Failed Logins to Bastion

Greg Thomas 121 Reputation points
2021-05-26T13:37:16.057+00:00

Hi,

We have enabled Diagnostic Logging on Bastion and are trying to identify where we look to see failed connections. I have a Diagnostics/Logging workspace setup.

When we go search for this query...

// Signin Locations
// Failed and successful sig ins by source location.
SigninLogs
| summarize Successful=countif(ResultType==0), Failed=countif(ResultType!=0) by Location

We get the following error message...

'summarize' operator: Failed to resolve table or column expression named 'SigninLogs'
If issue persists, please open a support ticket. Request id: 1286b477-1028-4544-95c3-d681cb015dba

Is there a better way to see failed login attempts to Bastion?

Azure Bastion
Azure Bastion
An Azure service that provides private and fully managed Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to virtual machines.
262 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Greg Thomas 121 Reputation points
    2021-06-02T12:50:28.143+00:00

    Following up on this,

    I have configured logging below and can access the RAW JSON logs, is there a way to view this without having to navigate to the storage account to view the information?

    Essentially all I want to see are connects/disconnects.

    https://video2.skills-academy.com/en-us/azure/bastion/diagnostic-logs

    https://video2.skills-academy.com/en-us/azure/bastion/howto-metrics-monitor-alert?WT.mc_id=Portal-Microsoft_Azure_Support

    Thank you.

    0 comments
  2. SaiKishor-MSFT 17,231 Reputation points
    2021-06-02T21:41:17.26+00:00

    @Greg Thomas Thank you for reaching out to Microsoft Q&A.

    You can send the Bastion Diagnostic Logs to Log Analytics workspace, Event Hub or Partner solution other than a Storage Account. Hope this helps.

    Please let us know if you have any further questions/concerns and we will be glad to assist further. Thank you!

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.