AzureDiagnostics

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Reference for AzureDiagnostics table in Azure Monitor Logs.

Attribute	Value
Category	Various
Custom Log V1	Yes 🔶 — uses type-suffixed column names
Supports Transformations	✗ No
Ingestion API Supported	✗ No
Lake-Only Ingestion	✗ No (source)
Azure Monitor Tables Reference	View Documentation

Schema
Solutions
Connectors
Content Items
Parsers

Schema (170 columns)

Source: Azure Monitor documentation

Column Name	Type	Description

| ... | ... | ...

Solutions (34)

This table is used by the following solutions:

Connectors (14)

This table is ingested by the following connectors:

Connector	Selection Criteria
Azure Batch Account	`ResourceProvider == "MICROSOFT.BATCH"`
Azure Cognitive Search	`ResourceProvider == "MICROSOFT.SEARCH"`
Azure Data Lake Storage Gen1	`ResourceProvider == "MICROSOFT.DATALAKESTORE"`
Azure Event Hub	`ResourceProvider == "MICROSOFT.EVENTHUB"`
Azure Firewall	`ResourceType == "AZUREFIREWALLS"`
Azure Key Vault	`ResourceProvider == "MICROSOFT.KEYVAULT"`
Azure Kubernetes Service (AKS)	`Category in "cluster-autoscaler,guard,kube-apiserver,kube-audit,kube-audit-admin,kube-controller-manager,kube-scheduler"`
Azure Logic Apps	`ResourceProvider == "MICROSOFT.LOGIC"`
Network Security Groups	`Category in "NetworkSecurityGroupEvent,NetworkSecurityGroupRuleCounter"`
Azure Service Bus	`ResourceProvider == "MICROSOFT.SERVICEBUS"`
Azure SQL Databases	`Category in "AutomaticTuning,Basic,Blocks,DatabaseWaitStatistics,Deadlocks,DevOpsOperationsAudit,Errors,InstanceAndAppAdvanced,QueryStoreWaitStatistics,SQLInsights,SQLSecurityAuditEvents,Timeouts,WorkloadManagement"` `Category contains "SQLSecurityAuditEvents"` `ResourceProvider == "MICROSOFT.SQL"` `ResourceType == "SERVERS/DATABASES"`
Azure Stream Analytics	`ResourceProvider == "MICROSOFT.STREAMANALYTICS"`
Azure DDoS Protection	`Category == "DDoSMitigationReports"` `ResourceType == "PUBLICIPADDRESSES"`
Azure Web Application Firewall (WAF)	`ResourceType in "APPLICATIONGATEWAYS,CDNWEBAPPLICATIONFIREWALLPOLICIES,FRONTDOORS"` `action_s == "Blocked"`

Content Items Using This Table (78)

Analytic Rules (36)

In solution Apache Log4j Vulnerability Detection:

Analytic Rule	Selection Criteria
Azure WAF matching for Log4j vuln(CVE-2021-44228)	`Category in "ApplicationGatewayFirewallLog,FrontdoorWebApplicationFirewallLog"` `ResourceProvider == "MICROSOFT.NETWORK"`
Log4j vulnerability exploit aka Log4Shell IP IOC	`Category in "AzureFirewallApplicationRule,AzureFirewallNetworkRule"` `ResourceType == "AZUREFIREWALLS"`
User agent search for log4j exploitation attempt

In solution Azure DDoS Protection: Category == "DDoSMitigationFlowLogs"
ResourceType == "PUBLICIPADDRESSES"

Analytic Rule
DDoS Attack IP Addresses - PPS Threshold
DDoS Attack IP Addresses - Percent Threshold

In solution Azure Firewall:

Analytic Rule	Selection Criteria
Abnormal Deny Rate for Source IP
Abnormal Port to Protocol
Multiple Sources Affected by the Same TI Destination
Port Scan
Port Sweep
Several deny actions registered

In solution Azure Key Vault: ResourceType == "VAULTS"

Analytic Rule
Azure Key Vault access TimeSeries anomaly
Mass secret retrieval from Azure Key Vault
NRT Sensitive Azure Key Vault operations
Sensitive Azure Key Vault operations

In solution Azure SQL Database solution for sentinel: Category == "SQLSecurityAuditEvents"

Analytic Rule
Affected rows stateful anomaly on database
Credential errors stateful anomaly on database
Drop attempts stateful anomaly on database
Execution attempts stateful anomaly on database
Firewall errors stateful anomaly on database
Firewall rule manipulation attempts stateful anomaly on database
OLE object manipulation attempts stateful anomaly on database
Outgoing connection attempts stateful anomaly on database
Response rows stateful anomaly on database
Syntax errors stateful anomaly on database

In solution Azure Web Application Firewall (WAF): Category == "FrontDoorWebApplicationFirewallLog"
action_s in "AnomalyScoring,Block"

Analytic Rule
AFD WAF - Code Injection
AFD WAF - Path Traversal Attack
Front Door Premium WAF - SQLi Detection
Front Door Premium WAF - XSS Detection

In solution Threat Intelligence:

Analytic Rule	Selection Criteria
TI Map IP Entity to Azure SQL Security Audit Events	`Category == "SQLSecurityAuditEvents"` `ResourceProvider == "MICROSOFT.SQL"`
TI map IP entity to Azure Key Vault logs	`ResourceType == "VAULTS"`
TI map IP entity to AzureFirewall

In solution Threat Intelligence (NEW):

Analytic Rule	Selection Criteria
TI Map IP Entity to Azure SQL Security Audit Events	`Category == "SQLSecurityAuditEvents"` `ResourceProvider == "MICROSOFT.SQL"`
TI map IP entity to Azure Key Vault logs	`ResourceType == "VAULTS"`
TI map IP entity to AzureFirewall

In solution Zinc Open Source:

Analytic Rule	Selection Criteria
[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022

Hunting Queries (19)

In solution Apache Log4j Vulnerability Detection: Category in "ApplicationGatewayAccessLog,ApplicationGatewayFirewallLog,FrontdoorAccessLog,FrontdoorWebApplicationFirewallLog"

Hunting Query
Azure WAF Log4j CVE-2021-44228 hunting

In solution Azure Firewall:

Hunting Query	Selection Criteria
First Time Source IP to Destination
First Time Source IP to Destination Using Port
Source IP Abnormally Connects to Multiple Destinations
Uncommon Port for Organization
Uncommon Port to IP

In solution Azure SQL Database solution for sentinel:

Hunting Query	Selection Criteria
Affected rows stateful anomaly on database - hunting query	`Category == "SQLSecurityAuditEvents"`
Anomalous Query Execution Time	`Category == "SQLSecurityAuditEvents"`
Anomalous Query Execution Time	`Category == "SQLSecurityAuditEvents"`
Boolean Blind SQL Injection	`Category == "SQLSecurityAuditEvents"`
Prevalence Based SQL Query Size Anomaly	`Category == "SQLSecurityAuditEvents"`
Response rows stateful anomaly on database - hunting query	`Category == "SQLSecurityAuditEvents"`
Suspicious SQL Stored Procedures	`Category == "SQLSecurityAuditEvents"`
Time Based SQL Query Size Anomaly	`Category == "SQLSecurityAuditEvents"`

In solution Azure kubernetes Service:

Hunting Query	Selection Criteria
Azure RBAC AKS created role details	`Category == "kube-audit"`
Determine users with cluster admin role	`Category == "kube-audit"` `Resource == "ClusterRoleBinding"`

In solution Cloud Service Threat Protection Essentials: ResourceType == "VAULTS"
ResultType == "Success"

Hunting Query
Azure Key Vault Access Policy Manipulation

In solution Legacy IOC based Threat Protection: Category == "AzureFirewallNetworkRule"

Hunting Query
Connection from external IP to OMI related Ports

In solution Web Shells Threat Protection: Category in "ApplicationGatewayAccessLog,ApplicationGatewayFirewallLog,FrontdoorAccessLog,FrontdoorWebApplicationFirewallLog"

Hunting Query
Possible Webshell usage attempt related to SpringShell(CVE-2022-22965)

Workbooks (23)

In solution Apache Log4j Vulnerability Detection: Category in "ApplicationGatewayAccessLog,ApplicationGatewayFirewallLog,FrontdoorAccessLog,FrontdoorWebApplicationFirewallLog"

Workbook
Log4jPostCompromiseHunting

In solution Azure DDoS Protection: Category in "DDoSMitigationFlowLogs,DDoSMitigationReports,DDoSProtectionNotifications"
Message == "Packet was forwarded to service"
Message startswith "Protocol violation"
Resource in ",{Resource:label}"

Workbook
AzDDoSStandardWorkbook

In solution Azure Firewall: Category in "AzureFirewallApplicationRule,AzureFirewallDnsProxy,AzureFirewallNetworkRule"
Resource in ",{Resource:label}"
ResourceType == "AZUREFIREWALLS"
msg_s !has ". Rule Collection:"
msg_s !has ". Url"
msg_s !has "DNAT"
msg_s !has "No rule matched"
msg_s !has "Policy:"
msg_s !has "Reason:"
msg_s !has "Rule Collection"
msg_s !has "Rule Collection:"
msg_s !has "TLS extension was missing"
msg_s !has "Type="
msg_s !has "Url"
msg_s !has "Web Category:"
msg_s has ". No rule matched"
msg_s has ". Rule Collection:"
msg_s has ". Url"
msg_s has "DNAT"
msg_s has "Policy:"
msg_s has "Reason:"
msg_s has "Rule Collection Group"
msg_s has "Rule Collection:"
msg_s has "Type="
msg_s has "Url"
msg_s has "Web Category:"

Workbook
AzureFirewallWorkbook

In solution Azure Key Vault: Category == "AuditEvent"
ResourceType == "VAULTS"

Workbook
AzureKeyVaultWorkbook

In solution Azure SQL Database solution for sentinel: Category == "SQLSecurityAuditEvents"
ResourceType == "SERVERS/DATABASES"

Workbook
Workbook-AzureSQLSecurity

In solution Azure Web Application Firewall (WAF):

Workbook	Selection Criteria
WebApplicationFirewallFirewallEvents	`Message == "*"` `Message has "SQL Injection"` `Message has "attack"` `ResourceType == "APPLICATIONGATEWAYS"` `action_s in "Blocked,Detected"` `instanceId_s has "role"`
WebApplicationFirewallGatewayAccessEvents	`ResourceType == "APPLICATIONGATEWAYS"`
WebApplicationFirewallOverview	`ResourceType == "APPLICATIONGATEWAYS"`
WebApplicationFirewallWAFTypeEvents	`Message has "attack"`

In solution Azure kubernetes Service: Category == "kube-audit"
Resource in "clusterrolebindings,events,pods,secrets"

Workbook
AksSecurity

In solution AzureSecurityBenchmark: Category in "All,AzureFirewallNetworkRule,NetworkSecurityGroupRuleCounter"
ResourceProvider == "MICROSOFT.KEYVAULT"
ResourceType == "AZUREFIREWALLS"
msg_s !has ". Rule Collection:"
msg_s !has "DNAT"
msg_s !has "Policy:"
msg_s !has "Rule Collection:"
msg_s !has "Type="
msg_s has ". Rule Collection:"
msg_s has "DNAT"
msg_s has "Policy:"
msg_s has "Rule Collection:"
msg_s has "Type="

Workbook
AzureSecurityBenchmark

In solution ContinuousDiagnostics&Mitigation: Category in "NetworkSecurityGroupEvent,kube-audit"
Category contains "SQL"
ResourceProvider == "MICROSOFT.KEYVAULT"
ResourceType in "APPLICATIONGATEWAYS,AZUREFIREWALLS,CDNWEBAPPLICATIONFIREWALLPOLICIES,FRONTDOORS,PROFILES,PUBLICIPADDRESSES"

Workbook
ContinuousDiagnostics&Mitigation

In solution CybersecurityMaturityModelCertification(CMMC)2.0: Category == "AzureFirewallApplicationRule"

Workbook
CybersecurityMaturityModelCertification_CMMCV2

In solution DPDP Compliance: Category == "SQLSecurityAuditEvents"
ResourceType == "SERVERS/DATABASES"

Workbook
DPDPCompliance

In solution GDPR Compliance & Data Security: Category == "SQLSecurityAuditEvents"
ResourceType == "SERVERS/DATABASES"

Workbook
GDPRComplianceAndDataSecurity

In solution HIPAA Compliance: Category == "AzureFirewallNetworkRule"
Category == "SQLSecurityAuditEvents"

Workbook
HIPAACompliance

In solution MaturityModelForEventLogManagementM2131: Category in "AzureFirewallApplicationRule,AzureFirewallNetworkRule,EntitlementManagement,FrontdoorWebApplicationFirewallLog,GatewayDiagnosticLog,GroupManagement,IKEDiagnosticLog,NetworkSecurityGroupEvent,RouteDiagnosticLog,TunnelDiagnosticLog,UserManagement,WebApplicationFirewallLogs,kube-audit"
Category contains "SQL"
Resource == "SOC-NS-AG-WAFV2"
ResourceProvider in "MICROSOFT.CONTAINERSERVICE,MICROSOFT.KEYVAULT"
ResourceType in "APPLICATIONGATEWAYS,AZUREFIREWALLS,CDNWEBAPPLICATIONFIREWALLPOLICIES,FRONTDOORS,PROFILES,PUBLICIPADDRESSES,SERVERS/DATABASES"
msg_s !has ". Url"
msg_s !has "No rule matched"
msg_s !has "Reason:"
msg_s !has "Rule Collection"
msg_s !has "TLS extension was missing"
msg_s !has "Web Category:"
msg_s has ". No rule matched"
msg_s has ". Url"
msg_s has "Reason:"
msg_s has "Rule Collection Group"
msg_s has "Web Category:"

Workbook
MaturityModelForEventLogManagement_M2131

In solution NISTSP80053: Category in "NetworkSecurityGroupEvent,kube-audit"
Category contains "SQL"
ResourceProvider == "MICROSOFT.KEYVAULT"
ResourceType in "APPLICATIONGATEWAYS,AZUREFIREWALLS,CDNWEBAPPLICATIONFIREWALLPOLICIES,FRONTDOORS,PROFILES,PUBLICIPADDRESSES"

Workbook
NISTSP80053

In solution PCI DSS Compliance:

Workbook	Selection Criteria
PCIDSSCompliance

In solution SOC Handbook:

Workbook	Selection Criteria
AzureSentinelCost

In solution SentinelSOARessentials: ResourceProvider == "MICROSOFT.LOGIC"

Workbook
AutomationHealth

In solution ThreatAnalysis&Response: ResourceType == "PUBLICIPADDRESSES"

Workbook
DynamicThreatModeling&Response

In solution ZeroTrust(TIC3.0): Category in "ApplicationGatewayFirewallLog,AzureFirewallApplicationRule,AzureFirewallDnsProxy,AzureFirewallNetworkRule,DDoSMitigationReports,FrontdoorWebApplicationFirewallLog,NetworkSecurityGroupEvent,WebApplicationFirewallLogs,kube-audit"
Category contains "SQL"
Resource == "SOC-NS-AG-WAFV2"
ResourceProvider == "MICROSOFT.KEYVAULT"
ResourceType in "APPLICATIONGATEWAYS,AZUREFIREWALLS,CDNWEBAPPLICATIONFIREWALLPOLICIES,FRONTDOORS,PROFILES,PUBLICIPADDRESSES"
msg_s !has ". Url"
msg_s !has "No rule matched"
msg_s !has "Reason:"
msg_s !has "Rule Collection"
msg_s !has "TLS extension was missing"
msg_s !has "Url"
msg_s !has "Web Category:"
msg_s has ". No rule matched"
msg_s has ". Url"
msg_s has "Reason:"
msg_s has "Rule Collection Group"
msg_s has "Url"
msg_s has "Web Category:"

Workbook
ZeroTrustTIC3

Parsers Using This Table (2)

Other Parsers (2)

Parser	Solution	Selection Criteria
AzureFirewallApplicationRule	(Legacy)
AzureFirewallNetworkRule	(Legacy)	`Category == "AzureFirewallNetworkRule"`

Selection Criteria Summary (41 criteria, 76 total references)

References by type: 14 connectors, 61 content items, 0 ASIM parsers, 1 other parsers.

Selection Criteria	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`Category == "SQLSecurityAuditEvents"`	-	18	-	-	18
`ResourceType == "VAULTS"`	-	6	-	-	6
`Category == "FrontDoorWebApplicationFirewallLog"` `action_s in "AnomalyScoring,Block"`	-	4	-	-	4
`Category in "ApplicationGatewayAccessLog,ApplicationGatewayFirewallLog,FrontdoorAccessLog,FrontdoorWebApplicationFirewallLog"`	-	3	-	-	3
`Category == "SQLSecurityAuditEvents"` `ResourceType == "SERVERS/DATABASES"`	-	3	-	-	3
`ResourceProvider == "MICROSOFT.LOGIC"`	1	1	-	-	2
`Category == "DDoSMitigationFlowLogs"` `ResourceType == "PUBLICIPADDRESSES"`	-	2	-	-	2
`Category == "SQLSecurityAuditEvents"` `ResourceProvider == "MICROSOFT.SQL"`	-	2	-	-	2
`Category == "AzureFirewallNetworkRule"`	-	1	-	1	2
`ResourceType == "APPLICATIONGATEWAYS"`	-	2	-	-	2
`Category in "NetworkSecurityGroupEvent,kube-audit"` `Category contains "SQL"` `ResourceProvider == "MICROSOFT.KEYVAULT"` `ResourceType in "APPLICATIONGATEWAYS,AZUREFIREWALLS,CDNWEBAPPLICATIONFIREWALLPOLICIES,FRONTDOORS,PROFILES,PUBLICIPADDRESSES"`	-	2	-	-	2
`ResourceType in "APPLICATIONGATEWAYS,CDNWEBAPPLICATIONFIREWALLPOLICIES,FRONTDOORS"` `action_s == "Blocked"`	1	-	-	-	1
`ResourceProvider == "MICROSOFT.EVENTHUB"`	1	-	-	-	1
`ResourceProvider == "MICROSOFT.SERVICEBUS"`	1	-	-	-	1
`ResourceProvider == "MICROSOFT.STREAMANALYTICS"`	1	-	-	-	1
`ResourceProvider == "MICROSOFT.DATALAKESTORE"`	1	-	-	-	1
`Category == "DDoSMitigationReports"` `ResourceType == "PUBLICIPADDRESSES"`	1	-	-	-	1
`ResourceProvider == "MICROSOFT.BATCH"`	1	-	-	-	1
`Category in "AutomaticTuning,Basic,Blocks,DatabaseWaitStatistics,Deadlocks,DevOpsOperationsAudit,Errors,InstanceAndAppAdvanced,QueryStoreWaitStatistics,SQLInsights,SQLSecurityAuditEvents,Timeouts,WorkloadManagement"` `Category contains "SQLSecurityAuditEvents"` `ResourceProvider == "MICROSOFT.SQL"` `ResourceType == "SERVERS/DATABASES"`	1	-	-	-	1
`Category in "NetworkSecurityGroupEvent,NetworkSecurityGroupRuleCounter"`	1	-	-	-	1
`ResourceType == "AZUREFIREWALLS"`	1	-	-	-	1
`ResourceProvider == "MICROSOFT.KEYVAULT"`	1	-	-	-	1
`ResourceProvider == "MICROSOFT.SEARCH"`	1	-	-	-	1
`Category in "cluster-autoscaler,guard,kube-apiserver,kube-audit,kube-audit-admin,kube-controller-manager,kube-scheduler"`	1	-	-	-	1
`Category in "ApplicationGatewayFirewallLog,FrontdoorWebApplicationFirewallLog"` `ResourceProvider == "MICROSOFT.NETWORK"`	-	1	-	-	1
`Category in "AzureFirewallApplicationRule,AzureFirewallNetworkRule"` `ResourceType == "AZUREFIREWALLS"`	-	1	-	-	1
`Category == "kube-audit"` `Resource == "ClusterRoleBinding"`	-	1	-	-	1
`Category == "kube-audit"`	-	1	-	-	1
`ResourceType == "VAULTS"` `ResultType == "Success"`	-	1	-	-	1
`Category in "DDoSMitigationFlowLogs,DDoSMitigationReports,DDoSProtectionNotifications"` `Message == "Packet was forwarded to service"` `Message startswith "Protocol violation"` `Resource in ",{Resource:label}"`	-	1	-	-	1
`Category in "AzureFirewallApplicationRule,AzureFirewallDnsProxy,AzureFirewallNetworkRule"` `Resource in ",{Resource:label}"` `ResourceType == "AZUREFIREWALLS"` `msg_s !has ". Rule Collection:"` `msg_s !has ". Url"` `msg_s !has "DNAT"` `msg_s !has "No rule matched"` `msg_s !has "Policy:"` `msg_s !has "Reason:"` `msg_s !has "Rule Collection"` `msg_s !has "Rule Collection:"` `msg_s !has "TLS extension was missing"` `msg_s !has "Type="` `msg_s !has "Url"` `msg_s !has "Web Category:"` `msg_s has ". No rule matched"` `msg_s has ". Rule Collection:"` `msg_s has ". Url"` `msg_s has "DNAT"` `msg_s has "Policy:"` `msg_s has "Reason:"` `msg_s has "Rule Collection Group"` `msg_s has "Rule Collection:"` `msg_s has "Type="` `msg_s has "Url"` `msg_s has "Web Category:"`	-	1	-	-	1
`Category == "AuditEvent"` `ResourceType == "VAULTS"`	-	1	-	-	1
`Category == "kube-audit"` `Resource in "clusterrolebindings,events,pods,secrets"`	-	1	-	-	1
`Message == "*"` `Message has "SQL Injection"` `Message has "attack"` `ResourceType == "APPLICATIONGATEWAYS"` `action_s in "Blocked,Detected"` `instanceId_s has "role"`	-	1	-	-	1
`Message has "attack"`	-	1	-	-	1
`Category in "All,AzureFirewallNetworkRule,NetworkSecurityGroupRuleCounter"` `ResourceProvider == "MICROSOFT.KEYVAULT"` `ResourceType == "AZUREFIREWALLS"` `msg_s !has ". Rule Collection:"` `msg_s !has "DNAT"` `msg_s !has "Policy:"` `msg_s !has "Rule Collection:"` `msg_s !has "Type="` `msg_s has ". Rule Collection:"` `msg_s has "DNAT"` `msg_s has "Policy:"` `msg_s has "Rule Collection:"` `msg_s has "Type="`	-	1	-	-	1
`Category == "AzureFirewallApplicationRule"`	-	1	-	-	1
`Category == "AzureFirewallNetworkRule"` `Category == "SQLSecurityAuditEvents"`	-	1	-	-	1
`Category in "AzureFirewallApplicationRule,AzureFirewallNetworkRule,EntitlementManagement,FrontdoorWebApplicationFirewallLog,GatewayDiagnosticLog,GroupManagement,IKEDiagnosticLog,NetworkSecurityGroupEvent,RouteDiagnosticLog,TunnelDiagnosticLog,UserManagement,WebApplicationFirewallLogs,kube-audit"` `Category contains "SQL"` `Resource == "SOC-NS-AG-WAFV2"` `ResourceProvider in "MICROSOFT.CONTAINERSERVICE,MICROSOFT.KEYVAULT"` `ResourceType in "APPLICATIONGATEWAYS,AZUREFIREWALLS,CDNWEBAPPLICATIONFIREWALLPOLICIES,FRONTDOORS,PROFILES,PUBLICIPADDRESSES,SERVERS/DATABASES"` `msg_s !has ". Url"` `msg_s !has "No rule matched"` `msg_s !has "Reason:"` `msg_s !has "Rule Collection"` `msg_s !has "TLS extension was missing"` `msg_s !has "Web Category:"` `msg_s has ". No rule matched"` `msg_s has ". Url"` `msg_s has "Reason:"` `msg_s has "Rule Collection Group"` `msg_s has "Web Category:"`	-	1	-	-	1
`ResourceType == "PUBLICIPADDRESSES"`	-	1	-	-	1
`Category in "ApplicationGatewayFirewallLog,AzureFirewallApplicationRule,AzureFirewallDnsProxy,AzureFirewallNetworkRule,DDoSMitigationReports,FrontdoorWebApplicationFirewallLog,NetworkSecurityGroupEvent,WebApplicationFirewallLogs,kube-audit"` `Category contains "SQL"` `Resource == "SOC-NS-AG-WAFV2"` `ResourceProvider == "MICROSOFT.KEYVAULT"` `ResourceType in "APPLICATIONGATEWAYS,AZUREFIREWALLS,CDNWEBAPPLICATIONFIREWALLPOLICIES,FRONTDOORS,PROFILES,PUBLICIPADDRESSES"` `msg_s !has ". Url"` `msg_s !has "No rule matched"` `msg_s !has "Reason:"` `msg_s !has "Rule Collection"` `msg_s !has "TLS extension was missing"` `msg_s !has "Url"` `msg_s !has "Web Category:"` `msg_s has ". No rule matched"` `msg_s has ". Url"` `msg_s has "Reason:"` `msg_s has "Rule Collection Group"` `msg_s has "Url"` `msg_s has "Web Category:"`	-	1	-	-	1
Total	14	61	0	1	76

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`SQLSecurityAuditEvents`	1	24	-	-	25
`kube-audit`	1	7	-	-	8
`AzureFirewallNetworkRule`	-	7	-	1	8
`FrontdoorWebApplicationFirewallLog`	-	6	-	-	6
`NetworkSecurityGroupEvent`	1	4	-	-	5
`ApplicationGatewayFirewallLog`	-	5	-	-	5
`AzureFirewallApplicationRule`	-	5	-	-	5
`FrontDoorWebApplicationFirewallLog`	-	4	-	-	4
`contains SQL`	-	4	-	-	4
`DDoSMitigationReports`	1	2	-	-	3
`DDoSMitigationFlowLogs`	-	3	-	-	3
`ApplicationGatewayAccessLog`	-	3	-	-	3
`FrontdoorAccessLog`	-	3	-	-	3
`NetworkSecurityGroupRuleCounter`	1	1	-	-	2
`AzureFirewallDnsProxy`	-	2	-	-	2
`WebApplicationFirewallLogs`	-	2	-	-	2
`AutomaticTuning`	1	-	-	-	1
`Basic`	1	-	-	-	1
`Blocks`	1	-	-	-	1
`DatabaseWaitStatistics`	1	-	-	-	1
`Deadlocks`	1	-	-	-	1
`DevOpsOperationsAudit`	1	-	-	-	1
`Errors`	1	-	-	-	1
`InstanceAndAppAdvanced`	1	-	-	-	1
`QueryStoreWaitStatistics`	1	-	-	-	1
`SQLInsights`	1	-	-	-	1
`Timeouts`	1	-	-	-	1
`WorkloadManagement`	1	-	-	-	1
`contains SQLSecurityAuditEvents`	1	-	-	-	1
`cluster-autoscaler`	1	-	-	-	1
`guard`	1	-	-	-	1
`kube-apiserver`	1	-	-	-	1
`kube-audit-admin`	1	-	-	-	1
`kube-controller-manager`	1	-	-	-	1
`kube-scheduler`	1	-	-	-	1
`DDoSProtectionNotifications`	-	1	-	-	1
`AuditEvent`	-	1	-	-	1
`All`	-	1	-	-	1
`EntitlementManagement`	-	1	-	-	1
`GatewayDiagnosticLog`	-	1	-	-	1
`GroupManagement`	-	1	-	-	1
`IKEDiagnosticLog`	-	1	-	-	1
`RouteDiagnosticLog`	-	1	-	-	1
`TunnelDiagnosticLog`	-	1	-	-	1
`UserManagement`	-	1	-	-	1

Message

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`has attack`	-	2	-	-	2
`Packet was forwarded to service`	-	1	-	-	1
`startswith Protocol violation`	-	1	-	-	1
`*`	-	1	-	-	1
`has SQL Injection`	-	1	-	-	1

Resource

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`{Resource:label}`	-	2	-	-	2
`SOC-NS-AG-WAFV2`	-	2	-	-	2
`ClusterRoleBinding`	-	1	-	-	1
`clusterrolebindings`	-	1	-	-	1
`events`	-	1	-	-	1
`pods`	-	1	-	-	1
`secrets`	-	1	-	-	1

ResourceProvider

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`MICROSOFT.KEYVAULT`	1	5	-	-	6
`MICROSOFT.SQL`	1	2	-	-	3
`MICROSOFT.LOGIC`	1	1	-	-	2
`MICROSOFT.EVENTHUB`	1	-	-	-	1
`MICROSOFT.SERVICEBUS`	1	-	-	-	1
`MICROSOFT.STREAMANALYTICS`	1	-	-	-	1
`MICROSOFT.DATALAKESTORE`	1	-	-	-	1
`MICROSOFT.BATCH`	1	-	-	-	1
`MICROSOFT.SEARCH`	1	-	-	-	1
`MICROSOFT.NETWORK`	-	1	-	-	1
`MICROSOFT.CONTAINERSERVICE`	-	1	-	-	1

ResourceType

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`APPLICATIONGATEWAYS`	1	7	-	-	8
`PUBLICIPADDRESSES`	1	7	-	-	8
`AZUREFIREWALLS`	1	7	-	-	8
`VAULTS`	-	8	-	-	8
`CDNWEBAPPLICATIONFIREWALLPOLICIES`	1	4	-	-	5
`FRONTDOORS`	1	4	-	-	5
`SERVERS/DATABASES`	1	4	-	-	5
`PROFILES`	-	4	-	-	4

ResultType

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`Success`	-	1	-	-	1

action_s

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`AnomalyScoring`	-	4	-	-	4
`Block`	-	4	-	-	4
`Blocked`	1	1	-	-	2
`Detected`	-	1	-	-	1

instanceId_s

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`has role`	-	1	-	-	1

msg_s

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`!has . Url`	-	3	-	-	3
`!has No rule matched`	-	3	-	-	3
`!has Reason:`	-	3	-	-	3
`!has Rule Collection`	-	3	-	-	3
`!has TLS extension was missing`	-	3	-	-	3
`!has Web Category:`	-	3	-	-	3
`has . No rule matched`	-	3	-	-	3
`has . Url`	-	3	-	-	3
`has Reason:`	-	3	-	-	3
`has Rule Collection Group`	-	3	-	-	3
`has Web Category:`	-	3	-	-	3
`!has . Rule Collection:`	-	2	-	-	2
`!has DNAT`	-	2	-	-	2
`!has Policy:`	-	2	-	-	2
`!has Rule Collection:`	-	2	-	-	2
`!has Type=`	-	2	-	-	2
`!has Url`	-	2	-	-	2
`has . Rule Collection:`	-	2	-	-	2
`has DNAT`	-	2	-	-	2
`has Policy:`	-	2	-	-	2
`has Rule Collection:`	-	2	-	-	2
`has Type=`	-	2	-	-	2
`has Url`	-	2	-	-	2