Firewalls and virtual networks events

[Jeff Walzer]

I am trying to view events in AzureActivity related to Firewalls and virtual networks events, specifically if someone adds an IP and so far checking the schema I can't find the column that would have that info.

Is there a column that tracks the IP added to Firewalls and virtual networks events, or is there only way to track this info is a generic query like below, and then check the RG's  Firewalls and virtual networks events view to see what IP has been added?

AzureActivity

| where OperationName contains "Update SQL server firewall rules"

| project TimeGenerated , OperationName , ActivityStatus , OperationNameValue , ResourceGroup , Caller , CallerIpAddress

[#2]

@Jeff Walzer 

For Azure Firewalls, also see https://docs.microsoft.com/en-us/azure/firewall/log-analytics-samples 

[#3]

@CliveWatson - thx for the reply.

It doesn't appear that events from Firewalls and virtual networks are logged under AzureDiagnostics as far as I can tell as a search for the OperationName containing "Update SQL server firewall rules" returns no hits whereas searching under AzureActivity I see the events.