Queries for the AZMSVnetConnectionEvents table
For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.
Publish deny connection by namespace
Publish deny connection by namespace on network data.
AZMSVnetConnectionEvents
| extend NamespaceName = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "EventHub"
| where Action == "Deny Connection"
| project Action, _SubscriptionId, NamespaceName, AddressIp, Reason, Count
| summarize by Action, NamespaceName
Publish namespace vnet data
Publish vnet data for namespace by action status.
AZMSVnetConnectionEvents
| extend NamespaceName = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "EventHub"
| project Action, _SubscriptionId, NamespaceName, AddressIp, Reason, Count, _ResourceId
| summarize by NamespaceName, Action
Publish deny connection by namespace
Publish deny network connection information by namespace.
AZMSVNetConnectionEvents
| extend NamespaceName = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "Relay"
| where Action == "Deny Connection"
| project Action, _SubscriptionId, NamespaceName, AddressIp, Reason, Count
| summarize by Action, NamespaceName
Publish virtual network events by namespace
Publish virtual network events with outcome for namespace.
AZMSVNetConnectionEvents
| extend NamespaceName = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "Relay"
| project Action, _SubscriptionId, NamespaceName, AddressIp, Reason, Count, _ResourceId
| summarize by NamespaceName, Action
Publish deny connection by namespace
Publish deny network connection information by namespace.
AZMSVNetConnectionEvents
| extend NamespaceName = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "ServiceBus"
| where Action == "Deny Connection"
| project Action, _SubscriptionId, NamespaceName, AddressIp, Reason, Count
| summarize by Action, NamespaceName
Publish virtual network events by namespace
Publish virtual network events with outcome for namespace.
AZMSVNetConnectionEvents
| extend NamespaceName = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "ServiceBus"
| project Action, _SubscriptionId, NamespaceName, AddressIp, Reason, Count, _ResourceId
| summarize by NamespaceName, Action