NSG Changes By User
Query
AzureActivity
| where parse_json(Authorization).action == "Microsoft.Network/networkSecurityGroups/securityRules/write" and ActivityStatus == "Succeeded"
| make-series count() default=0 on TimeGenerated in range(ago(7d), now(), 1d) by Caller
|render barchartExplanation
This query is searching for Azure activity logs related to writing security rules for network security groups. It filters for activities that have a status of "Succeeded". It then groups the results by the caller and creates a series of counts for each caller over the past 7 days. Finally, it renders the results as a bar chart.
Details
Rod Trent
Released: June 4, 2020
Tables
AzureActivity
Keywords
AzureActivityAuthorizationMicrosoft.NetworknetworkSecurityGroupssecurityRuleswriteActivityStatusSucceededmake-seriescountdefaultTimeGeneratedrangeagonowCallerrenderbarchart
Operators
whereparse_json==andActivityStatusmake-seriescount()default=0onTimeGeneratedinrange()ago()now()1dbyCallerrenderbarchart