KQL Search

Query Details

NSG Changesby Userand Resource

Query

//NSG Changes by Resource and Who did it

AzureActivity
| where parse_json(Authorization).action == "Microsoft.Network/networkSecurityGroups/securityRules/write" and ActivityStatus == "Succeeded"
| distinct Resource, Caller

Explanation

This query retrieves information about changes made to network security groups (NSGs) in Azure. It filters for successful write actions on security rules within NSGs and returns the distinct resources and the individuals who made the changes.