AFSAuditLogs 테이블에 대한 쿼리

  • 아티클

집계 작업 쿼리

제공 기간 동안 모든 UnsuspendAmlFilesystem 요청을 나열합니다.

AFSAuditLogs
// The OperationName below can be replaced by obtain other operations such as "RebootAmlFilesystemNode" or "AmlFSRefreshHSMToken".
| where OperationName has "UnsuspendAmlFilesystem"
| project TimeGenerated, _ResourceId, ActivityId, ResultSignature, ResultDescription, Location
| sort by TimeGenerated asc
| limit 100

권한 없는 요청 쿼리

권한 없는 액세스로 인해 실패한 AMLFilesystems 요청의 수입니다.

AFSAuditLogs
// 401 below could be replaced by other result signatures to obtain different operation results.
// For example, 'ResultSignature == 202' to obtain accepted requests.
| where ResultSignature == 401
| summarize count() by _ResourceId, OperationName