Forum Discussion
Jeff Walzer
Apr 27, 2020Iron Contributor
Firewalls and virtual networks events
I am trying to view events in AzureActivity related to Firewalls and virtual networks events, specifically if someone adds an IP and so far checking the schema I can't find the column that would have that info.
Is there a column that tracks the IP added to Firewalls and virtual networks events, or is there only way to track this info is a generic query like below, and then check the RG's Firewalls and virtual networks events view to see what IP has been added?
AzureActivity
| where OperationName contains "Update SQL server firewall rules"
| project TimeGenerated , OperationName , ActivityStatus , OperationNameValue , ResourceGroup , Caller , CallerIpAddress
- CliveWatson
Microsoft
For Azure Firewalls, also see https://docs.microsoft.com/en-us/azure/firewall/log-analytics-samples
- Jeff WalzerIron Contributor
CliveWatson - thx for the reply.
It doesn't appear that events from Firewalls and virtual networks are logged under AzureDiagnostics as far as I can tell as a search for the OperationName containing "Update SQL server firewall rules" returns no hits whereas searching under AzureActivity I see the events.