MicrosoftAzureBastionAuditLogs

  • Article

Microsoft Azure Bastion Audit Logs

Table attributes

Attribute Value
Resource types microsoft.network/bastionhosts
Categories Azure Resources
Solutions LogManagement
Basic log No
Ingestion-time transformation Yes
Sample Queries -

Columns

Column Type Description
_BilledSize real The record size in bytes
ClientIpAddress string Browser IP Address that was used to log into the VirtualMachine from Bastion
ClientPort int Browser Port Number that was used to log into the VirtualMachine from Bastion
Duration int Duration in milliseconds where the Bastion Session lasted (available only when the Bastion Session ended)
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
Location string The location of the server that processed the request (e.g., China North).
Message string Additonal text that's assoicated of this event
OperationName string The name of the operation represented by this event
Protocol string Protocol (could be ssh or rdp) that was used to log into the VirtualMachine from Bastion
_ResourceId string A unique identifier for the resource that the record is associated with
ResourceType string Resource Type that was accessed during the session. This could be a VM/VMSS/BSL/etc.
SessionEndTime string Timestamp (UTC) of when the Bastion Session was ended
SessionStartTime datetime Timestamp (UTC) of when the Bastion Session was started
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
_SubscriptionId string A unique identifier for the subscription that the record is associated with
TargetResourceId string ResourceID of the VirtualMachine where the Bastion was connected to
TargetVMIPAddress string IP Address of VirtualMachine where the Bastion was connected to
TenantId string The Log Analytics workspace ID
Time datetime The timestamp (UTC) of the log
TimeGenerated datetime
TunnelId string Internal Bastion Connection GUID
Type string The name of the table
UserAgent string Browser User Agent that the request was sent
UserEmail string UserEmail account that was used to log into the VirtualMachine
UserName string UserName that was used to log into the VirtualMachine from Bastion