Abfragen für die TABELLE REDConnectionEvents
Eindeutige authentifizierte Redis-Client-IP-Adressen
Eindeutige Redis-Client-IP-Adressen, die sich erfolgreich beim Cache authentifiziert haben.
REDConnectionEvents
// https://docs.redis.com/latest/rs/security/audit-events/#status-result-codes
// EventStatus :
// 0 AUTHENTICATION_FAILED - Invalid username and/or password.
// 1 AUTHENTICATION_FAILED_TOO_LONG - Username or password are too long.
// 2 AUTHENTICATION_NOT_REQUIRED - Client tried to authenticate, but authentication isn’t necessary.
// 3 AUTHENTICATION_DIRECTORY_PENDING - Attempting to receive authentication info from the directory in async mode.
// 4 AUTHENTICATION_DIRECTORY_ERROR - Authentication attempt failed because there was a directory connection error.
// 5 AUTHENTICATION_SYNCER_IN_PROGRESS - Syncer SASL handshake. Return SASL response and wait for the next request.
// 6 AUTHENTICATION_SYNCER_FAILED - Syncer SASL handshake. Returned SASL response and closed the connection.
// 7 AUTHENTICATION_SYNCER_OK - Syncer authenticated. Returned SASL response.
// 8 AUTHENTICATION_OK - Client successfully authenticated.
| where EventType == "auth" and EventStatus == 2 or EventStatus == 8 or EventStatus == 7
| summarize count() by ClientIp
Redis-Clientauthentifizierungsanforderungen pro Stunde
Redis-Clientauthentifizierungsanforderungen pro Stunde innerhalb des angegebenen IP-Adressbereichs. Umfasst sowohl erfolgreiche als auch nicht erfolgreiche Anforderungen.
REDConnectionEvents
| extend EventTime = unixtime_seconds_todatetime(EventEpochTime)
// For particular datetime filtering, add '| where EventTime between (StartTime .. EndTime)'
// For particular IP range filtering, add '| where ipv4_is_in_range(ClientIp, IpRange)'
// IP range can be defined like this 'let IpRange = "10.1.1.0/24";' at the top of query.
| where EventType == "auth"
| summarize AuthencationRequestsCount = count() by TimeRange = bin(EventTime, 1h)
Redis-Clientverbindungen pro Stunde
Redis-Clientverbindungen pro Stunde innerhalb des angegebenen IP-Adressbereichs.
REDConnectionEvents
// For particular datetime filtering, add '| where EventTime between (StartTime .. EndTime)'
// For particular IP range filtering, add '| where ipv4_is_in_range(ClientIp, IpRange)'
// IP range can be defined like this 'let IpRange = "10.1.1.0/24";' at the top of query.
| extend EventTime = unixtime_seconds_todatetime(EventEpochTime)
| where EventType == "new_conn"
| summarize ConnectionCount = count() by TimeRange = bin(EventTime, 1h)
Redis-Clienttrennungen pro Stunde
Redis-Clienttrennungen pro Stunde innerhalb des angegebenen IP-Adressbereichs.
REDConnectionEvents
// For particular datetime filtering, add '| where EventTime between (StartTime .. EndTime)'
// For particular IP range filtering, add '| where ipv4_is_in_range(ClientIp, IpRange)'
// IP range can be defined like this 'let IpRange = "10.1.1.0/24";' at the top of query.
| extend EventTime = unixtime_seconds_todatetime(EventEpochTime)
| where EventType == "close_conn"
| summarize DisconnectionCount = count() by TimeRange = bin(EventTime, 1h)
Nicht erfolgreiche Authentifizierungsversuche im Redis-Cache
Authentifizierungsversuche für Redis-Cache, die nicht erfolgreich waren.
REDConnectionEvents
// https://docs.redis.com/latest/rs/security/audit-events/#status-result-codes
// EventStatus :
// 0 AUTHENTICATION_FAILED - Invalid username and/or password.
// 1 AUTHENTICATION_FAILED_TOO_LONG - Username or password are too long.
// 2 AUTHENTICATION_NOT_REQUIRED - Client tried to authenticate, but authentication isn’t necessary.
// 3 AUTHENTICATION_DIRECTORY_PENDING - Attempting to receive authentication info from the directory in async mode.
// 4 AUTHENTICATION_DIRECTORY_ERROR - Authentication attempt failed because there was a directory connection error.
// 5 AUTHENTICATION_SYNCER_IN_PROGRESS - Syncer SASL handshake. Return SASL response and wait for the next request.
// 6 AUTHENTICATION_SYNCER_FAILED - Syncer SASL handshake. Returned SASL response and closed the connection.
// 7 AUTHENTICATION_SYNCER_OK - Syncer authenticated. Returned SASL response.
// 8 AUTHENTICATION_OK - Client successfully authenticated.
| where EventType == "auth" and EventStatus != 2 and EventStatus != 8 and EventStatus != 7
| project ClientIp, EventStatus, ConnectionId
Feedback
https://aka.ms/ContentUserFeedback.
Bald verfügbar: Im Laufe des Jahres 2024 werden wir GitHub-Issues stufenweise als Feedbackmechanismus für Inhalte abbauen und durch ein neues Feedbacksystem ersetzen. Weitere Informationen finden Sie unterFeedback senden und anzeigen für