如何编写KQL来显示访问日志分析工作区中特定表的每个用户

Question

我需要特定日志分析工作区的帮助，显示访问它的用户、访问的表以及每个用户对每个表进行的查询数量。我尝试使用 AzureActivity 表，但结果不是我想要的。

AzureActivity
| where OperationNameValue contains "Microsoft.OperationalInsights/workspaces/"
| extend role_ = tostring(parse_json(tostring(Authorization_d.evidence)).role)
| extend principalType_ = tostring(parse_json(tostring(Authorization_d.evidence)).principalType)
| where TimeGenerated between ( startofyear(now()) .. now() )
| where dayofweek(TimeGenerated) between (1d .. 5d)
| join kind=inner(
    IdentityInfo
    | where TimeGenerated > (ago(30d))
    | summarize arg_max(TimeGenerated, *) by AccountSID)
    on $left.Caller == $right.AccountUPN
| extend RetraiteQuebecTime = datetime_utc_to_local(TimeGenerated, "America/Montreal")
| summarize  count() by Caller,Level, role_, ActivityStatusValue,  bin(TimeGenerated,1d)
| render columnchart

谢谢您的帮助，

真诚的

Answer 1

你好Louis Di Edgar，似乎你已经找到了问题的解决方案，我只是将其发布在这里，以方便其他在 SO 上面临类似问题的人。如果需要，请随时添加任何要点/您的意见。

要跟踪访问 Log Analytic Workspace 中特定表的每个用户，您可以使用 LAQueryLogs 表。它包括诸如

AADObjectId

（代表用户）和

RequestTarget

（显示访问的特定资源或表）等信息。

LAQueryLogs
| where AADObjectId != ""  // Ensure that the AAD Object ID is present
| project AADObjectId, QueryText, RequestTarget, QueryTimeRangeStart, QueryTimeRangeEnd  // Project relevant fields: Object ID, query text, table accessed, and timestamps
| summarize QueryCount = count() by AADObjectId, RequestTarget  // Summarize by user and table accessed
| order by QueryCount desc  // Sort by the number of queries made in descending order

如果您希望查看实际的查询文本以及查询执行时间，您可以使用

LAQueryLogs
| where AADObjectId != ""  // Ensure that the AAD Object ID is present
| project AADObjectId, QueryText, RequestTarget, QueryTimeRangeStart, QueryTimeRangeEnd  // Project additional fields for query time
| order by QueryTimeRangeStart desc  // Sort by the start time of the queries in descending order
| limit 50  // Show a limited number of results for inspection