• 4xx HTTP responses per hour

• Show login error events

• DICOM privileged operations

• Log count per log starting with Dicom100 error code and CorrelationId

• Most recent actionable MedTech logs
• Log count per MedTech log or exception type
• MedTech healthcheck exceptions
• MedTech normalization stage logs
• MedTech FHIR conversion stage logs

• Volume of Kubernetes audit events per SourceIp

• Volume of admin Kubernetes audit events per username
• Admin Kubernetes audit events for deployment

• Cluster Autoscaler logs
• Kubernetes API server logs

• Latest Snat Port Exhaustion Per LB Frontend

• Key delivery successful request count by key type
• Key delivery failed requests
• Key delivery requests latency at 95 and 99 percentiles

• Live event ingest discontinuity operation count
• Live event error operations

• Media account health events

• Streaming endpoint successful request count by client IP
• Streaming endpoint informational requests

• Queries executed by a user on dataproduct

• Row digestion errors
• Failed file digestion by source

• Ingestion operation on storage
• Delete operation on storage
• Read operation on storage
• Read operation on input storage

• Azure Sphere device authentication and attestation failures
• Azure Sphere device events timeline
• Azure Sphere device heartbeat events timechart
• Azure Sphere devices not updated to latest OS
• Azure Sphere device telemetry events summary

• Get all test failover jobs run

• Get replication health status history

• Count DNS failures for a source by source and type
• Identify excessive query for a nonexistent domain by a source

• Recent connectivity configuration changes
• Recent failed connectivity configuration changes

• AVNM IPAM pool allocation changes
• Failed AVNM IPAM pool allocation changes

• Get recent Network Group Membership changes
• Failed Network Group Membership Changes

• Get recent security admin rule collection changes
• Get recent failed security admin rule collection changes

• Get DNS failures
• Get distributed Firewall logs
• Get audit events for VM created
• Get audit events for VM deleted
• Get audit events for VM powered on
• Get audit events for VM disconnected
• Get audit events for VM rebooted
• Get audit events for VM migrated
• Get audit events for host added
• Get audit events for host shutdown
• Get audit events for host enter maintenance mode
• Get audit events for host exit maintenance mode
• Get audit events for host connected
• Get audit events for host connection lost
• Get audit events for cluster
• Get audit events count for NSX
• Get audit events count for vCenter
• Get audit events for role added
• Get AVS events with severity of Info

• New users per region
• All AWS CloudTrail events
• AWSCT for user
• AWS console sign in

• High severity findings

• Rejected IPv4 actions

• Application rule logs
• All firewall decisions

• DNS proxy logs

• Azure Firewall Top Flow Logs

• Azure Firewall flow trace logs

• IDPS event logs
• All firewall decisions

• Internal FQDN resolution failures

• DNAT rule logs
• All firewall decisions

• Network rule logs
• All firewall decisions

• Threat intelligence logs
• All firewall decisions

• Are there any failures?
• Are there any slow requests?
• How active has this KeyVault been?
• How fast is this KeyVault serving requests?
• What changes occurred last month?
• Who is calling this KeyVault?

• Publish detailed error logs
• Publish detailed error logs

• Publish HTTP send data for hybrid connection

• Publish success data for topics
• Publish failures for subscription
• Publish failures for namespace
• Publish success data for topics
• Publish failures for Topics
• Publish failures for subscription
• Publish failures for namespace

• Publish successful connection for AMQP protocol
• Publish failed AAD logs
• Publish failed SAS logs
• Publish failure for send message
• Publish failure for Namespace
• [Classic] Errors in the last 7 days
• Publish successful connection for AMQP protocol
• Publish failures for send message
• Publish failure for namespace
• Publish failed AAD logs
• Publish failed SAS logs

• Publish deny connection by namespace
• Publish namespace vnet data
• Publish deny connection by namespace
• Publish virtual network events by namespace
• Publish deny connection by namespace
• Publish virtual network events by namespace

• Distribution of Backup Jobs by Status
• Distribution of Restore Jobs by Status
• All Successful Jobs
• All Failed Jobs

• Trend of total Cloud Storage consumed

• Unique unauthorized or forbidden client IP addresses

• Delivery failures by topic and error
• Delivery failures by topic and error
• Delivery failures by domain and error
• Topics Average Delivery Latency
• Domains Average Delivery Latency

• Publish failures by topic and error
• Publish failures by topic and error
• Publish failures by domain and error

• Group Aggregated Security Alerts by Sector

• Failed authorization

• Status of farm management operations for a farmer
• Status of all operations for a farmer
• Usage trend for top 100 farmers based on the operations performed

• Job execution statistics for a farmer

• Alerts involving a user

• Alerts by MITRE ATT&CK technique

• Get cluster events for clusters for specific VM size
• Get number of running nodes
• Graph of Running and Idle Node instances

• Plot compute cluster utilization

• Get failed jobs
• Get records for a job
• Display top 5 longest job runs

• Count datasets reads

• Request the history of accessing environment

• Found users who accessed models

• Online endpoint console logs

• Online endpoint failure events

• Online endpoint failed requests

• All WRITE events

• Get Production Anomalies (last day)
• Get Flighting Anomalies (last day)

• Number of requests
• Logs of the last 100 calls
• Number of calls by APIs
• Bandwidth consumed
• Request sizes
• Response sizes
• Client TLS versions
• Error reasons breakdown
• Last 100 failed requests
• Get failed requests due to issues related to the backend
• Get failed requests due to issues not related to the backend
• Overall latency
• Backend latency
• Client latency
• Cache hit ratio

• Failing dependencies

• Latest Container App first party Spring App errors

• Top 3 browser exceptions

• Page views trend
• Slowest pages

• Show the application logs which contain the "error" or "exception" terms
• Show the error and exception number of each application

• Show the config server logs
• Show the service registry logs
• Show the Spring Cloud Gateway logs
• Show the API portal logs
• Show the Application Configuration Service logs
• Show the Spring Cloud Gateway operator logs

• Response time trend
• Request count trend
• Response time buckets
• Operations performance
• Top 10 countries by traffic
• Failed requests - top 10
• Failed operations
• Exceptions causing request failures

• Count app logs by severity
• App logs for each App Service

• Audit Logs relating to unexpected users

• Most recent errors from App Service Authentication
• Most recent warnings from App Service Authentication
• Top 100 most frequent errors and warnings from App Service Authentication

• Find console logs relating to application startup

• File Audit Logs relating to a "Delete" operation

• App Service Health
• Failure Categorization
• Response times of requests
• Top 5 Clients
• Top 5 Machines

• Review Autoscale evaluations

• Display top Autoscale 50 logs
• Autoscale operation status
• Autoscale failed operations

• [Classic] Find In AzureActivity
• Shut down Virtual Machines
• Latest 50 logs
• Operations' status
• Recent Azure Activity logs
• Failed operations
• Resources creation
• Find In AzureActivity
• Show logs from AzureActivity table
• Show logs from AzureActivity table
• Display top 50 Activity log events
• Display Activity log Administrative events
• VM creation
• Display Activity log events generated from Policy
• List callers and their associated action in last 48 hours
• All Azure Activity
• Azure Activity for user
• Successful key enumaration
• Network Access JIT initiation
• Azure Activity operation statistics

• Are there any authorization failures?
• Are there any slow requests?
• How active has this Attestation provider been?
• Who is calling this attestation provider?
• Have there been any changes to attestation policy?
• Have there been any errors attempting to configure the attestation policy?

• Get all backup operations

• Errors in automation jobs
• Find logs reporting errors in automation jobs from the last day
• Azure Automation jobs that are failed, suspended, or stopped
• Runbook completed successfully with errors
• View historical job status
• Azure Automation jobs that are Completed
• Successful tasks per job
• Failed tasks per job
• Task durations
• Pool resizes
• Pool resize failures
• [Microsoft CDN (classic)] Requests per hour
• [Microsoft CDN (classic)] Traffic by URL
• [Microsoft CDN (classic)] 4XX error rate by URL
• [Microsoft CDN (classic)] Request errors by user agent
• [Microsoft CDN (classic)] Top 10 URL request count
• [Microsoft CDN (classic)] Unique IP request count
• [Microsoft CDN (classic)] Top 10 client IPs and HTTP versions
• [Azure Front Door Standard/Premium] Top 20 blocked clients by IP and rule
• [Azure Front Door Standard/Premium] Requests to origin by route
• [Azure Front Door Standard/Premium] Request errors by user agent
• [Azure Front Door Standard/Premium] Top 10 client IPs and http versions
• [Azure Front Door Standard/Premium] Request errors by host and path
• [Azure Front Door Standard/Premium] Firewall blocked request count per hour
• [Azure Front Door Standard/Premium] Firewall request count by host, path, rule, and action
• [Azure Front Door Standard/Premium] Requests per hour
• [Azure Front Door Standard/Premium] Top 10 URL request count
• [Azure Front Door Standard/Premium] Top 10 URL request count
• [Azure Front Door Standard/Premium] Unique IP request count
• Find In AzureDiagnostics
• Execution time exceeding a threshold
• Show the Slowest queries
• Show Query's statistics
• Review audit log events in GENERAL class
• Review audit log events in CONNECTION class
• Execution time exceeding a threshold
• Show the Slowest queries
• Show Query's statistics
• Review audit log events in GENERAL class
• Review audit log events in CONNECTION class
• Autovacuum events
• Server restarts
• Find Errors
• Unauthorized connections
• Deadlocks
• Lock contention
• Audit logs
• Audit logs for table(s) and event type(s)
• Queries with execution time exceeding a threshold
• Slowest queries
• Query statistics
• Execution count trends
• Top wait events
• Wait event trends
• Connectvity errors
• Devices with most throttling errors
• Dead endpoints
• Error summary
• Recently connected devices
• SDK version of devices
• Consumed RU/s in last 24 hours
• Collections with throttles (429) in past 24 hours
• Top operations by consumed Request Units (RUs) in last 24 hours
• Top logical partition keys by storage
• [Classic] Duration of Capture failure
• [Classic] Join request for client
• [Classic] Access to keyvault - key not found
• [Classic] Operation performed with keyvault
• Errors in the last 7 days
• Duration of Capture failure
• Join request for client
• Access to keyvault - key not found
• Operation performed with keyvault
• [Classic] How active has this KeyVault been?
• [Classic] Who is calling this KeyVault?
• [Classic] Are there any slow requests?
• [Classic] How fast is this KeyVault serving requests?
• [Classic] Are there any failures?
• [Classic] What changes occurred last month?
• [Classic] List all input deserialization errors
• [Classic] Find In AzureDiagnostics
• Total billable executions
• Logic App execution distribution by workflows
• Logic App execution distribution by status
• Triggered failures count
• Requests per hour
• Non-SSL requests per hour
• Failed requests per hour
• Errors by user agent
• Errors by URI
• Top 10 Client IPs
• Top HTTP versions
• Network security events
• Requests per hour
• Forwarded backend requests by routing rule
• Request errors by host and path
• Request errors by user agent
• Top 10 client IPs and http versions
• Firewall blocked request count per hour
• Top 20 blocked clients by IP and rule
• Firewall request count by host, path, rule, and action
• Application rule log data
• Network rule log data
• Threat Intelligence rule log data
• Azure Firewall log data
• Azure Firewall DNS proxy log data
• BGP route table
• BGP informational messages
• Endpoints with monitoring Status down
• Successful P2S connections
• Failed P2S connections
• Gateway configuration changes
• S2S tunnel connet/disconnect events
• BGP route updates
• Show logs from AzureDiagnostics table
• Failed backup jobs
• [Classic] List Management operations
• [Classic] Error Summary
• [Classic] Keyvault access attempt - key not found
• [Classic] AutoDeleted entities
• [Classic] Keyvault performed operational
• Management operations in the last 7 days
• Errors summary
• Keyvault access attempt - key not found
• AutoDeleted entities
• Keyvault performed operational
• Storage on managed instances above 90%
• CPU utilization treshold above 95% on managed instances
• Display all active intelligent insights
• Wait stats
• List all input data errors
• List all input deserialization errors
• List all InvalidInputTimeStamp errors
• List all InvalidInputTimeStampKey errors
• Events that arrived late
• Events that arrived early
• Events that arrived out of order
• All output data errors
• List all RequiredColumnMissing errors
• List all ColumnNameInvalid errors
• List all TypeConversionError errors
• List all RecordExceededSizeLimit errors
• List all DuplicateKey errors
• All logs with level "Error"
• Operations that have "Failed"
• Output Throttling logs (Cosmos DB, Power BI, Event Hubs)
• Transient input and output errors
• Summary of all data errors in the last 7 days
• Summary of all errors in the last 7 days
• Summary of 'Failed' operations in the last 7 days

• Azure load test creation count
• Azure load test run creation count

• Pie chart of HTTP response codes
• Line chart of response times
• [Classic] Find In AzureMetrics
• Latest metrics
• Find In AzureMetrics
• ExpressRoute Circuit BitsInPerSecond traffic graph
• ExpressRoute Circuit BitsOutPerSecond traffic graph
• ExpressRoute Circuit ArpAvailablility graph
• ExpressRoute Circuit BGP availability
• Avg CPU usage
• Performance troubleshooting
• Loading Data
• P2S connection count
• P2S bandwidth utilization
• Gateway throughput
• Show logs from AzureMetrics table
• Show logs from AzureMetrics table
• Cluster availability (KeepAlive)

• CCF application errors

• CIEventsAudit - API response codes line chart
• CIEventsAudit - result type ClientError
• CIEventsAudit - security level Error
• CIEvents - all events for a specific correlation id
• CIEventsAudit - all events for a specific instance ID

• CIEventsOperational - event type ApiEvent
• CIEventsOperational- event type WorkflowEvent
• CIEvents - all events for a specific correlation id
• CIEventsOperational - all events for a specific instance ID

• Cassandra logs
• Cassandra errors or warnings

• Failed experiment runs
• Experiment events on last experiment run

• File name extension change

• Are there any slow requests?
• How active has this Cloud HSM been?
• Are there any failures?

• Palo Alto collector machine usage
• Cisco ASA events type usage
• Device events volume statistics

• Office Communication Compliance events filtered by organization ID

• Get confidential Watchlist aliases
• Lookup events using a confidential Watchlist

• Stopped Windows services
• Software changes
• Service changes
• Software change type per computer
• Stopped services
• Software change count per category
• Removed software changes

• Recent stopped auto services

• Latest Container App user errors

• Image inventory
• Find In ContainerImageInventory

• Container Lifecycle Information

• Find a value in Container Logs Table
• Billable Log Data by log-type
• List container logs per namespace
• Find In ContainerLog

• Find In ContainerLogV2

• Find In ContainerNodeInventory

• Show login events reported over the last hour

• Show registry events reported over the last hour

• Find In ContainerServiceLog

• Backup Items by Vault and Backup item type

• Ingestion and Transformation errors from data collection rules

• DNS queries by virtual network and return code

• Discovered object
• Terminal object state

• List all Databricks Diagnostic Settings categories

• Dataverse events filtered by operation type

• Failed actions query

• Hibernate Unsupported Check

• Exchange Error

• Cleanup Failure

• Hardware Minor
• Hardware Alert

• Software Alert

• Skype Error

• Devices with antivirus configurations issue

• Unsupported software titles

• Devices affected by a specific vulnerability

• Clients Resolving Malicious Domains

• TLS 1.3 Lower query

• Authentication error query

• Disconnections reason query
• Session disconnections query

• TLS 1.3 Lower query

• Session connections query

• Files from malicious sender
• Emails to external domains with attachments

• Phishing emails from the top 10 sender domains
• Emails with malware

• Post-delivery administrator actions
• Unremediated post-delivery phishing email detections
• Full email processing details

• URLs in an email

• Memory usage percentage
• Avg node CPU usage percentage
• Virtual machines failed
• Total virtual machines in a cluster.
• Available volume capacity in a cluster.
• Volume latency
• Volume IOPS
• Volume throughput
• Cluster node down
• Memory usage percentage
• Ingestion latency (end-to-end) timechart - Event table
• Show the trend of a selected event
• Error event on computer missing security co critical update
• All Events in the past hour
• Events started
• Events by event source
• Events by event ID
• Warning events
• Count of warning events
• Events in OM between 2000 to 3000
• Windows Fireawall policy settings
• Windows Fireawall policy settings changed by machines

• Failed ingestions by errors
• Failed ingestions timechart
• Failed Ingestions

• Show application logs from Function Apps
• Show logs with warnings or exceptions
• Error and exception count
• Function activity over time
• Function results
• Function Error rate

• PubSub subscription logs with severity info

• Count heartbeats
• Last heartbeat of each computer
• Ingestion latency (end-to-end) spikes - Heartbeat table
• Agent latency spikes - Heartbeat table
• Recently stopped heartbeats - Heartbeat table
• Computers availability today
• Unavailable computers
• Availability rate
• Not reporting VMs
• Computers list
• Find In Heartbeat

• Group Membership changed
• Password change event

• LDAP authentication processes with cleartext passwords

• SAMR queries to Active Directory

• IoT Edge: Device offline or not sending messages upstream at expected rate
• IoT Edge: Edge Hub queue size over threshold
• Maximum node disk
• Prometheus disk read per second per node
• Find In InsightsMetrics
• What data is being collected?
• Virtual Machine available memory
• Chart CPU usage trends by computer
• Virtual Machine free disk space
• Track VM Availability using Heartbeat
• Top 10 Virtual Machines by CPU utilization
• Bottom 10 Free disk space %

• Kubernetes events
• Find In KubeEvents

• Find In KubeMonAgentEvents

• Avg node CPU usage percentage per minute
• Avg node memory usage percentage per minute
• Readiness status per node
• Find In KubeNodeInventory

• Pods in crash loop
• Pods in pending state
• Find In KubePodInventory

• Find In KubeServices

• Most Requested ResourceIds
• Unauthorized Users
• Throttled Users
• Request Count by ResponseCode
• Top 10 resource intensive queries
• Top 10 longest time range queries

• Bin Rules Query Duration

• Count of failed workflow operations from Logic App Workflow Runtime

• All DNS events where the domain queried was 'www.google.com' ordered by time

• All FIM events for directories

• All recent Gating validation events

• Find all entries where value is active
• Find all entries where value is up
• Find all events of the type VxlanVlanToVniVlan
• Find all entries where afisafiname is not of the type L2VPN_EVPN
• Find all entries where network instance name is of the type workload-mgmt

• Find all entries where session update user is admin

• Find all errors from Syslog

• List received snapshots by duration
• Count failed received snapshots
• Frequent errors in received snapshots
• Chart of daily received snapshots

• List sent snapshots by duration
• Count failed sent snapshots
• Frequent errors in sent snapshots
• Chart of daily sent snapshots

• Frequent users endpoint callers
• Failed groups endpoint requests

• Microsoft Purview Information Protection events

• Show NGINXaaS access logs
• Show NGINXaaS error logs

• Show NGINXaaS security logs

• Path diagnostics

• Failed tests
• Tests performance

• Get traffic to non standard ports
• High volume traffic to uncommon domains

• DAG type vs DAG runs summary statitics
• Correlation IDs of all DAG runs
• Logs of a DAG run
• Error logs of a DAG run

• Count of successful warehouse delete requests

• All Office Activity
• Users accessing files
• File upload operation
• Office activity for user
• Creation of Forward rule
• Suspicious file name

• Non-RDMA activity
• RDMA activity
• What data is being collected?
• Memory and CPU usage
• CPU usage trends over the last day
• Top 10 computers with the highest disk space
• What data is being collected?
• Virtual Machine available memory
• Chart CPU usage trends
• Virtual Machine free disk space
• Top 10 Virtual Machines by CPU utilization
• Bottom 10 Free disk space %
• Container CPU
• Container memory
• Instances Avg CPU usage growth from last week
• Find In Perf

• Power Apps events filtered activity type

• Power Automate events filtered by activity type

• PowerBI events filtered by organization ID

• Power Platform administration events

• Power Platform Connector events filtered by by activity type

• Power Platform DLP events filtered by by activity type

• MS Project events filtered by organization ID

• Signatures out of date
• Protection Status updates
• Malware detection

• Audit collection delete events

• Unique authenticated Redis client IP addresses
• Redis client authentication requests per hour
• Redis client connections per hour
• Redis client disconnections per hour
• Unsuccessful authentication attempts on Redis cache

• Group number of requests based on the IP address
• Number of opertions triggered
• Calls based on the target URI
• Calls based on operation name
• Calls based on user

• SQL Recommendations by Focus Area
• SQL Recommendations by Computer
• SQL Recommendations by Instance
• SQL Recommendations by Database
• SQL Recommendations by AffectedObjectType
• How many times did each unique SQL Recommendation trigger?
• High priority SQL Assessment recommendations

• All attack paths by specific risk level

• Security Events most common event IDs
• Members added to security groups
• Uses of clear text password
• Windows failed logins
• All Security Activities
• Security Activities on the Device
• Security Activities for Admin
• Logon Activity by Device
• Devices With More Than 10 Logons
• Accounts Terminated Antimalware
• Devices with Antimalware Terminated
• Devices Where Hash Was Executed
• Process Names Executed
• Devices With Security Log Cleared
• Logon Activity by Account
• Accounts With Less Than 5 Times Logons
• Remoted Logged Accounts on Devices
• Computers With Guest Account Logons
• Members Added to Security Enabled Groups
• Domain Security Policy Changes
• System Audit Policy Changes
• Suspicious Executables
• Logons With Clear Text Password
• Computers With Cleaned Event Logs
• Accounts Failed to Logon
• Locked Accounts
• Change or Reset Passwords Attempts
• Groups Created or Modified
• Remote Procedure Call Attempts
• User Accounts Changed

• Failures updating Office365-Sharepoint related Sentinel resources

• Client connection IDs
• Connection close reasons
• IP addresses
• Logs relating to specific connection ID
• Logs relating to specific message tracing ID
• Logs relating to specific user ID
• Logs with warning or exceptions
• Server connection IDs
• Time chart of operation names
• Transport types
• User IDs

• All SiginLogs events
• Resources accessed by user
• User count per Resource
• User count per Application
• Failed Signin reasons
• Failed MFA challenge
• Failed App tried silent signin
• Failed login Count
• Signin Locations
• Logins To Resource

• Most common errors
• Operations causing most errors
• Operations with the highest latency
• Operations causing server side throttling
• Show anonymous requests
• Frequent operations chart

• Failed operation
• Failed priming job
• Completed long-running asynchronous operations

• Upgrade events

• Active warning events

• Malicious blobs per storage account
• Unsuccessful Scans

• Succeeded ingestions
• Succeeded ingestions timechart

• Synapse Link table fail events

• Find Linux kernel events
• All Syslog
• All Syslog with errors
• All Syslog by facility
• All Syslog by process name
• Users Added to Linux Group by Computer
• New Linux Group Created by Computer
• Failed Linux User Password Change
• Computers With Failed Ssh Logons
• Computers With Failed Su Logons
• Computers With Failed Sudo Logons

• Show event source connection errors
• 10 latest Ingress logs
• Show deserialization errors

• Content distribution in Gigabytes

• Device configuration

• Missing security or critical updates
• Updates available for Windows machines
• Updates available for Linux machines
• Missing updates summary
• Missing updates list
• Computer with missing updates
• Missing required updates for server
• Missing critical security updates
• Missing security or critical where update is manual
• Missing update rollups
• Distinct missing updates cross computers

• Patch installation failure for your machines

• Summary of updates available across machines
• Missing update specific product
• Automatic update configuration
• Automatic update configuration is disabled

• Links where a user was allowed to proceed

• Usage by data types
• Billable performance data
• Volume of solutions' data
• Total workspace ingestion over the last 24 hours
• Container Insight solution billable data

• Mongo vCore requests P99 duration by operation
• Mongo vCore requests binned by duration
• Failed Mongo vCore requests
• Mongo vCore requests by user agent

• Video Indexer Audit by account id
• Video Indexer Audit top 10 users by operations
• Video Indexer Audit parsed error message
• Video Indexer Audit failed operations

• Failed Indexing operations
• Top 10 users

• List IIS log entries
• Display breakdown respond codes
• Maximum time taken for each page
• Show 404 pages list
• Average HTTP request time
• Servers with internal server error
• Count IIS log entries by HTTP request method
• Count IIS log entries by HTTP user agent
• Count IIS log entries by client IP address
• IIS log entries for client IP
• Count of IIS log entries by URL
• Count of IIS log entries by host
• Total bytes traffic by client IP
• Bytes received by each IIS computer
• Bytes responded to clients by each IIS server IP
• Average HTTP request time by client IP

• Active sessions on SessionHost
• HealthChecks of SessionHost

• Published remote resources by count of users

• Average round-trip time over time
• Average BW across all connections
• Top 10 users with the highest round-trip time
• Top 10 users with lowest bandwidth
• Summary of Round-trip time and bandwidth

• Connection Errors
• Session duration
• Top 10 users by average connection duration
• Top 10 most active users
• Average connection duration by hostpool
• Client-side operating system information by user count
• Azure Virtual Desktop client usage information
• Average session logon time

• Top 10 connection errors
• Top 10 feed errors

• Update deployment failures
• Devices pending reboot to complete update
• Devices with a Safeguard Hold
• Target build distribution of devices with a safeguard hold

• Distribution of device Servicing Branch
• Distribution of device OS Edition
• Feature Update Deferral Configurations
• Feature Update Pause Configurations
• Quality Update Deferral Configurations
• Quality Update Pause Configurations

• Get Watchlist aliases
• Lookup events using a Watchlist

• WindowsEvent Audit Policy Events

• Agents that provide wire data
• IP Addresses of the agents providing wire data
• All Outbound communications by Remote IP Address
• Bytes sent by Application Protocol
• Bytes received by Protocol Name
• Total bytes by IP version
• Remote IP addresses that have communicated with agents on the subnet '10.0.0.0/8' (any direction)
• Processes that initiated or received network traffic
• Amount of Network Traffic by Process

• Workload Monitoring Insights data collection warnings or errors

• Analyze logs from Azure storage with Log Analytics
• Learn more about resource logs
• Change resource log diagnostic settings using the Azure Monitor REST API