Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Diagnostic events emitted by the managed virtual network firewall provisioned by an Azure Machine Learning workspace. Each record represents a single Azure Firewall rule evaluation (network rule or application rule) performed on egress traffic from the workspace's managed VNet, including the source, destination, protocol, rule that matched, and the resulting action.
Table attributes
| Attribute | Value |
|---|---|
| Resource types | - |
| Categories | - |
| Solutions | LogManagement |
| Basic table support | No |
| Auxiliary / Lake table support | Yes |
| DCR workspace transformation support | No |
| Ingestion API support | No |
| Sample Queries | - |
Columns
| Column | Type | Description |
|---|---|---|
| _BilledSize | real | The record size in bytes |
| Category | string | The diagnostic log category. Always "ManagedNetworkEvent" for records in this table. |
| CorrelationId | string | Correlation identifier propagated by the Azure Machine Learning workspace pipeline. Use to correlate a managed network event with related workspace operations. |
| _IsBillable | string | Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account |
| Level | string | The severity level of the log record. Typical values are Informational, Warning, and Error. |
| OperationName | string | The ARM-format operation name identifying the firewall rule category evaluated. Example values include MICROSOFT.MACHINELEARNINGSERVICES/WORKSPACES/MANAGEDNETWORK/AZFWNETWORKRULE and MICROSOFT.MACHINELEARNINGSERVICES/WORKSPACES/MANAGEDNETWORK/AZFWAPPLICATIONRULE. |
| Properties | dynamic | Firewall rule evaluation details as emitted by the underlying managed Azure Firewall. Common fields include FirewallLogCategory (AZFWNetworkRule or AZFWApplicationRule), Action (Allow or Deny), ActionReason, Protocol, SourceIp, SourcePort, DestinationIp, DestinationPort, Fqdn, TargetUrl, Policy, RuleCollectionGroup, RuleCollection, Rule, IsTlsInspected, WebCategory, IsExplicitProxyRequest, and Sequence. The exact set of fields follows the upstream Azure Firewall log schema and may evolve as Azure Firewall adds new attributes. |
| _ResourceId | string | A unique identifier for the resource that the record is associated with |
| ResultType | string | The outcome of the firewall rule evaluation. "Succeeded" indicates the traffic matched an Allow rule; "Failed" indicates the traffic was denied by a Deny rule or did not match any allowed rule. |
| SourceSystem | string | The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics |
| _SubscriptionId | string | A unique identifier for the subscription that the record is associated with |
| TenantId | string | The Log Analytics workspace ID |
| TimeGenerated | datetime | The UTC timestamp at which the managed firewall evaluated the network flow. |
| Type | string | The name of the table |