AzureAttestationDiagnostics 數據表的查詢
是否有任何授權失敗?
授權失敗的證明提供者要求計數。
// To create an alert for this query, click '+ New alert rule'
AzureAttestationDiagnostics
| where toint(ResultSignature) == 403
| summarize count() by ResourceUri, ResultSignature, _ResourceId
// ResultSignature contains HTTP status code returned by the request, (e.g. 200, 300, 401, etc.)
// ResourceUri contains the URI of the request
是否有任何緩慢的要求?
超過 1 秒的證明提供者要求清單。
// To create an alert for this query, click '+ New alert rule'
let threshold=1000; // let operator defines a constant that can be further used in the query
AzureAttestationDiagnostics
| where DurationMs > threshold
| summarize count() by OperationName, _ResourceId
此證明提供者的作用中程度如何?
折線圖顯示一段時間內每個作業的證明提供者要求量趨勢。
AzureAttestationDiagnostics
| where TimeGenerated > ago(1d)
| summarize count() by bin(TimeGenerated, 1h), OperationName // Aggregate by hour
| render timechart
誰正在呼叫此證明提供者?
其IP位址所識別的呼叫端清單,以及其要求計數的 AAD UPN。
AzureAttestationDiagnostics
| summarize count() by CallerIpAddress, tostring(Identity.callerAadUPN)
證明原則是否有任何變更?
成功證明提供者要求的清單,以變更證明原則或原則簽署憑證。
// To create an alert for this query, click '+ New alert rule'
let policyOperations = pack_array(
"AddPolicyCertificate",
"AddPolicyManagementCertificate",
"AddPolicyManagementCertificates",
"RemovePolicyCertificate",
"RemovePolicyManagementCertificate",
"RemovePolicyManagementCertificates",
"ResetAttestationPolicy",
"SetCurrentPolicy",
"SetCurrentPolicyWithHttpMessagesAsync",
"SetEffectiveAttestationPolicy",
"DeleteCurrentPolicy",
"DeletePolicy"
);
AzureAttestationDiagnostics
| where toint(ResultSignature) == 200
| where policyOperations contains OperationName
| take 100
是否有任何嘗試設定證明原則的錯誤?
嘗試設定證明原則或原則簽署憑證的任何錯誤清單。
// To create an alert for this query, click '+ New alert rule'
let policyOperations = pack_array(
"AddPolicyCertificate",
"AddPolicyManagementCertificate",
"AddPolicyManagementCertificates",
"PrepareToSetPolicy",
"PrepareToUpdatePolicy",
"RemovePolicyCertificate",
"RemovePolicyManagementCertificate",
"RemovePolicyManagementCertificates",
"ResetAttestationPolicy",
"SetCurrentPolicy",
"SetCurrentPolicyWithHttpMessagesAsync",
"SetEffectiveAttestationPolicy",
"DeleteCurrentPolicy",
"DeletePolicy"
);
AzureAttestationDiagnostics
| where toint(ResultSignature) >= 300
| where policyOperations contains OperationName
| take 100
意見反應
https://aka.ms/ContentUserFeedback。
即將登場:在 2024 年,我們將逐步淘汰 GitHub 問題作為內容的意見反應機制,並將它取代為新的意見反應系統。 如需詳細資訊,請參閱:提交並檢視相關的意見反應