Queries for the AegDataPlaneRequests table
For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.
Unique unauthorized or forbidden client IP addresses
Get a list of client IP addresses from which EventGrid received unauthorized or forbidden requests.
EventGridDataPlaneRequests
| where OperationResult == "Unauthorized" or OperationResult == "Forbidden"
| summarize count() by ClientIpAddress