Queries for the ResourceManagementPublicAccessLogs table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Group number of requests based on the IP address

Get the number of request accessing the resource from an IP address.

//List the IP addresses and number of calls
ResourceManagementPublicAccessLogs
| where Category == "PublicAccessLogs"
| summarize count() by CallerIpAddress 

Number of opertions triggered

Count the number of request made.

// Count the number of operations.
ResourceManagementPublicAccessLogs
| where Category == "PublicAccessLogs"
| summarize count() by CorrelationId 

Calls based on the target URI

Chart the number of calls based on the target URI.

// Chart the number of calls based on the target URI.
ResourceManagementPublicAccessLogs
| where Category == "PublicAccessLogs"
| summarize count() by Uri, bin(TimeGenerated, 1m)
| render columnchart with (kind=stacked) 

Calls based on operation name

Count the number of request made based on operation name.

// List the operations and their number of calls from the public network
ResourceManagementPublicAccessLogs
| where Category == "PublicAccessLogs"
| summarize count() by OperationName
| order by count_

Calls based on user

Count the number of request made based on object identifiers.

// List the object identifiers and number of calls from each over the public network
ResourceManagementPublicAccessLogs
| where Category == "PublicAccessLogs"
| summarize count() by ObjectIdentifier
| order by count_