ArcK8sAudit

Contains all Kubernetes API Server audit logs including events with the get and list verbs. These events are useful for monitoring all of the interactions with the Kubernetes API. To limit the scope to modifying operations see the ArcK8sAuditAdmin table. Requires Diagnostic Settings to use the Resource Specific destination table.

Table attributes

Attribute	Value
Resource types	microsoft.kubernetes/connectedclusters
Categories	Audit, Azure Resources, Containers
Solutions	LogManagement
Basic log	Yes
Ingestion-time transformation	No
Sample Queries	-

Columns

Column	Type	Description
Annotations	dynamic	An unstructed key-value map associated with this audit event. These annotations are set by plugins as part of the request serving chain and are included at the Metadata event level.
AuditId	string	Unique audit ID that is generated for each request.
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
Level	string	Level (Metadata, Request, RequestResponse) of the audit event.
ObjectRef	dynamic	The Kubernetes object reference this event was targeted for. This field does not apply for list requests nor non-resource requests.
PodName	string	Name of the pod emitting this audit event.
RequestObject	dynamic	Kubernetes API object from the request in object format or the string "skipped-too-big-size-object". This is omitted for non-resource requests.
RequestReceivedTime	datetime	Time when the API Server first received the request.
RequestUri	string	The URI of the request made by the client to the server.
_ResourceId	string	A unique identifier for the resource that the record is associated with
ResponseObject	dynamic	Kubernetes API object from the response, in object format or the string "skipped-too-big-size-object". This is omitted for non-resource requests.
ResponseStatus	dynamic	Response status for the request, which includes the response code. In error cases, this object will include the error message property.
SourceIps	dynamic	The list of source IP addresses for the originating client and intermediate proxies.
SourceSystem	string	The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
Stage	string	The request handling stage (RequestReceived, ResponseStarted, ResponseComplete, Panic) at which this audit event was generated.
StageReceivedTime	datetime	Time when the request reached the current audit stage.
_SubscriptionId	string	A unique identifier for the subscription that the record is associated with
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	Event generation time.
Type	string	The name of the table
User	dynamic	Authenticated user metadata of the requesting client, including optional fields such as UID and groups.
UserAgent	string	The user agent string presented by the originating client.
Verb	string	The Kubernetes verb associated with the request. For non-resource requests, this is the lower-cased HTTP method.