AzureAttestationDiagnostics 數據表的查詢

發行項
11/05/2024

如需在 Azure 入口網站使用這些查詢的詳細資訊，請參閱Log Analytics教學課程。如需 REST API，請參閱查詢。

是否有任何授權失敗?

授權失敗的證明提供者要求計數。

// To create an alert for this query, click '+ New alert rule'
AzureAttestationDiagnostics
| where toint(ResultSignature) == 403
| summarize count() by ResourceUri, ResultSignature, _ResourceId
// ResultSignature contains HTTP status code returned by the request, (e.g.  200, 300, 401, etc.)
// ResourceUri contains the URI of the request

是否有任何緩慢的要求？

超過 1 秒的證明提供者要求清單。

// To create an alert for this query, click '+ New alert rule'
let threshold=1000; // let operator defines a constant that can be further used in the query
AzureAttestationDiagnostics
| where DurationMs > threshold
| summarize count() by OperationName, _ResourceId

此證明提供者有多活躍?

折線圖顯示證明提供者要求量的趨勢，一段時間后的每個作業。

AzureAttestationDiagnostics
| where TimeGenerated > ago(1d)
| summarize count() by bin(TimeGenerated, 1h), OperationName // Aggregate by hour
| render timechart

誰在呼叫這個證明提供者?

其IP位址和 AAD UPN 所識別的來電者清單及其要求計數。

AzureAttestationDiagnostics
| summarize count() by CallerIpAddress, tostring(Identity.callerAadUPN)

證明原則是否有任何變更?

成功證明提供者要求的清單，以變更證明原則或原則簽署憑證。

// To create an alert for this query, click '+ New alert rule'
let policyOperations = pack_array(
    "AddPolicyCertificate",
    "AddPolicyManagementCertificate",
    "AddPolicyManagementCertificates",
    "RemovePolicyCertificate",
    "RemovePolicyManagementCertificate",
    "RemovePolicyManagementCertificates",
    "ResetAttestationPolicy",
    "SetCurrentPolicy",
    "SetCurrentPolicyWithHttpMessagesAsync",
    "SetEffectiveAttestationPolicy",
    "DeleteCurrentPolicy",
    "DeletePolicy"
);
AzureAttestationDiagnostics
| where toint(ResultSignature) == 200
| where policyOperations contains OperationName
| take 100

是否有任何嘗試設定證明原則的錯誤？

嘗試設定證明原則或原則簽署憑證的任何錯誤清單。

// To create an alert for this query, click '+ New alert rule'
let policyOperations = pack_array(
    "AddPolicyCertificate",
    "AddPolicyManagementCertificate",
    "AddPolicyManagementCertificates",
    "PrepareToSetPolicy",
    "PrepareToUpdatePolicy",
    "RemovePolicyCertificate",
    "RemovePolicyManagementCertificate",
    "RemovePolicyManagementCertificates",
    "ResetAttestationPolicy",
    "SetCurrentPolicy",
    "SetCurrentPolicyWithHttpMessagesAsync",
    "SetEffectiveAttestationPolicy",
    "DeleteCurrentPolicy",
    "DeletePolicy"
);
AzureAttestationDiagnostics
| where toint(ResultSignature) >= 300
| where policyOperations contains OperationName
| take 100

共用方式為