AzureAttestationDiagnostics 表的查询

项目
11/11/2024

有关在 Azure 门户中使用这些查询的信息，请参阅 Log Analytics 教程。有关 REST API，请参阅查询。

是否有任何授权失败？

授权失败的证明提供程序请求的计数。

// To create an alert for this query, click '+ New alert rule'
AzureAttestationDiagnostics
| where toint(ResultSignature) == 403
| summarize count() by ResourceUri, ResultSignature, _ResourceId
// ResultSignature contains HTTP status code returned by the request, (e.g.  200, 300, 401, etc.)
// ResourceUri contains the URI of the request

是否有慢速请求？

长于 1 秒的证明提供程序请求的列表。

// To create an alert for this query, click '+ New alert rule'
let threshold=1000; // let operator defines a constant that can be further used in the query
AzureAttestationDiagnostics
| where DurationMs > threshold
| summarize count() by OperationName, _ResourceId

此证明提供程序有多活跃？

显示每个操作随时间推移的证明提供程序请求量趋势的折线图。

AzureAttestationDiagnostics
| where TimeGenerated > ago(1d)
| summarize count() by bin(TimeGenerated, 1h), OperationName // Aggregate by hour
| render timechart

谁正在调用此证明提供程序？

按调用方的 IP 地址和 AAD UPN 及其请求计数识别的调用方列表。

AzureAttestationDiagnostics
| summarize count() by CallerIpAddress, tostring(Identity.callerAadUPN)

证明策略是否有任何更改？

更改证明策略或策略签名证书的成功证明提供程序请求的列表。

// To create an alert for this query, click '+ New alert rule'
let policyOperations = pack_array(
    "AddPolicyCertificate",
    "AddPolicyManagementCertificate",
    "AddPolicyManagementCertificates",
    "RemovePolicyCertificate",
    "RemovePolicyManagementCertificate",
    "RemovePolicyManagementCertificates",
    "ResetAttestationPolicy",
    "SetCurrentPolicy",
    "SetCurrentPolicyWithHttpMessagesAsync",
    "SetEffectiveAttestationPolicy",
    "DeleteCurrentPolicy",
    "DeletePolicy"
);
AzureAttestationDiagnostics
| where toint(ResultSignature) == 200
| where policyOperations contains OperationName
| take 100

尝试配置证明策略时是否出现任何错误？

尝试配置证明策略或策略签名证书时出现的任何错误的列表。

// To create an alert for this query, click '+ New alert rule'
let policyOperations = pack_array(
    "AddPolicyCertificate",
    "AddPolicyManagementCertificate",
    "AddPolicyManagementCertificates",
    "PrepareToSetPolicy",
    "PrepareToUpdatePolicy",
    "RemovePolicyCertificate",
    "RemovePolicyManagementCertificate",
    "RemovePolicyManagementCertificates",
    "ResetAttestationPolicy",
    "SetCurrentPolicy",
    "SetCurrentPolicyWithHttpMessagesAsync",
    "SetEffectiveAttestationPolicy",
    "DeleteCurrentPolicy",
    "DeletePolicy"
);
AzureAttestationDiagnostics
| where toint(ResultSignature) >= 300
| where policyOperations contains OperationName
| take 100

通过