title | description | ms.topic | ms.service | ms.author | author | ms.date |
---|---|---|---|---|---|---|
Example log table queries for AzureAttestationDiagnostics |
Example queries for AzureAttestationDiagnostics log table |
reference |
azure-monitor |
edbaynash |
EdB-MSFT |
02/18/2024 |
Count of Attestation provider requests which failed authorization.
// To create an alert for this query, click '+ New alert rule'
AzureAttestationDiagnostics
| where toint(ResultSignature) == 403
| summarize count() by ResourceUri, ResultSignature, _ResourceId
// ResultSignature contains HTTP status code returned by the request, (e.g. 200, 300, 401, etc.)
// ResourceUri contains the URI of the request
List of Attestation provider requests that took longer than 1 second.
// To create an alert for this query, click '+ New alert rule'
let threshold=1000; // let operator defines a constant that can be further used in the query
AzureAttestationDiagnostics
| where DurationMs > threshold
| summarize count() by OperationName, _ResourceId
Line chart showing trend of Attestation provider requests volume, per operation over time.
AzureAttestationDiagnostics
| where TimeGenerated > ago(1d)
| summarize count() by bin(TimeGenerated, 1h), OperationName // Aggregate by hour
| render timechart
List of callers identified by their IP address and AAD UPN with their request count.
AzureAttestationDiagnostics
| summarize count() by CallerIpAddress, tostring(Identity.callerAadUPN)
List of successful Attestation provider requests to change the attestation policy or policy signing certificates.
// To create an alert for this query, click '+ New alert rule'
let policyOperations = pack_array(
"AddPolicyCertificate",
"AddPolicyManagementCertificate",
"AddPolicyManagementCertificates",
"RemovePolicyCertificate",
"RemovePolicyManagementCertificate",
"RemovePolicyManagementCertificates",
"ResetAttestationPolicy",
"SetCurrentPolicy",
"SetCurrentPolicyWithHttpMessagesAsync",
"SetEffectiveAttestationPolicy",
"DeleteCurrentPolicy",
"DeletePolicy"
);
AzureAttestationDiagnostics
| where toint(ResultSignature) == 200
| where policyOperations contains OperationName
| take 100
List of any errors attempting to configure the attestation policy or policy signing certificates.
// To create an alert for this query, click '+ New alert rule'
let policyOperations = pack_array(
"AddPolicyCertificate",
"AddPolicyManagementCertificate",
"AddPolicyManagementCertificates",
"PrepareToSetPolicy",
"PrepareToUpdatePolicy",
"RemovePolicyCertificate",
"RemovePolicyManagementCertificate",
"RemovePolicyManagementCertificates",
"ResetAttestationPolicy",
"SetCurrentPolicy",
"SetCurrentPolicyWithHttpMessagesAsync",
"SetEffectiveAttestationPolicy",
"DeleteCurrentPolicy",
"DeletePolicy"
);
AzureAttestationDiagnostics
| where toint(ResultSignature) >= 300
| where policyOperations contains OperationName
| take 100