LAQueryLogs

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Reference for LAQueryLogs table in Azure Monitor Logs.

Attribute	Value
Category	Audit
Basic Logs Eligible	✓ Yes (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Lake-Only Ingestion	✓ Yes
Azure Monitor Tables Reference	View Documentation

Schema
Schema References
Solutions
Content Items
Resource Types

Schema (35 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
_ResourceId	string	A unique identifier for the resource that the record is associated with
_SubscriptionId	string	A unique identifier for the subscription that the record is associated with
AADClientId	string	AAD ClientId used by the caller.
AADEmail	string	AAD Email of the caller.
AADObjectId	string	AAD ObjectId of the caller, or the 'aai' claim for GDAP scenarios.
AADTenantId	string	AAD TenantId of the caller.
ConditionalDataAccess	string	Indicates whether the query was executed with an applicable attribute-based access control data access condition (ABAC), and if the condition had an error.
CorrelationId	string	The ID for correlated events.
IsBillableQuery	bool	Indicates whether query execution is billed.
IsWorkspaceInFailover	bool	Indicates whether the queried workspace was in failover mode.
QueryText	string	The full body of the query as submitted by the user.
QueryThumbprint	string	A hash representing the query structure, useful for identifying similar queries.
QueryTimeRangeEnd	datetime	The end time (UTC) of the time range across which the query was requested by the caller to be executed.
QueryTimeRangeStart	datetime	The starting time (UTC) of the time range across which the query was requested by the caller to be executed.
RecordKind	string	The record kind. Classifies whether the record is backfilled for missed statistics retrieval. If it is not backfilled, the value is empty.
RequestClientApp	string	ClientApp string in the request header (x-ms-app).
RequestContext	dynamic	ResourceId of all referenced workspaces, applications, and resources across which the query was requested by the caller to be executed.
RequestContextFilters	dynamic	Filters applied to the request context.
RequestTarget	string	ResourceId of the request URL.
ResponseCode	int	The HTTP response code for the request.
ResponseDurationMs	real	The duration (in ms) that the query took to execute.
ResponseRowCount	int	The number of rows that were returned.
ScannedGB	real	For billable queries, like Basic logs queries, indicates the total GB of data scanned in the query.
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
StatsCPUTimeMs	real	The CPU (in ms) used in the execution of this query.
StatsDataProcessedEnd	datetime	The end time (UTC) of the time range across which the data processed.
StatsDataProcessedStart	datetime	The starting time (UTC) of the time range across which the data processed.
StatsRegionCount	int	The number of regions that the workspaces accessed are spread across.
StatsWorkspaceCount	int	The number of workspaces that the query accessed, either explicitly or otherwise.
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	The timestamp (UTC) at which the query was submitted.
Type	string	The name of the table
WorkspaceRegion	string	The region of the queried workspace.

Schema References

Official Microsoft Learn documentation for field/column information:

LAQueryLogs Schema Reference (Azure Monitor)

Solutions (4)

This table is used by the following solutions:

Content Items Using This Table (20)

Analytic Rules (1)

Standalone Content: QueryText has_any "_GetWatchlist("

Analytic Rule
Users searching for VIP user activity

Hunting Queries (11)

Standalone Content:

Hunting Query	Selection Criteria
Cross workspace query anomolies
Multiple large queries made by user	`ResponseRowCount == "10001"`
New ServicePrincipal running queries	`AADEmail !contains "@"` `RequestClientApp != "AppAnalytics"` `ResponseCode == "200"`
New client running queries	`ResponseCode == "200"`
New users running queries
Query data volume anomolies
Query looking for secrets	`RequestClientApp != "Sentinel-General"`
User returning more data than daily average
User running multiple queries that fail	`ResponseCode != "200"`

GitHub Only:

Hunting Query	Selection Criteria
Cross-service Azure Data Explorer queries
New users calling sensitive Watchlist	`QueryText has_any "_GetWatchlist("`

Workbooks (8)

In solution DPDP Compliance: RequestClientApp != "Sentinel-General"

Workbook
DPDPCompliance

In solution GDPR Compliance & Data Security: RequestClientApp != "Sentinel-General"

Workbook
GDPRComplianceAndDataSecurity

In solution MicrosoftPurviewInsiderRiskManagement: RequestClientApp != "Sentinel-General"
ResponseCode != "200"
ResponseRowCount == "5000"

Workbook
InsiderRiskManagement

GitHub Only:

Workbook	Selection Criteria
AzureLogCoverage
LogAnalyticsQueryAnalysis
LogSourcesAndAnalyticRulesCoverage	`QueryText !startswith "search"` `QueryText !startswith "top"` `QueryText !startswith "union"` `RequestClientApp in "ASC_Portal,ASI_Portal,AppAnalytics,AppInsightsPortalExtension,AzureInformationProtection,AzureMonitorLogsConnector,IbizaExtension,Sentinel-Investigation-Queries,Sentinel-analyticsManagement-customerQuery"`
WorkspaceAuditing	`ResponseCode != "200"`
WorkspaceUsage

Resource Types

This table collects data from the following Azure resource types:

microsoft.operationalinsights/workspaces

Selection Criteria Summary (7 criteria, 10 total references)

References by type: 0 connectors, 10 content items, 0 ASIM parsers, 0 other parsers.

Selection Criteria	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`RequestClientApp != "Sentinel-General"`	-	3	-	-	3
`QueryText has_any "_GetWatchlist("`	-	2	-	-	2
`ResponseRowCount == "10001"`	-	1	-	-	1
`ResponseCode == "200"`	-	1	-	-	1
`AADEmail !contains "@"` `RequestClientApp != "AppAnalytics"` `ResponseCode == "200"`	-	1	-	-	1
`ResponseCode != "200"`	-	1	-	-	1
`RequestClientApp != "Sentinel-General"` `ResponseCode != "200"` `ResponseRowCount == "5000"`	-	1	-	-	1
Total	0	10	0	0	10

AADEmail

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`!contains @`	-	1	-	-	1

QueryText

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`has_any _GetWatchlist(`	-	2	-	-	2

RequestClientApp

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`!= Sentinel-General`	-	4	-	-	4
`!= AppAnalytics`	-	1	-	-	1

ResponseCode

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`200`	-	2	-	-	2
`!= 200`	-	2	-	-	2

ResponseRowCount

Value	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
`10001`	-	1	-	-	1
`5000`	-	1	-	-	1