Intelligence Packs - List

Service:

Log Analytics

API Version:

2026-03-01

Lists all the intelligence packs possible and whether they are enabled or disabled for a given workspace.

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/intelligencePacks?api-version=2026-03-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string (uuid)	The ID of the target subscription. The value must be an UUID.
workspaceName	path	True	string minLength: 4 maxLength: 63 pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$	The name of the workspace.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Responses

Name	Type	Description
200 OK	IntelligencePack[]	Azure operation completed successfully.
Other Status Codes	ErrorResponse	An unexpected error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

IntelligencePacksList

Sample request

HTTP

GET https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.OperationalInsights/workspaces/TestLinkWS/intelligencePacks?api-version=2026-03-01

Sample response

Status code:

200

[
  {
    "name": "CapacityPerformance",
    "displayName": "Capacity and Performance",
    "enabled": false
  },
  {
    "name": "AzureWebAppsAnalytics",
    "displayName": "Azure Web Apps Analytics (Preview)",
    "enabled": false
  },
  {
    "name": "Security",
    "displayName": "Security and Audit",
    "enabled": false
  },
  {
    "name": "Updates",
    "displayName": "Update Management",
    "enabled": false
  },
  {
    "name": "AntiMalware",
    "displayName": "Antimalware Assessment",
    "enabled": false
  },
  {
    "name": "LogManagement",
    "displayName": "Log Management",
    "enabled": true
  },
  {
    "name": "ChangeTracking",
    "displayName": "Change Tracking",
    "enabled": true
  },
  {
    "name": "SQLAssessment",
    "displayName": "SQL Assessment",
    "enabled": false
  },
  {
    "name": "SCOMAssessment",
    "displayName": "System Center Operations Manager Assessment (Preview)",
    "enabled": false
  },
  {
    "name": "ServiceDesk",
    "displayName": "IT Service Management Connector(Preview)",
    "enabled": false
  },
  {
    "name": "ADAssessment",
    "displayName": "AD Assessment",
    "enabled": false
  },
  {
    "name": "AlertManagement",
    "displayName": "Alert Management",
    "enabled": false
  },
  {
    "name": "AzureAutomation",
    "displayName": "Azure Automation",
    "enabled": false
  },
  {
    "name": "WireData",
    "displayName": "Wire Data",
    "enabled": false
  },
  {
    "name": "SiteRecovery",
    "displayName": "Azure Site Recovery",
    "enabled": true
  },
  {
    "name": "Backup",
    "displayName": "Backup",
    "enabled": false
  },
  {
    "name": "SurfaceHub",
    "displayName": "Surface Hub",
    "enabled": false
  },
  {
    "name": "NetworkMonitoring",
    "displayName": "Network Performance Monitor",
    "enabled": false
  },
  {
    "name": "Containers",
    "displayName": "Container Monitoring Solution",
    "enabled": false
  },
  {
    "name": "ServiceMap",
    "displayName": "Service Map",
    "enabled": false
  },
  {
    "name": "AzureNetworking",
    "displayName": "Azure Networking Analytics (Deprecated)",
    "enabled": false
  },
  {
    "name": "ADReplication",
    "displayName": "AD Replication Status",
    "enabled": false
  },
  {
    "name": "Office365",
    "displayName": "Office 365 (Preview)",
    "enabled": false
  },
  {
    "name": "CompatibilityAssessment",
    "displayName": "Upgrade Readiness",
    "enabled": false
  },
  {
    "name": "KeyVault",
    "displayName": "Key Vault (Deprecated)",
    "enabled": false
  },
  {
    "name": "ServiceFabric",
    "displayName": "Service Fabric",
    "enabled": false
  },
  {
    "name": "DnsAnalytics",
    "displayName": "DNS Analytics (Preview)",
    "enabled": false
  },
  {
    "name": "ApplicationInsights",
    "displayName": "Application Insights (Preview)",
    "enabled": false
  },
  {
    "name": "WireData2",
    "displayName": "Wire Data 2.0",
    "enabled": false
  },
  {
    "name": "WaaSUpdateInsights",
    "displayName": "Update Compliance (Preview)",
    "enabled": false
  },
  {
    "name": "AgentHealthAssessment",
    "displayName": "Agent Health ",
    "enabled": false
  },
  {
    "name": "AzureActivity",
    "displayName": "Activity Log Analytics",
    "enabled": false
  },
  {
    "name": "HDInsight",
    "displayName": "HDInsight HBase Monitoring (Preview)",
    "enabled": false
  },
  {
    "name": "HDInsightKafka",
    "displayName": "HDInsight Kafka Monitoring",
    "enabled": false
  },
  {
    "name": "HDInsightSpark",
    "displayName": "HDInsight Spark Monitoring",
    "enabled": false
  },
  {
    "name": "VMware",
    "displayName": "VMware (Preview)",
    "enabled": false
  },
  {
    "name": "SecurityCenterFree",
    "displayName": "Security Center Free � for Azure Resources only",
    "enabled": false
  },
  {
    "name": "LogicAppsManagement",
    "displayName": "Logic Apps Management",
    "enabled": false
  },
  {
    "name": "LogicAppB2B",
    "displayName": "Logic Apps B2B",
    "enabled": false
  },
  {
    "name": "AzureSQLAnalytics",
    "displayName": "Azure SQL Analytics (Preview)",
    "enabled": false
  },
  {
    "name": "KeyVaultAnalytics",
    "displayName": "Key Vault Analytics",
    "enabled": false
  },
  {
    "name": "AzureNSGAnalytics",
    "displayName": "Azure Network Security Group Analytics",
    "enabled": false
  },
  {
    "name": "AzureAppGatewayAnalytics",
    "displayName": "Azure Application Gateway Analytics",
    "enabled": false
  },
  {
    "name": "DeviceHealthProd",
    "displayName": "Device Health (Preview)",
    "enabled": false
  },
  {
    "name": "WindowsDefenderATP",
    "displayName": "Windows Defender ATP",
    "enabled": false
  },
  {
    "name": "ProcessInvestigator",
    "displayName": "ProcessInvestigator",
    "enabled": false
  }
]

Definitions

Name	Description
ErrorAdditionalInfo	The resource management error additional info.
ErrorDetail	The error detail.
ErrorResponse	Error response
IntelligencePack	Intelligence Pack containing a string name and boolean indicating if it's enabled.

ErrorAdditionalInfo

Object

The resource management error additional info.

Name	Type	Description
info	object	The additional info.
type	string	The additional info type.

ErrorDetail

Object

The error detail.

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	The error additional info.
code	string	The error code.
details	ErrorDetail[]	The error details.
message	string	The error message.
target	string	The error target.

ErrorResponse

Object

Error response

Name	Type	Description
error	ErrorDetail	The error object.

IntelligencePack

Object

Intelligence Pack containing a string name and boolean indicating if it's enabled.

Name	Type	Description
displayName	string	The display name of the intelligence pack.
enabled	boolean	The enabled boolean for the intelligence pack.
name	string	The name of the intelligence pack.