Queries for the AegDataPlaneRequests table

Unique unauthorized or forbidden client IP addresses

Get a list of client IP addresses from which EventGrid received unauthorized or forbidden requests.

EventGridDataPlaneRequests
| where OperationResult == "Unauthorized" or OperationResult == "Forbidden"
| summarize count() by ClientIpAddress