Queries for the ResourceManagementPublicAccessLogs table

Group number of requests based on the IP address

Get the number of request accessing the resource from an IP address.

//List the IP addresses and number of calls
ResourceManagementPublicAccessLogs
| where Category == "PublicAccessLogs"
| summarize count() by CallerIpAddress 

Number of opertions triggered

Count the number of request made.

// Count the number of operations.
ResourceManagementPublicAccessLogs
| where Category == "PublicAccessLogs"
| summarize count() by CorrelationId 

Calls based on the target URI

Chart the number of calls based on the target URI.

// Chart the number of calls based on the target URI.
ResourceManagementPublicAccessLogs
| where Category == "PublicAccessLogs"
| summarize count() by Uri, bin(TimeGenerated, 1m)
| render columnchart with (kind=stacked) 

Calls based on operation name

Count the number of request made based on operation name.

// List the operations and their number of calls from the public network
ResourceManagementPublicAccessLogs
| where Category == "PublicAccessLogs"
| summarize count() by OperationName
| order by count_

Calls based on user

Count the number of request made based on object identifiers.

// List the object identifiers and number of calls from each over the public network
ResourceManagementPublicAccessLogs
| where Category == "PublicAccessLogs"
| summarize count() by ObjectIdentifier
| order by count_