detection.wiki

Azure Container Registry Azure-Microsoft.ContainerRegistry

operationNameDescriptionSampleRule
anyCatch-all for Azure-Microsoft.ContainerRegistry rules that match the resource provider but no specific operation.NN
Microsoft.ContainerRegistry/locations/deleteVirtualNetworkOrSubnets/actionNotifies Microsoft.ContainerRegistry that virtual network or subnet is being deletedNN
Microsoft.ContainerRegistry/register/actionRegisters the subscription for the container registry resource provider and enables the creation of container registries.YN
Microsoft.ContainerRegistry/registries/agentpools/deleteDelete an agentpool for a container registry.NN
Microsoft.ContainerRegistry/registries/agentpools/listQueueStatus/actionList all queue status of an agentpool for a container registry.NN
Microsoft.ContainerRegistry/registries/agentpools/writeCreate or Update an agentpool for a container registry.NN
Microsoft.ContainerRegistry/registries/artifacts/deleteDelete artifact in a container registry.NN
Microsoft.ContainerRegistry/registries/cacheRules/deleteDeletes a cache rule from a container registryNN
Microsoft.ContainerRegistry/registries/cacheRules/writeCreates or updates a cache rule for a container registry with the specified parametersNN
Microsoft.ContainerRegistry/registries/connectedRegistries/deactivate/actionDeactivates a connected registry for a container registryNN
Microsoft.ContainerRegistry/registries/connectedRegistries/deleteDeletes a connected registry from a container registry.NN
Microsoft.ContainerRegistry/registries/connectedRegistries/resync/actionResync a connected registry for a container registryNN
Microsoft.ContainerRegistry/registries/connectedRegistries/writeCreates or updates a connected registry for a container registry with the specified parameters.NN
Microsoft.ContainerRegistry/registries/credentialSets/deleteDeletes a credential set from a container registryNN
Microsoft.ContainerRegistry/registries/credentialSets/writeCreates or updates a credential set for a container registry with the specified parametersNN
Microsoft.ContainerRegistry/registries/deleteDeletes a container registry.YY
Microsoft.ContainerRegistry/registries/deleted/restore/actionRestores deleted artifacts in a container registryNN
Microsoft.ContainerRegistry/registries/eventGridFilters/deleteDeletes an event grid filter from a container registry.NN
Microsoft.ContainerRegistry/registries/eventGridFilters/writeCreates or updates an event grid filter for a container registry with the specified parameters.NN
Microsoft.ContainerRegistry/registries/exportPipelines/deleteDeletes an export pipeline from a container registry.NN
Microsoft.ContainerRegistry/registries/exportPipelines/writeCreates or updates an export pipeline for a container registry with the specified parameters.NN
Microsoft.ContainerRegistry/registries/generateCredentials/actionGenerate keys for a token of a specified container registry.NN
Microsoft.ContainerRegistry/registries/importImage/actionImport Image to container registry with the specified parameters.NN
Microsoft.ContainerRegistry/registries/importPipelines/deleteDeletes an import pipeline from a container registry.NN
Microsoft.ContainerRegistry/registries/importPipelines/writeCreates or updates an import pipeline for a container registry with the specified parameters.NN
Microsoft.ContainerRegistry/registries/listBuildSourceUploadUrl/actionGet source upload url location for a container registry.NN
Microsoft.ContainerRegistry/registries/listCredentials/actionLists the login credentials for the specified container registry.NN
Microsoft.ContainerRegistry/registries/metadata/writeUpdates the metadata of a repository for a container registryNN
Microsoft.ContainerRegistry/registries/packages/archives/deleteDelete an Archive from a container registryNN
Microsoft.ContainerRegistry/registries/packages/archives/versions/deleteDelete an Archive version from an ArchiveNN
Microsoft.ContainerRegistry/registries/packages/archives/versions/writeCreates or updates a Archive version for an Archive with the specified parameterNN
Microsoft.ContainerRegistry/registries/packages/archives/writeCreates or updates a Archive for a container registry with the specified parametersNN
Microsoft.ContainerRegistry/registries/pipelineRuns/deleteDeletes a pipeline run from a container registry.NN
Microsoft.ContainerRegistry/registries/pipelineRuns/writeCreates or updates a pipeline run for a container registry with the specified parameters.NN
Microsoft.ContainerRegistry/registries/privateEndpointConnectionProxies/deleteDelete the Private Endpoint Connection Proxy (NRP only)NN
Microsoft.ContainerRegistry/registries/privateEndpointConnectionProxies/validate/actionValidate the Private Endpoint Connection Proxy (NRP only)NN
Microsoft.ContainerRegistry/registries/privateEndpointConnectionProxies/writeCreate the Private Endpoint Connection Proxy (NRP only)NN
Microsoft.ContainerRegistry/registries/privateEndpointConnections/deleteDeletes the private endpoint connectionNN
Microsoft.ContainerRegistry/registries/privateEndpointConnections/writeApproves/Rejects the private endpoint connectionNN
Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/actionAuto Approves a Private Endpoint ConnectionNN
Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/writeCreates or updates the diagnostic setting for the resourceNN
Microsoft.ContainerRegistry/registries/push/writePush or Write images to a container registry.NN
Microsoft.ContainerRegistry/registries/quarantine/writeWrite/Modify quarantine state of quarantined imagesNN
Microsoft.ContainerRegistry/registries/regenerateCredential/actionRegenerates one of the login credentials for the specified container registry.NN
Microsoft.ContainerRegistry/registries/replications/deleteDeletes a replication from a container registry.NN
Microsoft.ContainerRegistry/registries/replications/writeCreates or updates a replication for a container registry with the specified parameters.NN
Microsoft.ContainerRegistry/registries/runs/cancel/actionCancel an existing run.NN
Microsoft.ContainerRegistry/registries/runs/listLogSasUrl/actionGets the log SAS URL for a run.NN
Microsoft.ContainerRegistry/registries/runs/writeUpdates a run.NN
Microsoft.ContainerRegistry/registries/scheduleRun/actionSchedule a run against a container registry.NN
Microsoft.ContainerRegistry/registries/scopeMaps/deleteDeletes a scope map from a container registry.NN
Microsoft.ContainerRegistry/registries/scopeMaps/writeCreates or updates a scope map for a container registry with the specified parameters.NN
Microsoft.ContainerRegistry/registries/sign/writePush/Pull content trust metadata for a container registry.NN
Microsoft.ContainerRegistry/registries/taskruns/deleteDelete a taskrun for a container registry.NN
Microsoft.ContainerRegistry/registries/taskruns/listDetails/actionList all details of a taskrun for a container registry.NN
Microsoft.ContainerRegistry/registries/taskruns/writeCreate or Update a taskrun for a container registry.NN
Microsoft.ContainerRegistry/registries/tasks/deleteDeletes a task for a container registry.NN
Microsoft.ContainerRegistry/registries/tasks/listDetails/actionList all details of a task for a container registry.NN
Microsoft.ContainerRegistry/registries/tasks/writeCreates or Updates a task for a container registry.NN
Microsoft.ContainerRegistry/registries/tokens/deleteDeletes a token from a container registry.NN
Microsoft.ContainerRegistry/registries/tokens/writeCreates or updates a token for a container registry with the specified parameters.NN
Microsoft.ContainerRegistry/registries/updatePolicies/writeUpdates the policies for the specified container registryNN
Microsoft.ContainerRegistry/registries/webhooks/deleteDeletes a webhook from a container registry.NN
Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/actionGets the configuration of service URI and custom headers for the webhook.NN
Microsoft.ContainerRegistry/registries/webhooks/listEvents/actionLists recent events for the specified webhook.NN
Microsoft.ContainerRegistry/registries/webhooks/ping/actionTriggers a ping event to be sent to the webhook.NN
Microsoft.ContainerRegistry/registries/webhooks/writeCreates or updates a webhook for a container registry with the specified parameters.NN
Microsoft.ContainerRegistry/registries/writeCreates or updates a container registry with the specified parameters.YY
Microsoft.ContainerRegistry/unregister/actionUnregisters the subscription for the container registry resource provider.NN

any: Azure Container Registry (catch-all)

#
Namespace
Microsoft.ContainerRegistry

Description

Catch-all for Azure-Microsoft.ContainerRegistry rules that match the resource provider but no specific operation.

Microsoft.ContainerRegistry/locations/deleteVirtualNetworkOrSubnets/action

#
Namespace
Microsoft.ContainerRegistry

Description

Notifies Microsoft.ContainerRegistry that virtual network or subnet is being deleted

Microsoft.ContainerRegistry/register/action

#
Namespace
Microsoft.ContainerRegistry

Description

Registers the subscription for the container registry resource provider and enables the creation of container registries.

Example Resource Log Record #

{
  "ActivityStatus": "",
  "ActivityStatusValue": "Success",
  "ActivitySubstatus": "",
  "ActivitySubstatusValue": "OK",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222",
    "action": "Microsoft.ContainerRegistry/register/action",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222",
    "action": "Microsoft.ContainerRegistry/register/action",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "Category": "",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782752670",
    "nbf": "1782752670",
    "exp": "1782756583",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "REDACTED",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "REDACTED",
    "rh": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "3 5",
    "xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
    "xms_idrel": "1 2",
    "xms_sub_fct": "2 3",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782752670",
    "nbf": "1782752670",
    "exp": "1782756583",
    "aio": "REDACTED",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "idtyp": "user",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "rh": "REDACTED",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "3 5",
    "xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
    "xms_idrel": "1 2",
    "xms_sub_fct": "2 3",
    "xms_tcdt": "1768616282",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "puid": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
  },
  "CorrelationId": "a80a7aec-f145-43e4-a56a-c8c9abf14706",
  "EventDataId": "97bd45e5-ca34-4abb-29c2-52e9f82078d8",
  "EventSubmissionTimestamp": "2026-06-29T17:48:47.7154565Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationId": "",
  "OperationName": "",
  "OperationNameValue": "MICROSOFT.CONTAINERREGISTRY/REGISTER/ACTION",
  "Properties": {
    "statusCode": "OK",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/providers/Microsoft.ContainerRegistry",
    "message": "Microsoft.ContainerRegistry/register/action",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "97bd45e5-ca34-4abb-29c2-52e9f82078d8",
    "eventSubmissionTimestamp": "2026-06-29T17:48:47.7154565Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resourceProviderValue": "MICROSOFT.CONTAINERREGISTRY",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "activitySubstatusValue": "OK"
  },
  "Properties_d": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/providers/Microsoft.ContainerRegistry",
    "message": "Microsoft.ContainerRegistry/register/action",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "97bd45e5-ca34-4abb-29c2-52e9f82078d8",
    "eventSubmissionTimestamp": "2026-06-29T17:48:47.7154565Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resourceProviderValue": "MICROSOFT.CONTAINERREGISTRY",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "statusCode": "OK",
    "serviceRequestId": "",
    "activitySubstatusValue": "OK"
  },
  "Resource": "",
  "ResourceGroup": "",
  "ResourceId": "",
  "ResourceProvider": "",
  "ResourceProviderValue": "MICROSOFT.CONTAINERREGISTRY",
  "SourceSystem": "Azure",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222",
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T17:48:47.7154565Z",
  "Type": "AzureActivity",
  "_ResourceId": ""
}

Microsoft.ContainerRegistry/registries/agentpools/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Delete an agentpool for a container registry.

Microsoft.ContainerRegistry/registries/agentpools/listQueueStatus/action

#
Namespace
Microsoft.ContainerRegistry

Description

List all queue status of an agentpool for a container registry.

Microsoft.ContainerRegistry/registries/agentpools/write

#
Namespace
Microsoft.ContainerRegistry

Description

Create or Update an agentpool for a container registry.

Microsoft.ContainerRegistry/registries/artifacts/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Delete artifact in a container registry.

Microsoft.ContainerRegistry/registries/cacheRules/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes a cache rule from a container registry

Microsoft.ContainerRegistry/registries/cacheRules/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates a cache rule for a container registry with the specified parameters

Microsoft.ContainerRegistry/registries/connectedRegistries/deactivate/action

#
Namespace
Microsoft.ContainerRegistry

Description

Deactivates a connected registry for a container registry

Microsoft.ContainerRegistry/registries/connectedRegistries/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes a connected registry from a container registry.

Microsoft.ContainerRegistry/registries/connectedRegistries/resync/action

#
Namespace
Microsoft.ContainerRegistry

Description

Resync a connected registry for a container registry

Microsoft.ContainerRegistry/registries/connectedRegistries/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates a connected registry for a container registry with the specified parameters.

Microsoft.ContainerRegistry/registries/credentialSets/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes a credential set from a container registry

Microsoft.ContainerRegistry/registries/credentialSets/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates a credential set for a container registry with the specified parameters

Microsoft.ContainerRegistry/registries/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes a container registry.

Example Resource Log Record #

{
  "ActivityStatusValue": "Success",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.ContainerRegistry/registries/dwh92eef0acr",
    "action": "Microsoft.ContainerRegistry/registries/delete",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.ContainerRegistry/registries/dwh92eef0acr",
    "action": "Microsoft.ContainerRegistry/registries/delete",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783012099",
    "nbf": "1783012099",
    "exp": "1783017701",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "eyUvMswr6EqJhPARR0x4AA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "5 3",
    "xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
    "xms_idrel": "24 1",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783012099",
    "nbf": "1783012099",
    "exp": "1783017701",
    "aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "idtyp": "user",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "uti": "eyUvMswr6EqJhPARR0x4AA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "5 3",
    "xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
    "xms_idrel": "24 1",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "puid": "1111111111111111",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
  },
  "CorrelationId": "6197cc11-fb82-487d-aab8-2f3d33e46005",
  "EventDataId": "8c77d29e-809c-c2e3-70f3-af5ca92b1990",
  "EventSubmissionTimestamp": "2026-07-02T17:19:19.656032Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationNameValue": "MICROSOFT.CONTAINERREGISTRY/REGISTRIES/DELETE",
  "Properties": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.ContainerRegistry/registries/dwh92eef0acr",
    "message": "Microsoft.ContainerRegistry/registries/delete",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "8c77d29e-809c-c2e3-70f3-af5ca92b1990",
    "eventSubmissionTimestamp": "2026-07-02T17:19:19.656032Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwh92eef0acr",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.CONTAINERREGISTRY",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success"
  },
  "Properties_d": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.ContainerRegistry/registries/dwh92eef0acr",
    "message": "Microsoft.ContainerRegistry/registries/delete",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "8c77d29e-809c-c2e3-70f3-af5ca92b1990",
    "eventSubmissionTimestamp": "2026-07-02T17:19:19.6560320Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwh92eef0acr",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.CONTAINERREGISTRY",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success"
  },
  "ResourceGroup": "rg-logcapture-gen",
  "ResourceProviderValue": "MICROSOFT.CONTAINERREGISTRY",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Microsoft.ContainerRegistry/registries/deleted/restore/action

#
Namespace
Microsoft.ContainerRegistry

Description

Restores deleted artifacts in a container registry

Microsoft.ContainerRegistry/registries/eventGridFilters/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes an event grid filter from a container registry.

Microsoft.ContainerRegistry/registries/eventGridFilters/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates an event grid filter for a container registry with the specified parameters.

Microsoft.ContainerRegistry/registries/exportPipelines/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes an export pipeline from a container registry.

Microsoft.ContainerRegistry/registries/exportPipelines/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates an export pipeline for a container registry with the specified parameters.

Microsoft.ContainerRegistry/registries/generateCredentials/action

#
Namespace
Microsoft.ContainerRegistry

Description

Generate keys for a token of a specified container registry.

Microsoft.ContainerRegistry/registries/importImage/action

#
Namespace
Microsoft.ContainerRegistry

Description

Import Image to container registry with the specified parameters.

Microsoft.ContainerRegistry/registries/importPipelines/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes an import pipeline from a container registry.

Microsoft.ContainerRegistry/registries/importPipelines/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates an import pipeline for a container registry with the specified parameters.

Microsoft.ContainerRegistry/registries/listBuildSourceUploadUrl/action

#
Namespace
Microsoft.ContainerRegistry

Description

Get source upload url location for a container registry.

Microsoft.ContainerRegistry/registries/listCredentials/action

#
Namespace
Microsoft.ContainerRegistry

Description

Lists the login credentials for the specified container registry.

Microsoft.ContainerRegistry/registries/metadata/write

#
Namespace
Microsoft.ContainerRegistry

Description

Updates the metadata of a repository for a container registry

Microsoft.ContainerRegistry/registries/packages/archives/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Delete an Archive from a container registry

Microsoft.ContainerRegistry/registries/packages/archives/versions/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Delete an Archive version from an Archive

Microsoft.ContainerRegistry/registries/packages/archives/versions/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates a Archive version for an Archive with the specified parameter

Microsoft.ContainerRegistry/registries/packages/archives/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates a Archive for a container registry with the specified parameters

Microsoft.ContainerRegistry/registries/pipelineRuns/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes a pipeline run from a container registry.

Microsoft.ContainerRegistry/registries/pipelineRuns/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates a pipeline run for a container registry with the specified parameters.

Microsoft.ContainerRegistry/registries/privateEndpointConnectionProxies/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Delete the Private Endpoint Connection Proxy (NRP only)

Microsoft.ContainerRegistry/registries/privateEndpointConnectionProxies/validate/action

#
Namespace
Microsoft.ContainerRegistry

Description

Validate the Private Endpoint Connection Proxy (NRP only)

Microsoft.ContainerRegistry/registries/privateEndpointConnectionProxies/write

#
Namespace
Microsoft.ContainerRegistry

Description

Create the Private Endpoint Connection Proxy (NRP only)

Microsoft.ContainerRegistry/registries/privateEndpointConnections/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes the private endpoint connection

Microsoft.ContainerRegistry/registries/privateEndpointConnections/write

#
Namespace
Microsoft.ContainerRegistry

Description

Approves/Rejects the private endpoint connection

Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action

#
Namespace
Microsoft.ContainerRegistry

Description

Auto Approves a Private Endpoint Connection

Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates the diagnostic setting for the resource

Microsoft.ContainerRegistry/registries/push/write

#
Namespace
Microsoft.ContainerRegistry

Description

Push or Write images to a container registry.

Microsoft.ContainerRegistry/registries/quarantine/write

#
Namespace
Microsoft.ContainerRegistry

Description

Write/Modify quarantine state of quarantined images

Microsoft.ContainerRegistry/registries/regenerateCredential/action

#
Namespace
Microsoft.ContainerRegistry

Description

Regenerates one of the login credentials for the specified container registry.

Microsoft.ContainerRegistry/registries/replications/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes a replication from a container registry.

Microsoft.ContainerRegistry/registries/replications/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates a replication for a container registry with the specified parameters.

Microsoft.ContainerRegistry/registries/runs/cancel/action

#
Namespace
Microsoft.ContainerRegistry

Description

Cancel an existing run.

Microsoft.ContainerRegistry/registries/runs/listLogSasUrl/action

#
Namespace
Microsoft.ContainerRegistry

Description

Gets the log SAS URL for a run.

Microsoft.ContainerRegistry/registries/runs/write

#
Namespace
Microsoft.ContainerRegistry

Description

Updates a run.

Microsoft.ContainerRegistry/registries/scheduleRun/action

#
Namespace
Microsoft.ContainerRegistry

Description

Schedule a run against a container registry.

Microsoft.ContainerRegistry/registries/scopeMaps/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes a scope map from a container registry.

Microsoft.ContainerRegistry/registries/scopeMaps/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates a scope map for a container registry with the specified parameters.

Microsoft.ContainerRegistry/registries/sign/write

#
Namespace
Microsoft.ContainerRegistry

Description

Push/Pull content trust metadata for a container registry.

Microsoft.ContainerRegistry/registries/taskruns/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Delete a taskrun for a container registry.

Microsoft.ContainerRegistry/registries/taskruns/listDetails/action

#
Namespace
Microsoft.ContainerRegistry

Description

List all details of a taskrun for a container registry.

Microsoft.ContainerRegistry/registries/taskruns/write

#
Namespace
Microsoft.ContainerRegistry

Description

Create or Update a taskrun for a container registry.

Microsoft.ContainerRegistry/registries/tasks/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes a task for a container registry.

Microsoft.ContainerRegistry/registries/tasks/listDetails/action

#
Namespace
Microsoft.ContainerRegistry

Description

List all details of a task for a container registry.

Microsoft.ContainerRegistry/registries/tasks/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or Updates a task for a container registry.

Microsoft.ContainerRegistry/registries/tokens/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes a token from a container registry.

Microsoft.ContainerRegistry/registries/tokens/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates a token for a container registry with the specified parameters.

Microsoft.ContainerRegistry/registries/updatePolicies/write

#
Namespace
Microsoft.ContainerRegistry

Description

Updates the policies for the specified container registry

Microsoft.ContainerRegistry/registries/webhooks/delete

#
Namespace
Microsoft.ContainerRegistry

Description

Deletes a webhook from a container registry.

Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action

#
Namespace
Microsoft.ContainerRegistry

Description

Gets the configuration of service URI and custom headers for the webhook.

Microsoft.ContainerRegistry/registries/webhooks/listEvents/action

#
Namespace
Microsoft.ContainerRegistry

Description

Lists recent events for the specified webhook.

Microsoft.ContainerRegistry/registries/webhooks/ping/action

#
Namespace
Microsoft.ContainerRegistry

Description

Triggers a ping event to be sent to the webhook.

Microsoft.ContainerRegistry/registries/webhooks/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates a webhook for a container registry with the specified parameters.

Microsoft.ContainerRegistry/registries/write

#
Namespace
Microsoft.ContainerRegistry

Description

Creates or updates a container registry with the specified parameters.

Example Resource Log Record #

{
  "ActivityStatus": "",
  "ActivityStatusValue": "Accept",
  "ActivitySubstatus": "",
  "ActivitySubstatusValue": "Created",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.ContainerRegistry/registries/zcacr39848",
    "action": "Microsoft.ContainerRegistry/registries/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.ContainerRegistry/registries/zcacr39848",
    "action": "Microsoft.ContainerRegistry/registries/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "Category": "",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782755989",
    "nbf": "1782755989",
    "exp": "1782761191",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "REDACTED",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "REDACTED",
    "rh": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "5 3",
    "xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
    "xms_idrel": "1 8",
    "xms_sub_fct": "14 3",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782755989",
    "nbf": "1782755989",
    "exp": "1782761191",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "REDACTED",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "REDACTED",
    "rh": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "5 3",
    "xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
    "xms_idrel": "1 8",
    "xms_sub_fct": "14 3",
    "xms_tcdt": "1768616282"
  },
  "CorrelationId": "903a9b89-4a02-4498-a2dc-d3aa128a7ea1",
  "EventDataId": "b678fae4-1d98-fef5-97f3-5487437a8157",
  "EventSubmissionTimestamp": "2026-06-29T19:04:19.2362826Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationId": "",
  "OperationName": "",
  "OperationNameValue": "MICROSOFT.CONTAINERREGISTRY/REGISTRIES/WRITE",
  "Properties": {
    "statusCode": "Created",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.ContainerRegistry/registries/zcacr39848",
    "message": "Microsoft.ContainerRegistry/registries/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "b678fae4-1d98-fef5-97f3-5487437a8157",
    "eventSubmissionTimestamp": "2026-06-29T19:04:19.2362826Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "zcacr39848",
    "resourceGroup": "RG-LOGCAPTURE-GEN",
    "resourceProviderValue": "MICROSOFT.CONTAINERREGISTRY",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Accept",
    "activitySubstatusValue": "Created"
  },
  "Properties_d": {
    "statusCode": "Created",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.ContainerRegistry/registries/zcacr39848",
    "message": "Microsoft.ContainerRegistry/registries/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "b678fae4-1d98-fef5-97f3-5487437a8157",
    "eventSubmissionTimestamp": "2026-06-29T19:04:19.2362826Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "zcacr39848",
    "resourceGroup": "RG-LOGCAPTURE-GEN",
    "resourceProviderValue": "MICROSOFT.CONTAINERREGISTRY",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Accept",
    "activitySubstatusValue": "Created"
  },
  "Resource": "",
  "ResourceGroup": "RG-LOGCAPTURE-GEN",
  "ResourceId": "",
  "ResourceProvider": "",
  "ResourceProviderValue": "MICROSOFT.CONTAINERREGISTRY",
  "SourceSystem": "Azure",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222",
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T19:04:19.2362826Z",
  "Type": "AzureActivity",
  "_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.containerregistry/registries/zcacr39848"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Microsoft.ContainerRegistry/unregister/action

#
Namespace
Microsoft.ContainerRegistry

Description

Unregisters the subscription for the container registry resource provider.

References #