LLMActivity 資料表的查詢

若要了解如何在 Azure 入口網站中使用這些查詢，請參閱 Log Analytics 教程。 如需 REST API，請參閱 查詢。

依使用者劃分的 Copilot 互動

顯示過去 7 天內按使用者分組的 Copilot 互動，以及計數和時間範圍

LLMActivity
| where RecordType == "CopilotInteraction"
| where TimeGenerated >= ago(7d)
| summarize InteractionCount = count(), 
            FirstInteraction = min(TimeGenerated),
            LastInteraction = max(TimeGenerated)
            by ActorName, ActorUserId
| order by InteractionCount desc

Copilot 外掛程式管理活動

顯示過去 30 天內的外掛程式建立、更新和狀態變更

LLMActivity
| where RecordType in ("CreateCopilotPlugin", "UpdateCopilotPlugin", "EnableCopilotPlugin", "DisableCopilotPlugin")
| where TimeGenerated >= ago(30d)
| project TimeGenerated, ActorName, RecordType, AgentName, SrcIpAddr
| order by TimeGenerated desc

Copilot PromptBook 管理

追蹤過去 30 天內的 PromptBook 建立、更新和刪除

LLMActivity
| where RecordType in ("CreateCopilotPromptBook", "UpdateCopilotPromptBook", "DeleteCopilotPromptBook")
| where TimeGenerated >= ago(30d)
| extend PromptBookId = tostring(LLMEventData.Resource[0].Property)
| project TimeGenerated, ActorName, RecordType, PromptBookId, SrcIpAddr
| order by TimeGenerated desc

Copilot 安全性與合規性事件

顯示與安全性相關的 Copilot 事件，包括過去 7 天的越獄偵測

LLMActivity
| where RecordType == "CopilotInteraction"
| where TimeGenerated >= ago(7d)
| extend Messages = LLMEventData.Messages
| mv-expand Messages
| where tobool(Messages.JailbreakDetected) == true
| project TimeGenerated, ActorName, ActorUserId, AgentName, 
          MessageId = tostring(Messages.Id),
          JailbreakDetected = tobool(Messages.JailbreakDetected)
| order by TimeGenerated desc

AI Model 使用統計

顯示過去 30 天內在 Copilot 互動中使用哪些 AI 模型

LLMActivity
| where RecordType == "CopilotInteraction"
| where TimeGenerated >= ago(30d)
| where isnotempty(AIModelName)
| summarize InteractionCount = count(),
            UniqueUsers = dcount(ActorUserId),
            FirstUsed = min(TimeGenerated),
            LastUsed = max(TimeGenerated)
            by AIModelName, AIModelVersion
| order by InteractionCount desc

Copilot 存取的資源

顯示過去 7 天內在 Copilot 互動期間存取的外部資源

LLMActivity
| where RecordType == "CopilotInteraction"
| where TimeGenerated >= ago(7d)
| extend AccessedResources = LLMEventData.AccessedResources
| mv-expand AccessedResources
| where isnotempty(AccessedResources.SiteUrl)
| project TimeGenerated, ActorName, AgentName,
          ResourceUrl = tostring(AccessedResources.SiteUrl),
          Action = tostring(AccessedResources.Action),
          ResourceType = tostring(AccessedResources.Type)
| summarize AccessCount = count() by ResourceUrl, Action, ResourceType
| order by AccessCount desc