Queries for the AVNMRuleCollectionChange table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Get recent security admin rule collection changes

List 10 most recent security admin rule collection changes.

AVNMRuleCollectionChange
|where OperationName has("securityAdminRuleCollections")
|top 10 by TimeGenerated desc
|project TimeGenerated, NetworkResourceIds, AppliedRuleCollectionIds, ResultType

Get recent failed security admin rule collection changes

List 100 most recent failed security admin rule collection changes.

AVNMRuleCollectionChange
|where OperationName has("securityAdminRuleCollections")
|where ResultType != "Success"
|sort by TimeGenerated desc
|take 100