Azure Network Azure-Microsoft.Network
any: Azure Network (catch-all)
#Description
Catch-all for Azure-Microsoft.Network rules that match the resource provider but no specific operation.
Microsoft.Network/adminNetworkSecurityGroups/delete
#Description
Deletes Admin Network Security Group
Microsoft.Network/adminNetworkSecurityGroups/write
#Description
Creates or Updates Existing Admin Network Security Group
Microsoft.Network/applicationGateways/applicationGatewayHealth/action
#Description
Gets an application gateway resource health
Microsoft.Network/applicationGateways/appProtectPolicy/attachAppProtectPolicy/action
#Description
Attaches AppProtect policy to application gateway at global, path and/or listener level
Microsoft.Network/applicationGateways/appProtectPolicy/detachAppProtectPolicy/action
#Description
Detaches AppProtect policy from application gateway at global, path and/or listener level
Microsoft.Network/applicationGateways/appProtectPolicy/getAppProtectPolicy/action
#Description
Get AppProtect policy attached to application gateway resource
Microsoft.Network/applicationGateways/backendAddressPools/join/action
#Description
Joins an application gateway backend address pool. Not Alertable.
Microsoft.Network/applicationGateways/backendhealth/action
#Description
Gets an application gateway backend health
Microsoft.Network/applicationGateways/commitMigration/action
#Description
Commit application gateway migration
Microsoft.Network/applicationGateways/delete
#Description
Deletes an application gateway
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/applicationGateways/effectiveNetworkSecurityGroups/action
#Description
Get Route Table configured On Application Gateway
Microsoft.Network/applicationGateways/effectiveRouteTable/action
#Description
Get Route Table configured On Application Gateway
Microsoft.Network/applicationGateways/executeMigration/action
#Description
Execute application gateway migration
Microsoft.Network/applicationGateways/getBackendHealthOnDemand/action
#Description
Gets an application gateway backend health on demand for given http setting and backend pool
Microsoft.Network/applicationGateways/getListenerCertificateMetadata/action
#Description
Gets an application gateway listener certificate metadata
Microsoft.Network/applicationGateways/getMigrationStatus/action
#Description
Get Status Of Migrate Application Gateway From V1 sku To V2 sku
Microsoft.Network/applicationGateways/migrateV1ToV2/action
#Description
Migrate Application Gateway from v1 sku to v2 sku
Microsoft.Network/applicationGateways/prepareMigration/action
#Description
Prepare application gateway migration
Microsoft.Network/applicationGateways/privateEndpointConnections/delete
#Description
Deletes Application Gateway PrivateEndpoint Connection
Microsoft.Network/applicationGateways/privateEndpointConnections/write
#Description
Updates Application Gateway PrivateEndpoint Connection
Microsoft.Network/applicationGateways/resolvePrivateLinkServiceId/action
#Description
Resolves privateLinkServiceId for application gateway private link resource
Microsoft.Network/applicationGateways/restart/action
#Description
Restarts an application gateway
Microsoft.Network/applicationGateways/setSecurityCenterConfiguration/action
#Description
Sets Application Gateway Security Center Configuration
Microsoft.Network/applicationGateways/start/action
#Description
Starts an application gateway
Microsoft.Network/applicationGateways/stop/action
#Description
Stops an application gateway
Microsoft.Network/applicationGateways/v1tov2Migration/action
#Description
Application Gateway V1 to V2 Migration Operation
Microsoft.Network/applicationGateways/write
#Description
Creates an application gateway or updates an application gateway
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/attachWafPolicyToAgc/action
#Description
Attaches Web application firewall policy to application gateway for containers
Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/delete
#Description
Deletes an Application Gateway WAF policy
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/dwh2220afapplicationgat",
"action": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/dwh2220afapplicationgat",
"action": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "a0e3c1d8-a394-4aa6-a136-ecb4b7eca5a0",
"EventDataId": "1262f29d-57fd-0846-a943-dc39d97bc07d",
"EventSubmissionTimestamp": "2026-07-02T18:25:16.1303936Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/APPLICATIONGATEWAYWEBAPPLICATIONFIREWALLPOLICIES/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/dwh2220afapplicationgat",
"message": "Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "1262f29d-57fd-0846-a943-dc39d97bc07d",
"eventSubmissionTimestamp": "2026-07-02T18:25:16.1303936Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afapplicationgat",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/dwh2220afapplicationgat",
"message": "Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "1262f29d-57fd-0846-a943-dc39d97bc07d",
"eventSubmissionTimestamp": "2026-07-02T18:25:16.1303936Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afapplicationgat",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/detachWafPolicyFromAgc/action
#Description
Detaches Web application firewall policy from application gateway for containers
Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/join/action
#Description
Join Application Gateway Web Application Firewall Policy. Not alertable
Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/write
#Description
Creates an Application Gateway WAF policy or updates an Application Gateway WAF policy
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/dwh2220afapplicationgat",
"action": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/dwh2220afapplicationgat",
"action": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "45495173-f6d9-4456-a9fa-dffda00c502f",
"EventDataId": "7b5ab62c-bca6-82e6-db89-9d14a6fd8682",
"EventSubmissionTimestamp": "2026-07-02T18:23:15.1524609Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/APPLICATIONGATEWAYWEBAPPLICATIONFIREWALLPOLICIES/WRITE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/dwh2220afapplicationgat",
"message": "Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "7b5ab62c-bca6-82e6-db89-9d14a6fd8682",
"eventSubmissionTimestamp": "2026-07-02T18:23:15.1524609Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afapplicationgat",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/dwh2220afapplicationgat",
"message": "Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "7b5ab62c-bca6-82e6-db89-9d14a6fd8682",
"eventSubmissionTimestamp": "2026-07-02T18:23:15.1524609Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afapplicationgat",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/applicationSecurityGroups/addressPrefixSets/delete
#Description
Deletes an Address Prefix Set
Microsoft.Network/applicationSecurityGroups/addressPrefixSets/write
#Description
Creates an address prefix set or updates an existing address prefix set
Microsoft.Network/applicationSecurityGroups/delete
#Description
Deletes an Application Security Group
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/applicationSecurityGroups/dwh92eef0asg",
"action": "Microsoft.Network/applicationSecurityGroups/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/applicationSecurityGroups/dwh92eef0asg",
"action": "Microsoft.Network/applicationSecurityGroups/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "afc938e3-dbe2-4333-9fe3-7f95bd703877",
"EventDataId": "95c98185-5696-c93e-e8d1-c56a3076a522",
"EventSubmissionTimestamp": "2026-07-02T17:14:58.6910678Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/APPLICATIONSECURITYGROUPS/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/applicationSecurityGroups/dwh92eef0asg",
"message": "Microsoft.Network/applicationSecurityGroups/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "95c98185-5696-c93e-e8d1-c56a3076a522",
"eventSubmissionTimestamp": "2026-07-02T17:14:58.6910678Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0asg",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/applicationSecurityGroups/dwh92eef0asg",
"message": "Microsoft.Network/applicationSecurityGroups/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "95c98185-5696-c93e-e8d1-c56a3076a522",
"eventSubmissionTimestamp": "2026-07-02T17:14:58.6910678Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0asg",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/applicationSecurityGroups/joinIpConfiguration/action
#Description
Joins an IP Configuration to Application Security Groups. Not alertable.
Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action
#Description
Joins a Security Rule to Application Security Groups. Not alertable.
Microsoft.Network/applicationSecurityGroups/listAddressPrefixSets/action
#Description
Lists address prefix sets in an application security group
Microsoft.Network/applicationSecurityGroups/listIpConfigurations/action
#Description
Lists IP Configurations in the ApplicationSecurityGroup
Microsoft.Network/applicationSecurityGroups/write
#Description
Creates an Application Security Group, or updates an existing Application Security Group.
Example Resource Log Record #
{
"ActivityStatus": "",
"ActivityStatusValue": "Success",
"ActivitySubstatus": "",
"ActivitySubstatusValue": "",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/applicationSecurityGroups/zcasg3",
"action": "Microsoft.Network/applicationSecurityGroups/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/applicationSecurityGroups/zcasg3",
"action": "Microsoft.Network/applicationSecurityGroups/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"Category": "",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"CorrelationId": "ba66021d-6ed1-44fb-898d-69cfe9eed945",
"EventDataId": "2f581fed-3d63-9319-8397-caa13aad9470",
"EventSubmissionTimestamp": "2026-06-29T19:02:14.6592814Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationId": "",
"OperationName": "",
"OperationNameValue": "MICROSOFT.NETWORK/APPLICATIONSECURITYGROUPS/WRITE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/applicationSecurityGroups/zcasg3",
"message": "Microsoft.Network/applicationSecurityGroups/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "2f581fed-3d63-9319-8397-caa13aad9470",
"eventSubmissionTimestamp": "2026-06-29T19:02:14.6592814Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcasg3",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/applicationSecurityGroups/zcasg3",
"message": "Microsoft.Network/applicationSecurityGroups/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "2f581fed-3d63-9319-8397-caa13aad9470",
"eventSubmissionTimestamp": "2026-06-29T19:02:14.6592814Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcasg3",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Resource": "",
"ResourceGroup": "RG-LOGCAPTURE-GEN",
"ResourceId": "",
"ResourceProvider": "",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SourceSystem": "Azure",
"SubscriptionId": "22222222-2222-2222-2222-222222222222",
"TenantId": "00000000-0000-0000-0000-000000000000",
"TimeGenerated": "2026-06-29T19:02:14.6592814Z",
"Type": "AzureActivity",
"_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.network/applicationsecuritygroups/zcasg3"
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/authenticationPolicies/delete
#Description
Delete Authentication Policy
Microsoft.Network/authenticationPolicies/join/action
#Description
Join Authentication Policy
Microsoft.Network/authenticationPolicies/write
#Description
Create or update Authentication Policy
Microsoft.Network/azureFirewalls/applicationRuleCollections/delete
#Description
Deletes Azure Firewall ApplicationRuleCollection
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1686, T1686.001↳ also matches Microsoft.Network/azureFirewalls/applicationRuleCollections/write, Microsoft.Network/azureFirewalls/natRuleCollections/delete, Microsoft.Network/azureFirewalls/natRuleCollections/write, Microsoft.Network/azureFirewalls/networkRuleCollections/delete, Microsoft.Network/azureFirewalls/networkRuleCollections/write
Microsoft.Network/azureFirewalls/applicationRuleCollections/write
#Description
CreatesOrUpdates Azure Firewall ApplicationRuleCollection
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1686, T1686.001↳ also matches Microsoft.Network/azureFirewalls/applicationRuleCollections/delete, Microsoft.Network/azureFirewalls/natRuleCollections/delete, Microsoft.Network/azureFirewalls/natRuleCollections/write, Microsoft.Network/azureFirewalls/networkRuleCollections/delete, Microsoft.Network/azureFirewalls/networkRuleCollections/write
Microsoft.Network/azurefirewalls/delete
#Description
Delete Azure Firewall
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1686, T1686.001↳ also matches Microsoft.Network/azurefirewalls/write
Microsoft.Network/azurefirewalls/learnedIPPrefixes/action
#Description
Gets IP prefixes learned by Azure Firewall to not perform SNAT
Microsoft.Network/azureFirewalls/natRuleCollections/delete
#Description
Deletes Azure Firewall NatRuleCollection
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1686, T1686.001↳ also matches Microsoft.Network/azureFirewalls/applicationRuleCollections/delete, Microsoft.Network/azureFirewalls/applicationRuleCollections/write, Microsoft.Network/azureFirewalls/natRuleCollections/write, Microsoft.Network/azureFirewalls/networkRuleCollections/delete, Microsoft.Network/azureFirewalls/networkRuleCollections/write
Microsoft.Network/azureFirewalls/natRuleCollections/write
#Description
CreatesOrUpdates Azure Firewall NatRuleCollection
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1686, T1686.001↳ also matches Microsoft.Network/azureFirewalls/applicationRuleCollections/delete, Microsoft.Network/azureFirewalls/applicationRuleCollections/write, Microsoft.Network/azureFirewalls/natRuleCollections/delete, Microsoft.Network/azureFirewalls/networkRuleCollections/delete, Microsoft.Network/azureFirewalls/networkRuleCollections/write
Microsoft.Network/azureFirewalls/networkRuleCollections/delete
#Description
Deletes Azure Firewall NetworkRuleCollection
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1686, T1686.001↳ also matches Microsoft.Network/azureFirewalls/applicationRuleCollections/delete, Microsoft.Network/azureFirewalls/applicationRuleCollections/write, Microsoft.Network/azureFirewalls/natRuleCollections/delete, Microsoft.Network/azureFirewalls/natRuleCollections/write, Microsoft.Network/azureFirewalls/networkRuleCollections/write
Microsoft.Network/azureFirewalls/networkRuleCollections/write
#Description
CreatesOrUpdates Azure Firewall NetworkRuleCollection
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1686, T1686.001↳ also matches Microsoft.Network/azureFirewalls/applicationRuleCollections/delete, Microsoft.Network/azureFirewalls/applicationRuleCollections/write, Microsoft.Network/azureFirewalls/natRuleCollections/delete, Microsoft.Network/azureFirewalls/natRuleCollections/write, Microsoft.Network/azureFirewalls/networkRuleCollections/delete
Microsoft.Network/azurefirewalls/packetCapture/action
#Description
AzureFirewallPacketCaptureOperation
Microsoft.Network/azurefirewalls/packetCaptureOperation/action
#Description
AzureFirewallPacketCaptureOperation
Microsoft.Network/azureFirewalls/providers/Microsoft.Insights/DiagnosticSettings/Write
#Description
Create or update the diagnostic settings of Azure Firewalls
Microsoft.Network/azurefirewalls/write
#Description
Creates or updates an Azure Firewall
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1686, T1686.001↳ also matches Microsoft.Network/azurefirewalls/delete
Microsoft.Network/azureWebCategories/classifyUnknown/action
#Description
Classifies Unknown WebCategory
Microsoft.Network/azureWebCategories/getMiscategorizationStatus/action
#Description
Gets Miscategorization Status
Microsoft.Network/azureWebCategories/getwebcategory/action
#Description
Looks up WebCategory
Microsoft.Network/azureWebCategories/reclassify/action
#Description
Reclassifies WebCategory
Microsoft.Network/bastionHosts/delete
#Description
Deletes a Bastion Host
Microsoft.Network/bastionHosts/disconnectactivesessions/action
#Description
Disconnect given Active Sessions in the Bastion Host
Microsoft.Network/bastionHosts/getactivesessions/action
#Description
Get Active Sessions in the Bastion Host
Microsoft.Network/bastionHosts/getsessionrecordingsasurl/action
#Description
Gets SAS URL for BastionHost Session Recording Feature
Microsoft.Network/bastionHosts/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates the diagnostic setting for the resource
Microsoft.Network/bastionHosts/setsessionrecordingsasurl/action
#Description
Sets SAS URL for BastionHost Session Recording Feature
Microsoft.Network/bastionHosts/write
#Description
Create or Update a Bastion Host
Microsoft.Network/checkFrontDoorNameAvailability/action
#Description
Checks whether a Front Door name is available
Microsoft.Network/checkTrafficManagerNameAvailability/action
#Description
Checks the availability of a Traffic Manager Relative DNS name.
Microsoft.Network/connections/delete
#Description
Deletes VirtualNetworkGatewayConnection
Microsoft.Network/connections/getikesas/action
#Description
Lists IKE Security Associations for the connection
Microsoft.Network/connections/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates diagnostic settings for Connections
Microsoft.Network/connections/resetconnection/action
#Description
Resets connection for VNG
Microsoft.Network/connections/revoke/action
#Description
Marks an Express Route Connection status as Revoked
Microsoft.Network/connections/startpacketcapture/action
#Description
Starts a Virtual Network Gateway Connection Packet Capture.
Microsoft.Network/connections/stoppacketcapture/action
#Description
Stops a Virtual Network Gateway Connection Packet Capture.
Microsoft.Network/connections/vpndeviceconfigurationscript/action
#Description
Gets Vpn Device Configuration of VirtualNetworkGatewayConnection
Microsoft.Network/connections/write
#Description
Creates or updates an existing VirtualNetworkGatewayConnection
Microsoft.Network/customIpPrefixes/delete
#Description
Deletes A Custom Ip Prefix
Microsoft.Network/customIpPrefixes/join/action
#Description
Joins a CustomIpPrefix. Not alertable.
Microsoft.Network/customIpPrefixes/write
#Description
Creates A Custom Ip Prefix Or Updates An Existing Custom Ip Prefix
Microsoft.Network/ddosCustomPolicies/delete
#Description
Deletes a DDoS customized policy
Microsoft.Network/ddosCustomPolicies/write
#Description
Creates a DDoS customized policy or updates an existing DDoS customized policy
Microsoft.Network/ddosProtectionPlans/ddosProtectionPlanProxies/delete
#Description
Deletes a DDoS Protection Plan Proxy
Microsoft.Network/ddosProtectionPlans/ddosProtectionPlanProxies/write
#Description
Creates a DDoS Protection Plan Proxy or updates and existing DDoS Protection Plan Proxy
Microsoft.Network/ddosProtectionPlans/delete
#Description
Deletes a DDoS Protection Plan
Microsoft.Network/ddosProtectionPlans/join/action
#Description
Joins a DDoS Protection Plan. Not alertable.
Microsoft.Network/ddosProtectionPlans/write
#Description
Creates a DDoS Protection Plan or updates a DDoS Protection Plan
Microsoft.Network/dnsForwardingRulesets/delete
#Description
Deletes a DNS Forwarding Ruleset, in JSON format
Microsoft.Network/dnsForwardingRulesets/forwardingRules/delete
#Description
Deletes a DNS Forwarding Rule, in JSON format
Microsoft.Network/dnsForwardingRulesets/forwardingRules/write
#Description
Creates Or Updates a DNS Forwarding Rule, in JSON format
Microsoft.Network/dnsForwardingRulesets/join/action
#Description
Join DNS Forwarding Ruleset
Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/delete
#Description
Deletes DNS Forwarding Ruleset Link to Virtual Network
Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/write
#Description
Creates Or Updates DNS Forwarding Ruleset Link to virtual network properties, in JSON format
Microsoft.Network/dnsForwardingRulesets/write
#Description
Creates Or Updates a DNS Forwarding Ruleset
Microsoft.Network/dnsResolverDomainLists/bulk/action
#Description
Bulk operations on the contents of the DNS Resolver Domain List.
Microsoft.Network/dnsResolverDomainLists/delete
#Description
Delete a DNS Resolver Domain List.
Microsoft.Network/dnsResolverDomainLists/join/action
#Description
Join a DNS Resolver Domain List from another resource.
Microsoft.Network/dnsResolverDomainLists/write
#Description
Create or update a DNS Resolver Domain List.
Microsoft.Network/dnsResolverPolicies/delete
#Description
Delete a DNS Resolver Policy.
Microsoft.Network/dnsResolverPolicies/dnsSecurityRules/delete
#Description
Delete a DNS Security Rule for a DNS Resolver Policy.
Microsoft.Network/dnsResolverPolicies/dnsSecurityRules/write
#Description
Create or update a DNS Security Rule for a DNS Resolver Policy.
Microsoft.Network/dnsResolverPolicies/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Create or update diagnostic settings for a DNS Resolver Policy.
Microsoft.Network/dnsResolverPolicies/virtualNetworkLinks/delete
#Description
Delete a Virtual Network Link for a DNS Resolver Policy.
Microsoft.Network/dnsResolverPolicies/virtualNetworkLinks/write
#Description
Create or update a Virtual Network Link for a DNS Resolver Policy.
Microsoft.Network/dnsResolverPolicies/write
#Description
Create or update a DNS Resolver Policy.
Microsoft.Network/dnsResolvers/delete
#Description
Deletes a DNS Resolver
Microsoft.Network/dnsResolvers/inboundEndpoints/delete
#Description
Deletes a DNS Resolver Inbound Endpoint, in JSON format
Microsoft.Network/dnsResolvers/inboundEndpoints/join/action
#Description
Join DNS Resolver
Microsoft.Network/dnsResolvers/inboundEndpoints/write
#Description
Creates Or Updates a DNS Resolver Inbound Endpoint, in JSON format
Microsoft.Network/dnsResolvers/join/action
#Description
Join DNS Resolver
Microsoft.Network/dnsResolvers/outboundEndpoints/delete
#Description
Deletes a DNS Resolver Outbound Endpoint description.
Microsoft.Network/dnsResolvers/outboundEndpoints/join/action
#Description
Join DNS Resolver
Microsoft.Network/dnsResolvers/outboundEndpoints/listDnsForwardingRulesets/action
#Description
Gets the DNS Forwarding Rulesets Properties for DNS Resolver Outbound Endpoint, in JSON format
Microsoft.Network/dnsResolvers/outboundEndpoints/write
#Description
Creates Or Updates a DNS Resolver Outbound Endpoint, in JSON format
Microsoft.Network/dnsResolvers/write
#Description
Creates Or Updates a DNS Resolver, in JSON format
Microsoft.Network/dnszones/A/delete
#Description
Remove the record set of a given name and type 'A' from a DNS zone.
Microsoft.Network/dnszones/A/write
#Description
Create or update a record set of type 'A' within a DNS zone. The records specified will replace the current records in the record set.
Microsoft.Network/dnszones/AAAA/delete
#Description
Remove the record set of a given name and type 'AAAA' from a DNS zone.
Microsoft.Network/dnszones/AAAA/write
#Description
Create or update a record set of type 'AAAA' within a DNS zone. The records specified will replace the current records in the record set.
Microsoft.Network/dnszones/CAA/delete
#Description
Remove the record set of a given name and type 'CAA' from a DNS zone.
Microsoft.Network/dnszones/CAA/write
#Description
Create or update a record set of type 'CAA' within a DNS zone. The records specified will replace the current records in the record set.
Microsoft.Network/dnszones/CNAME/delete
#Description
Remove the record set of a given name and type 'CNAME' from a DNS zone.
Microsoft.Network/dnszones/CNAME/write
#Description
Create or update a record set of type 'CNAME' within a DNS zone. The records specified will replace the current records in the record set.
Microsoft.Network/dnszones/delete
#Description
Delete the DNS zone, in JSON format. The zone properties include tags, etag, numberOfRecordSets, and maxNumberOfRecordSets.
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"ActivitySubstatusValue": "NoContent",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/dnsZones/dwh2220afdnszones",
"action": "Microsoft.Network/dnsZones/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/dnsZones/dwh2220afdnszones",
"action": "Microsoft.Network/dnsZones/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "95dc5735-fb83-49a5-a7d9-ec552a7cd1ae",
"EventDataId": "e1a02799-2fff-434a-f505-c871bc4a7342",
"EventSubmissionTimestamp": "2026-07-02T18:23:19.9687492Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/DNSZONES/DELETE",
"Properties": {
"statusCode": "NoContent",
"serviceRequestId": "",
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/dnsZones/dwh2220afdnszones",
"message": "Microsoft.Network/dnsZones/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "e1a02799-2fff-434a-f505-c871bc4a7342",
"eventSubmissionTimestamp": "2026-07-02T18:23:19.9687492Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afdnszones",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"activitySubstatusValue": "NoContent"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/dnsZones/dwh2220afdnszones",
"message": "Microsoft.Network/dnsZones/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "e1a02799-2fff-434a-f505-c871bc4a7342",
"eventSubmissionTimestamp": "2026-07-02T18:23:19.9687492Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afdnszones",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"statusCode": "NoContent",
"serviceRequestId": "",
"activitySubstatusValue": "NoContent"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/dnszones/dnssecConfigs/default/delete
#Description
Deletes the DNSSEC configuration for a DNS zone
Microsoft.Network/dnszones/dnssecConfigs/default/write
#Description
Creates or updates the DNSSEC configuration for a DNS zone
Microsoft.Network/dnszones/DS/delete
#Description
Deletes the DNS record set of type DS
Microsoft.Network/dnszones/DS/write
#Description
Creates or updates DNS record set of type DS
Microsoft.Network/dnszones/MX/delete
#Description
Remove the record set of a given name and type 'MX' from a DNS zone.
Microsoft.Network/dnszones/MX/write
#Description
Create or update a record set of type 'MX' within a DNS zone. The records specified will replace the current records in the record set.
Microsoft.Network/dnszones/NS/delete
#Description
Deletes the DNS record set of type NS
Microsoft.Network/dnszones/NS/write
#Description
Creates or updates DNS record set of type NS
Microsoft.Network/dnszones/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates the DNS zone diagnostic settings
Microsoft.Network/dnszones/PTR/delete
#Description
Remove the record set of a given name and type 'PTR' from a DNS zone.
Microsoft.Network/dnszones/PTR/write
#Description
Create or update a record set of type 'PTR' within a DNS zone. The records specified will replace the current records in the record set.
Microsoft.Network/dnszones/SOA/write
#Description
Creates or updates DNS record set of type SOA
Microsoft.Network/dnszones/SRV/delete
#Description
Remove the record set of a given name and type 'SRV' from a DNS zone.
Microsoft.Network/dnszones/SRV/write
#Description
Create or update record set of type SRV
Microsoft.Network/dnszones/TLSA/delete
#Description
Deletes the DNS record set of type TLSA
Microsoft.Network/dnszones/TLSA/write
#Description
Creates or updates DNS record set of type TLSA
Microsoft.Network/dnszones/TXT/delete
#Description
Remove the record set of a given name and type 'TXT' from a DNS zone.
Microsoft.Network/dnszones/TXT/write
#Description
Create or update a record set of type 'TXT' within a DNS zone. The records specified will replace the current records in the record set.
Microsoft.Network/dnszones/write
#Description
Create or update a DNS zone within a resource group. Used to update the tags on a DNS zone resource. Note that this command can not be used to create or update record sets within the zone.
Example Resource Log Record #
{
"ActivityStatusValue": "Failure",
"ActivitySubstatusValue": "BadRequest",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/dnsZones/dwh2220afdnszones",
"action": "Microsoft.Network/dnsZones/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/dnsZones/dwh2220afdnszones",
"action": "Microsoft.Network/dnsZones/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "d1be501b-2f7b-4c59-8729-92ac0e3220db",
"EventDataId": "b5dd0e8c-d52f-def7-baf0-1a38c4d6a708",
"EventSubmissionTimestamp": "2026-07-02T18:23:18.3851724Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Error",
"OperationNameValue": "MICROSOFT.NETWORK/DNSZONES/WRITE",
"Properties": {
"statusCode": "BadRequest",
"serviceRequestId": "",
"statusMessage": {
"code": "BadRequest",
"message": "The zone name 'dwh2220afdnszones' does not have enough labels. Zone names must have two or more labels."
},
"responseBody": {
"code": "BadRequest",
"message": "The zone name 'dwh2220afdnszones' does not have enough labels. Zone names must have two or more labels."
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/dnsZones/dwh2220afdnszones",
"message": "Microsoft.Network/dnsZones/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "b5dd0e8c-d52f-def7-baf0-1a38c4d6a708",
"eventSubmissionTimestamp": "2026-07-02T18:23:18.3851724Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afdnszones",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Failure",
"activitySubstatusValue": "BadRequest"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/dnsZones/dwh2220afdnszones",
"message": "Microsoft.Network/dnsZones/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "b5dd0e8c-d52f-def7-baf0-1a38c4d6a708",
"eventSubmissionTimestamp": "2026-07-02T18:23:18.3851724Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afdnszones",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Failure",
"statusCode": "BadRequest",
"serviceRequestId": "",
"activitySubstatusValue": "BadRequest",
"responseBody": {
"code": "BadRequest",
"message": "The zone name 'dwh2220afdnszones' does not have enough labels. Zone names must have two or more labels."
},
"statusMessage": {
"code": "BadRequest",
"message": "The zone name 'dwh2220afdnszones' does not have enough labels. Zone names must have two or more labels."
}
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/dscpConfiguration/join/action
#Description
Joins DSCP Configuration
Microsoft.Network/dscpConfiguration/write
#Description
Operation to put the DSCP configuration
Microsoft.Network/expressRouteCircuits/delete
#Description
Deletes an ExpressRouteCircuit
Microsoft.Network/expressRouteCircuits/join/action
#Description
Joins an Express Route Circuit. Not alertable.
Microsoft.Network/expressRouteCircuits/nrpinternalupdate/action
#Description
Create or Update ExpressRouteCircuit
Microsoft.Network/expressRouteCircuits/peerings/connections/delete
#Description
Deletes an ExpressRouteCircuit Connection
Microsoft.Network/expressRouteCircuits/peerings/connections/write
#Description
Creates or updates an existing ExpressRouteCircuit Connection Resource
Microsoft.Network/expressRouteCircuits/peerings/delete
#Description
Deletes an ExpressRouteCircuit Peering
Microsoft.Network/expressRouteCircuits/peerings/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates diagnostic settings for ExpressRoute Circuit Peerings
Microsoft.Network/expressRouteCircuits/peerings/write
#Description
Creates or updates an existing ExpressRouteCircuit Peering
Microsoft.Network/expressRouteCircuits/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates diagnostic settings for ExpressRoute Circuits
Microsoft.Network/expressRouteCircuits/write
#Description
Creates or updates an existing ExpressRouteCircuit
Microsoft.Network/expressRouteCrossConnections/confirmActivationKey/action
#Description
Express Route Cross Connection Confirm Activation Key
Microsoft.Network/expressRouteCrossConnections/delete
#Description
Delete Express Route Cross Connection
Microsoft.Network/expressRouteCrossConnections/deprovisionConnection/action
#Description
Express Route Deprovision Multi Cloud Connection
Microsoft.Network/expressRouteCrossConnections/features/delete
#Description
Deletes an Express Route Cross Connection Feature
Microsoft.Network/expressRouteCrossConnections/features/write
#Description
Creates or Updates an Express Route Cross Connection Feature
Microsoft.Network/expressRouteCrossConnections/join/action
#Description
Joins an Express Route Cross Connection. Not alertable.
Microsoft.Network/expressRouteCrossConnections/notifyConnectionStatus/action
#Description
Express Route Notify Multi Cloud Connection Status
Microsoft.Network/expressRouteCrossConnections/peerings/delete
#Description
Deletes an Express Route Cross Connection Peering
Microsoft.Network/expressRouteCrossConnections/peerings/write
#Description
Creates an Express Route Cross Connection Peering or Updates an existing Express Route Cross Connection Peering
Microsoft.Network/expressRouteCrossConnections/proposeInterconnect/action
#Description
Express Route Cross Connection operation to propose Interconnect
Microsoft.Network/expressRouteCrossConnections/serviceProviders/action
#Description
Backfill Express Route Cross Connection
Microsoft.Network/expressRouteCrossConnections/write
#Description
Create or Update Express Route Cross Connection
Microsoft.Network/expressRouteGateways/delete
#Description
Delete Express Route Gateway
Microsoft.Network/expressRouteGateways/expressRouteConnections/delete
#Description
Deletes an Express Route Connection
Microsoft.Network/expressRouteGateways/expressRouteConnections/write
#Description
Creates an Express Route Connection or Updates an existing Express Route Connection
Microsoft.Network/expressRouteGateways/join/action
#Description
Joins an Express Route Gateway. Not alertable.
Microsoft.Network/expressRouteGateways/write
#Description
Create or Update Express Route Gateway
Microsoft.Network/expressRouteLags/delete
#Description
Deletes ExpressRouteLag
Microsoft.Network/expressRouteLags/generateloa/action
#Description
Generates LOA for ExpressRouteLag
Microsoft.Network/expressRouteLags/join/action
#Description
Joins ExpressRouteLag
Microsoft.Network/expressRouteLags/write
#Description
Creates or updates ExpressRouteLag
Microsoft.Network/expressRoutePorts/delete
#Description
Deletes ExpressRoutePorts
Microsoft.Network/expressRoutePorts/generateloa/action
#Description
Generates LOA for ExpressRoutePorts
Microsoft.Network/expressRoutePorts/join/action
#Description
Joins Express Route ports. Not alertable.
Microsoft.Network/expressRoutePorts/write
#Description
Creates or updates ExpressRoutePorts
Microsoft.Network/firewallPolicies/certificates/action
#Description
Generate Firewall Policy Certificates
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1686, T1686.001↳ also matches Microsoft.Network/firewallPolicies/delete, Microsoft.Network/firewallPolicies/join/action, Microsoft.Network/firewallPolicies/write
Microsoft.Network/firewallPolicies/delete
#Description
Deletes a Firewall Policy
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/firewallPolicies/dwh2220affirewallpolici",
"action": "Microsoft.Network/firewallPolicies/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/firewallPolicies/dwh2220affirewallpolici",
"action": "Microsoft.Network/firewallPolicies/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "f46e907e-014f-4d34-bd5b-457426f20dcb",
"EventDataId": "42d7460e-8ab0-9283-5a2c-dc3e063ff2ca",
"EventSubmissionTimestamp": "2026-07-02T18:33:35.0856657Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/firewallPolicies/dwh2220affirewallpolici",
"message": "Microsoft.Network/firewallPolicies/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "42d7460e-8ab0-9283-5a2c-dc3e063ff2ca",
"eventSubmissionTimestamp": "2026-07-02T18:33:35.0856657Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220affirewallpolici",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/firewallPolicies/dwh2220affirewallpolici",
"message": "Microsoft.Network/firewallPolicies/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "42d7460e-8ab0-9283-5a2c-dc3e063ff2ca",
"eventSubmissionTimestamp": "2026-07-02T18:33:35.0856657Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220affirewallpolici",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1686, T1686.001↳ also matches Microsoft.Network/firewallPolicies/certificates/action, Microsoft.Network/firewallPolicies/join/action, Microsoft.Network/firewallPolicies/write Elastic #
T1562, T1562.007Panther #
T1562.004
Microsoft.Network/firewallPolicies/deploy/action
#Description
Deploy Firewall Policy Draft
Microsoft.Network/firewallPolicies/firewallPolicyDrafts/delete
#Description
Deletes a Firewall Policy Draft
Microsoft.Network/firewallPolicies/firewallPolicyDrafts/write
#Description
Creates a Firewall Policy Draft or Updates an existing Firewall Policy Draft
Microsoft.Network/firewallPolicies/join/action
#Description
Joins a Firewall Policy. Not alertable.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1686, T1686.001↳ also matches Microsoft.Network/firewallPolicies/certificates/action, Microsoft.Network/firewallPolicies/delete, Microsoft.Network/firewallPolicies/write
Microsoft.Network/firewallPolicies/pacFile/action
#Description
Get Firewall Policy PacFile
Microsoft.Network/firewallPolicies/ruleCollectionGroups/delete
#Description
Deletes a Firewall Policy Rule Collection Group
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/firewallPolicies/ruleCollectionGroups/ruleCollectionGroupDrafts/delete
#Description
Deletes a Firewall Policy Rule Collection Group Draft
Microsoft.Network/firewallPolicies/ruleCollectionGroups/ruleCollectionGroupDrafts/write
#Description
Creates a Firewall Policy Rule Collection Group Draft or Updates an existing Firewall Policy Rule Collection Group Draft
Microsoft.Network/firewallPolicies/ruleCollectionGroups/write
#Description
Creates a Firewall Policy Rule Collection Group or Updates an existing Firewall Policy Rule Collection Group
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/firewallPolicies/ruleGroups/delete
#Description
Deletes a Firewall Policy Rule Group
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/firewallPolicies/ruleGroups/write
#Description
Creates a Firewall Policy Rule Group or Updates an existing Firewall Policy Rule Group
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/firewallPolicies/write
#Description
Creates a Firewall Policy or Updates an existing Firewall Policy
Example Resource Log Record #
{
"ActivityStatus": "",
"ActivityStatusValue": "Accept",
"ActivitySubstatus": "",
"ActivitySubstatusValue": "Created",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/firewallPolicies/zcfwpol3",
"action": "Microsoft.Network/firewallPolicies/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/firewallPolicies/zcfwpol3",
"action": "Microsoft.Network/firewallPolicies/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"Category": "",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"CorrelationId": "43280262-6fe3-45ea-bbaf-6f72a7094bf4",
"EventDataId": "0e8da4a4-e2c8-469b-b565-bd2e2ff1ca11",
"EventSubmissionTimestamp": "2026-06-29T19:02:17.1953723Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationId": "",
"OperationName": "",
"OperationNameValue": "MICROSOFT.NETWORK/FIREWALLPOLICIES/WRITE",
"Properties": {
"statusCode": "Created",
"serviceRequestId": "",
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/firewallPolicies/zcfwpol3",
"message": "Microsoft.Network/firewallPolicies/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "0e8da4a4-e2c8-469b-b565-bd2e2ff1ca11",
"eventSubmissionTimestamp": "2026-06-29T19:02:17.1953723Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcfwpol3",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Accept",
"activitySubstatusValue": "Created"
},
"Properties_d": {
"statusCode": "Created",
"serviceRequestId": "",
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/firewallPolicies/zcfwpol3",
"message": "Microsoft.Network/firewallPolicies/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "0e8da4a4-e2c8-469b-b565-bd2e2ff1ca11",
"eventSubmissionTimestamp": "2026-06-29T19:02:17.1953723Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcfwpol3",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Accept",
"activitySubstatusValue": "Created"
},
"Resource": "",
"ResourceGroup": "RG-LOGCAPTURE-GEN",
"ResourceId": "",
"ResourceProvider": "",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SourceSystem": "Azure",
"SubscriptionId": "22222222-2222-2222-2222-222222222222",
"TenantId": "00000000-0000-0000-0000-000000000000",
"TimeGenerated": "2026-06-29T19:02:17.1953723Z",
"Type": "AzureActivity",
"_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.network/firewallpolicies/zcfwpol3"
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1686, T1686.001↳ also matches Microsoft.Network/firewallPolicies/certificates/action, Microsoft.Network/firewallPolicies/delete, Microsoft.Network/firewallPolicies/join/action
Microsoft.Network/frontDoors/backendPools/delete
#Description
Deletes a backend pool
Microsoft.Network/frontDoors/backendPools/write
#Description
Creates or updates a backend pool
Microsoft.Network/frontDoors/delete
#Description
Deletes a Front Door
Microsoft.Network/frontDoors/frontendEndpoints/delete
#Description
Deletes a frontend endpoint
Microsoft.Network/frontDoors/frontendEndpoints/disableHttps/action
#Description
Disables HTTPS on a Frontend Endpoint
Microsoft.Network/frontDoors/frontendEndpoints/enableHttps/action
#Description
Enables HTTPS on a Frontend Endpoint
Microsoft.Network/frontDoors/frontendEndpoints/write
#Description
Creates or updates a frontend endpoint
Microsoft.Network/frontDoors/healthProbeSettings/delete
#Description
Deletes health probe settings
Microsoft.Network/frontDoors/healthProbeSettings/write
#Description
Creates or updates health probe settings
Microsoft.Network/frontDoors/loadBalancingSettings/delete
#Description
Creates or updates load balancing settings
Microsoft.Network/frontDoors/loadBalancingSettings/write
#Description
Creates or updates load balancing settings
Microsoft.Network/frontdoors/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates the diagnostic setting for the Frontdoor resource
Microsoft.Network/frontDoors/purge/action
#Description
Purge cached content from a Front Door
Microsoft.Network/frontDoors/routingRules/delete
#Description
Deletes a routing rule
Microsoft.Network/frontDoors/routingRules/write
#Description
Creates or updates a routing rule
Microsoft.Network/frontDoors/rulesEngines/delete
#Description
Deletes a Rules Engine
Microsoft.Network/frontDoors/rulesEngines/write
#Description
Creates or updates a Rules Engine
Microsoft.Network/frontDoors/validateCustomDomain/action
#Description
Validates a frontend endpoint for a Front Door
Microsoft.Network/frontDoors/write
#Description
Creates or updates a Front Door
Microsoft.Network/frontDoorWebApplicationFirewallPolicies/delete
#Description
Deletes a Web Application Firewall Policy
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Elastic #
T1562, T1562.007
Microsoft.Network/frontDoorWebApplicationFirewallPolicies/join/action
#Description
Joins a Web Application Firewall Policy. Not Alertable.
Microsoft.Network/frontDoorWebApplicationFirewallPolicies/write
#Description
Creates or updates a Web Application Firewall Policy
Microsoft.Network/gatewayLoadBalancerAliases/delete
#Description
Delete Gateway LoadBalancer Alias
Microsoft.Network/gatewayLoadBalancerAliases/write
#Description
Creates or Updates a Gateway LaodBalancer Alias
Microsoft.Network/getDnsResourceReference/action
#Description
DNS alias resource dependency request
Microsoft.Network/interconnectGroups/delete
#Description
Delete Interconnect Group
Microsoft.Network/interconnectGroups/write
#Description
Create or update Interconnect Group
Microsoft.Network/internalNotify/action
#Description
DNS alias resource notification
Microsoft.Network/ipAllocations/delete
#Description
Deletes A IpAllocation
Microsoft.Network/ipAllocations/write
#Description
Creates A IpAllocation Or Updates An Existing IpAllocation
Microsoft.Network/ipGroups/delete
#Description
Deletes an IpGroup
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/ipGroups/dwhc6a93dipgroups",
"action": "Microsoft.Network/ipGroups/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/ipGroups/dwhc6a93dipgroups",
"action": "Microsoft.Network/ipGroups/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783041418",
"nbf": "1783041418",
"exp": "1783045937",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "tUdFU6nO4UmtUjpbHDqEAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783041418",
"nbf": "1783041418",
"exp": "1783045937",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "tUdFU6nO4UmtUjpbHDqEAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"CorrelationId": "13ca6ac6-1552-4a78-8c4a-d5be26440c6e",
"EventDataId": "abfa3e52-9cd1-589a-6b9f-5b9833a9899e",
"EventSubmissionTimestamp": "2026-07-03T02:28:42.7689219Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/IPGROUPS/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/ipGroups/dwhc6a93dipgroups",
"message": "Microsoft.Network/ipGroups/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "abfa3e52-9cd1-589a-6b9f-5b9833a9899e",
"eventSubmissionTimestamp": "2026-07-03T02:28:42.7689219Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwhc6a93dipgroups",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/ipGroups/dwhc6a93dipgroups",
"message": "Microsoft.Network/ipGroups/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "abfa3e52-9cd1-589a-6b9f-5b9833a9899e",
"eventSubmissionTimestamp": "2026-07-03T02:28:42.7689219Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwhc6a93dipgroups",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/ipGroups/join/action
#Description
Joins an IpGroup. Not alertable.
Microsoft.Network/ipGroups/updateReferences/action
#Description
Update references in an IpGroup
Microsoft.Network/ipGroups/validate/action
#Description
Validates an IpGroup
Microsoft.Network/ipGroups/write
#Description
Creates an IpGroup or Updates an Existing IpGroup
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/ipGroups/dwh2220afipgroups",
"action": "Microsoft.Network/ipGroups/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/ipGroups/dwh2220afipgroups",
"action": "Microsoft.Network/ipGroups/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "2c4f3240-95cc-402a-9ada-3ed0f9e3f27b",
"EventDataId": "13cd197d-db08-5c83-f36b-69204ce41039",
"EventSubmissionTimestamp": "2026-07-02T18:23:54.6089502Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/IPGROUPS/WRITE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/ipGroups/dwh2220afipgroups",
"message": "Microsoft.Network/ipGroups/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "13cd197d-db08-5c83-f36b-69204ce41039",
"eventSubmissionTimestamp": "2026-07-02T18:23:54.6089502Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afipgroups",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/ipGroups/dwh2220afipgroups",
"message": "Microsoft.Network/ipGroups/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "13cd197d-db08-5c83-f36b-69204ce41039",
"eventSubmissionTimestamp": "2026-07-02T18:23:54.6089502Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afipgroups",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/loadBalancers/backendAddressPools/delete
#Description
Deletes a load balancer backend address pool
Microsoft.Network/loadBalancers/backendAddressPools/health/action
#Description
Get Health Details of Backend Instance
Microsoft.Network/loadBalancers/backendAddressPools/join/action
#Description
Joins a load balancer backend address pool. Not Alertable.
Microsoft.Network/loadBalancers/backendAddressPools/queryInboundNatRulePortMapping/action
#Description
Query inbound Nat rule port mapping.
Microsoft.Network/loadBalancers/backendAddressPools/updateAdminState/action
#Description
Update AdminStates of backend addresses of a pool
Microsoft.Network/loadBalancers/backendAddressPools/write
#Description
Creates a load balancer backend address pool or updates an existing load balancer backend address pool
Microsoft.Network/loadBalancers/delete
#Description
Deletes a load balancer
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb",
"action": "Microsoft.Network/loadBalancers/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb",
"action": "Microsoft.Network/loadBalancers/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "edeb9d20-34e2-4456-bf07-2ac115cc7575",
"EventDataId": "9e228867-a50a-1cb8-8896-a8f304416bd3",
"EventSubmissionTimestamp": "2026-07-02T17:15:32.7659361Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/LOADBALANCERS/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb",
"message": "Microsoft.Network/loadBalancers/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "9e228867-a50a-1cb8-8896-a8f304416bd3",
"eventSubmissionTimestamp": "2026-07-02T17:15:32.7659361Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0lb",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb",
"message": "Microsoft.Network/loadBalancers/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "9e228867-a50a-1cb8-8896-a8f304416bd3",
"eventSubmissionTimestamp": "2026-07-02T17:15:32.7659361Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0lb",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action
#Description
Joins a Load Balancer Frontend IP Configuration. Not alertable.
Microsoft.Network/loadBalancers/frontendIPConfigurations/loadBalancerPools/delete
#Description
Deletes a load balancer frontend IP address backend pool
Microsoft.Network/loadBalancers/frontendIPConfigurations/loadBalancerPools/join/action
#Description
Joins a load balancer frontend IP address backend pool. Not alertable.
Microsoft.Network/loadBalancers/frontendIPConfigurations/loadBalancerPools/write
#Description
Creates a load balancer frontend IP address backend pool or updates an existing public IP Address load balancer backend pool
Microsoft.Network/loadBalancers/health/action
#Description
Get Health Summary of Load Balancer
Microsoft.Network/loadBalancers/inboundNatPools/join/action
#Description
Joins a load balancer inbound NAT pool. Not alertable.
Microsoft.Network/loadBalancers/inboundNatRules/delete
#Description
Deletes a load balancer inbound nat rule
Microsoft.Network/loadBalancers/inboundNatRules/join/action
#Description
Joins a load balancer inbound nat rule. Not Alertable.
Microsoft.Network/loadBalancers/inboundNatRules/write
#Description
Creates a load balancer inbound nat rule or updates an existing load balancer inbound nat rule
Microsoft.Network/loadBalancers/loadBalancingRules/health/action
#Description
Get Health Details of Load Balancing Rule
Microsoft.Network/loadBalancers/migrateToIpBased/action
#Description
Migrate from NIC based to IP based Load Balancer
Microsoft.Network/loadBalancers/probes/join/action
#Description
Allows using probes of a load balancer. For example, with this permission healthProbe property of VM scale set can reference the probe. Not alertable.
Microsoft.Network/loadBalancers/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates the Load Balancer Diagnostic Settings
Microsoft.Network/loadBalancers/write
#Description
Creates a load balancer or updates an existing load balancer
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"ActivitySubstatusValue": "Created",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb",
"action": "Microsoft.Network/loadBalancers/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb",
"action": "Microsoft.Network/loadBalancers/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "5d3baa24-50b6-485f-a362-6bf7e31874fc",
"EventDataId": "9939e218-cdf0-3f77-c1f7-2a820a34bfdf",
"EventSubmissionTimestamp": "2026-07-02T17:15:02.4099981Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/LOADBALANCERS/WRITE",
"Properties": {
"statusCode": "Created",
"serviceRequestId": "",
"responseBody": {
"name": "dwh92eef0lb",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb",
"etag": "W/\"96153c78-7d38-4776-b5f9-b2f5575cf62f\"",
"type": "Microsoft.Network/loadBalancers",
"location": "westus2",
"tags": "******",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "9797790d-900c-4ef8-95e7-e498c0079cfc",
"frontendIPConfigurations": [
{
"name": "LoadBalancerFrontEnd",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb/frontendIPConfigurations/LoadBalancerFrontEnd",
"etag": "W/\"96153c78-7d38-4776-b5f9-b2f5575cf62f\"",
"type": "Microsoft.Network/loadBalancers/frontendIPConfigurations",
"properties": {
"provisioningState": "Succeeded",
"privateIPAllocationMethod": "Dynamic",
"publicIPAddress": {
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPAddresses/PublicIPdwh92eef0lb"
}
}
}
],
"backendAddressPools": [
{
"name": "dwh92eef0lbbepool",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb/backendAddressPools/dwh92eef0lbbepool",
"etag": "W/\"96153c78-7d38-4776-b5f9-b2f5575cf62f\"",
"properties": {
"provisioningState": "Succeeded",
"loadBalancerBackendAddresses": []
},
"type": "Microsoft.Network/loadBalancers/backendAddressPools"
}
],
"loadBalancingRules": [],
"probes": [],
"inboundNatRules": [],
"outboundRules": [],
"inboundNatPools": []
},
"sku": {
"name": "Standard",
"tier": "Regional"
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb",
"message": "Microsoft.Network/loadBalancers/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "9939e218-cdf0-3f77-c1f7-2a820a34bfdf",
"eventSubmissionTimestamp": "2026-07-02T17:15:02.4099981Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0lb",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"activitySubstatusValue": "Created"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb",
"message": "Microsoft.Network/loadBalancers/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "9939e218-cdf0-3f77-c1f7-2a820a34bfdf",
"eventSubmissionTimestamp": "2026-07-02T17:15:02.4099981Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0lb",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"statusCode": "Created",
"serviceRequestId": "",
"activitySubstatusValue": "Created",
"responseBody": {
"name": "dwh92eef0lb",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb",
"etag": "W/\"96153c78-7d38-4776-b5f9-b2f5575cf62f\"",
"type": "Microsoft.Network/loadBalancers",
"location": "westus2",
"tags": "******",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "9797790d-900c-4ef8-95e7-e498c0079cfc",
"frontendIPConfigurations": [
{
"name": "LoadBalancerFrontEnd",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb/frontendIPConfigurations/LoadBalancerFrontEnd",
"etag": "W/\"96153c78-7d38-4776-b5f9-b2f5575cf62f\"",
"type": "Microsoft.Network/loadBalancers/frontendIPConfigurations",
"properties": {
"provisioningState": "Succeeded",
"privateIPAllocationMethod": "Dynamic",
"publicIPAddress": {
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPAddresses/PublicIPdwh92eef0lb"
}
}
}
],
"backendAddressPools": [
{
"name": "dwh92eef0lbbepool",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/loadBalancers/dwh92eef0lb/backendAddressPools/dwh92eef0lbbepool",
"etag": "W/\"96153c78-7d38-4776-b5f9-b2f5575cf62f\"",
"properties": {
"provisioningState": "Succeeded",
"loadBalancerBackendAddresses": []
},
"type": "Microsoft.Network/loadBalancers/backendAddressPools"
}
],
"loadBalancingRules": [],
"probes": [],
"inboundNatRules": [],
"outboundRules": [],
"inboundNatPools": []
},
"sku": {
"name": "Standard",
"tier": "Regional"
}
}
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/localnetworkgateways/delete
#Description
Deletes LocalNetworkGateway
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"ActivitySubstatusValue": "NoContent",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/localNetworkGateways/dwh2220aflocalnetworkga",
"action": "Microsoft.Network/localNetworkGateways/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/localNetworkGateways/dwh2220aflocalnetworkga",
"action": "Microsoft.Network/localNetworkGateways/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "e77cc504-0270-4752-a867-d4d0a3c5d8dc",
"EventDataId": "1b64d4b7-0eea-11af-328a-0eda4b13cb2d",
"EventSubmissionTimestamp": "2026-07-02T18:23:50.5406819Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/LOCALNETWORKGATEWAYS/DELETE",
"Properties": {
"statusCode": "NoContent",
"serviceRequestId": "",
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/localNetworkGateways/dwh2220aflocalnetworkga",
"message": "Microsoft.Network/localNetworkGateways/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "1b64d4b7-0eea-11af-328a-0eda4b13cb2d",
"eventSubmissionTimestamp": "2026-07-02T18:23:50.5406819Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220aflocalnetworkga",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"activitySubstatusValue": "NoContent"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/localNetworkGateways/dwh2220aflocalnetworkga",
"message": "Microsoft.Network/localNetworkGateways/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "1b64d4b7-0eea-11af-328a-0eda4b13cb2d",
"eventSubmissionTimestamp": "2026-07-02T18:23:50.5406819Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220aflocalnetworkga",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"statusCode": "NoContent",
"serviceRequestId": "",
"activitySubstatusValue": "NoContent"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/localnetworkgateways/write
#Description
Creates or updates an existing LocalNetworkGateway
Example Resource Log Record #
{
"ActivityStatusValue": "Failure",
"ActivitySubstatusValue": "BadRequest",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/localNetworkGateways/dwh2220aflocalnetworkga",
"action": "Microsoft.Network/localNetworkGateways/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/localNetworkGateways/dwh2220aflocalnetworkga",
"action": "Microsoft.Network/localNetworkGateways/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "7c76074f-57ae-4586-96cc-1ebd43fd70e2",
"EventDataId": "55113cf6-39b9-e96b-6509-fba7c592d875",
"EventSubmissionTimestamp": "2026-07-02T18:23:48.8773102Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Error",
"OperationNameValue": "MICROSOFT.NETWORK/LOCALNETWORKGATEWAYS/WRITE",
"Properties": {
"statusCode": "BadRequest",
"serviceRequestId": "",
"statusMessage": {
"error": {
"code": "LocalNetworkGatewayCannotHaveEmptyAddressPrefixAndBgpSettings",
"message": "The local network gateway /subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/localNetworkGateways/dwh2220aflocalnetworkga cannot have both empty address prefix and empty BGP Settings.",
"details": []
}
},
"responseBody": {
"error": {
"code": "LocalNetworkGatewayCannotHaveEmptyAddressPrefixAndBgpSettings",
"message": "The local network gateway /subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/localNetworkGateways/dwh2220aflocalnetworkga cannot have both empty address prefix and empty BGP Settings.",
"details": []
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/localNetworkGateways/dwh2220aflocalnetworkga",
"message": "Microsoft.Network/localNetworkGateways/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "55113cf6-39b9-e96b-6509-fba7c592d875",
"eventSubmissionTimestamp": "2026-07-02T18:23:48.8773102Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220aflocalnetworkga",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Failure",
"activitySubstatusValue": "BadRequest"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/localNetworkGateways/dwh2220aflocalnetworkga",
"message": "Microsoft.Network/localNetworkGateways/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "55113cf6-39b9-e96b-6509-fba7c592d875",
"eventSubmissionTimestamp": "2026-07-02T18:23:48.8773102Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220aflocalnetworkga",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Failure",
"statusCode": "BadRequest",
"serviceRequestId": "",
"activitySubstatusValue": "BadRequest",
"responseBody": {
"error": {
"code": "LocalNetworkGatewayCannotHaveEmptyAddressPrefixAndBgpSettings",
"message": "The local network gateway /subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/localNetworkGateways/dwh2220aflocalnetworkga cannot have both empty address prefix and empty BGP Settings.",
"details": []
}
},
"statusMessage": {
"error": {
"code": "LocalNetworkGatewayCannotHaveEmptyAddressPrefixAndBgpSettings",
"message": "The local network gateway /subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/localNetworkGateways/dwh2220aflocalnetworkga cannot have both empty address prefix and empty BGP Settings.",
"details": []
}
}
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/locations/bareMetalTenants/action
#Description
Allocates or validates a Bare Metal Tenant
Microsoft.Network/locations/batchNotifyPrivateEndpointsForResourceMove/action
#Description
Notifies to private endpoint in batches for resource move.
Microsoft.Network/locations/batchValidatePrivateEndpointsForResourceMove/action
#Description
Validates private endpoints in batches for resource move.
Microsoft.Network/locations/checkAcceleratedNetworkingSupport/action
#Description
Checks Accelerated Networking support
Microsoft.Network/locations/checkPrivateLinkServiceVisibility/action
#Description
Checks Private Link Service Visibility
Microsoft.Network/locations/commitInternalAzureNetworkManagerConfiguration/action
#Description
Commits Internal AzureNetworkManager Configuration In ANM
Microsoft.Network/locations/dataTasks/run/action
#Description
Runs Data Task
Microsoft.Network/locations/deletePacketTagging/action
#Description
Deletes Packet Tagging
Microsoft.Network/locations/effectiveResourceOwnership/action
#Description
Gets Effective Resource Ownership
Microsoft.Network/locations/getAzureNetworkManagerConfiguration/action
#Description
Gets Azure Network Manager Configuration
Microsoft.Network/locations/getPacketTagging/action
#Description
Gets Packet Tagging
Microsoft.Network/locations/internalAzureVirtualNetworkManagerOperation/action
#Description
Internal AzureVirtualNetworkManager Operation In ANM
Microsoft.Network/locations/privateLinkServices/privateEndpointConnectionProxies/delete
#Description
Deletes an private endpoint connection proxy resource.
Microsoft.Network/locations/privateLinkServices/privateEndpointConnectionProxies/write
#Description
Creates a new private endpoint connection proxy, or updates an existing private endpoint connection proxy.
Microsoft.Network/locations/publicIPAddresses/cleanupDdppReference/action
#Description
Cleanup DDPP reference on linked PublicIP upon DDPP subscription delete
Microsoft.Network/locations/publishResources/action
#Description
Publish Subscrioption Resources
Microsoft.Network/locations/PutResourcePubsubData/action
#Description
Put Resource PubSub Data
Microsoft.Network/locations/queryNetworkSecurityPerimeter/action
#Description
Queries Network Security Perimeter by the perimeter GUID
Microsoft.Network/locations/rnmEffectiveNetworkSecurityGroups/action
#Description
Gets Effective Security Groups Configured In Rnm Format
Microsoft.Network/locations/rnmEffectiveRouteTable/action
#Description
Gets Effective Routes Configured In Rnm Format
Microsoft.Network/locations/setAzureNetworkManagerConfiguration/action
#Description
Sets Azure Network Manager Configuration
Microsoft.Network/locations/setLbBackendAdminState/action
#Description
Sets admin state for load balancer backend addresses associated with the specified virtual machines or VM scale set instances
Microsoft.Network/locations/setLoadBalancerFrontendPublicIpAddresses/action
#Description
SetLoadBalancerFrontendPublicIpAddresses targets frontend IP configurations of 2 load balancers. Azure Resource Manager IDs of the IP configurations are provided in the body of the request.
Microsoft.Network/locations/setResourceOwnership/action
#Description
Sets Resource Ownership
Microsoft.Network/locations/startPacketTagging/action
#Description
Starts Packet Tagging
Microsoft.Network/locations/validateResourceOwnership/action
#Description
Validates Resource Ownership
Microsoft.Network/locations/virtualNetworks/cleanupDdppReference/action
#Description
Cleanup DDPP reference on linked VNET upon DDPP subscription delete
Microsoft.Network/masterCustomIpPrefixes/delete
#Description
Deletes A Master Custom Ip Prefix
Microsoft.Network/masterCustomIpPrefixes/write
#Description
Creates A Master Custom Ip Prefix Or Updates An Existing Master Custom Ip Prefix
Microsoft.Network/natGateways/delete
#Description
Delete Nat Gateway
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/natGateways/dwh92eef0natgw",
"action": "Microsoft.Network/natGateways/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/natGateways/dwh92eef0natgw",
"action": "Microsoft.Network/natGateways/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "30ff168e-dd16-49b2-9cd2-ba17f24e4f8f",
"EventDataId": "88e851b3-0d72-d74c-a936-84f980144490",
"EventSubmissionTimestamp": "2026-07-02T17:15:50.4312515Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/NATGATEWAYS/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/natGateways/dwh92eef0natgw",
"message": "Microsoft.Network/natGateways/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "88e851b3-0d72-d74c-a936-84f980144490",
"eventSubmissionTimestamp": "2026-07-02T17:15:50.4312515Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0natgw",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/natGateways/dwh92eef0natgw",
"message": "Microsoft.Network/natGateways/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "88e851b3-0d72-d74c-a936-84f980144490",
"eventSubmissionTimestamp": "2026-07-02T17:15:50.4312515Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0natgw",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/natGateways/join/action
#Description
Joins a NAT Gateway
Microsoft.Network/natGateways/write
#Description
Creates or Updates a Nat Gateway
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/natGateways/dwh92eef0natgw",
"action": "Microsoft.Network/natGateways/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/natGateways/dwh92eef0natgw",
"action": "Microsoft.Network/natGateways/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "c564e384-da2f-46c4-9e09-9e2c5fde0ac7",
"EventDataId": "7b82c5ea-c29f-816a-483e-1984f15f63ec",
"EventSubmissionTimestamp": "2026-07-02T17:15:44.4885532Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/NATGATEWAYS/WRITE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/natGateways/dwh92eef0natgw",
"message": "Microsoft.Network/natGateways/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "7b82c5ea-c29f-816a-483e-1984f15f63ec",
"eventSubmissionTimestamp": "2026-07-02T17:15:44.4885532Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0natgw",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/natGateways/dwh92eef0natgw",
"message": "Microsoft.Network/natGateways/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "7b82c5ea-c29f-816a-483e-1984f15f63ec",
"eventSubmissionTimestamp": "2026-07-02T17:15:44.4885532Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0natgw",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/networkExperimentProfiles/delete
#Description
Delete an Internet Analyzer profile
Microsoft.Network/networkExperimentProfiles/experiments/delete
#Description
Delete an Internet Analyzer test
Microsoft.Network/networkExperimentProfiles/experiments/latencyScorecard/action
#Description
Get an Internet Analyzer test's latency scorecard
Microsoft.Network/networkExperimentProfiles/experiments/timeseries/action
#Description
Get an Internet Analyzer test's time series
Microsoft.Network/networkExperimentProfiles/experiments/write
#Description
Create or update an Internet Analyzer test
Microsoft.Network/networkExperimentProfiles/write
#Description
Create or update an Internet Analyzer profile
Microsoft.Network/networkIntentPolicies/delete
#Description
Deletes an Network Intent Policy
Microsoft.Network/networkIntentPolicies/join/action
#Description
Joins a Network Intent Policy. Not alertable.
Microsoft.Network/networkIntentPolicies/write
#Description
Creates an Network Intent Policy or updates an existing Network Intent Policy
Microsoft.Network/networkInterfaces/delete
#Description
Deletes a network interface
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"ActivitySubstatusValue": "NoContent",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkInterfaces/dwh38d665vmVMNic",
"action": "Microsoft.Network/networkInterfaces/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkInterfaces/dwh38d665vmVMNic",
"action": "Microsoft.Network/networkInterfaces/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1785209876",
"nbf": "1785209876",
"exp": "1785215473",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAPURen4ovrhqDdFs0nhKRoSyF0GPVqO+JHPOsYdQPfzBZPUvCJEhxG5Ow/6nvUfqn2arqzvfadEGJHxGAKBILk0ph1H06195MJ99i9jv4ulIialxdbbi7QtnpHTxJggL9m/yPQGCll8eXrsZ1sRJgmg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMAAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "006ea83a-2932-54d9-1731-544dd799b8f0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "C7K3Vvx9ykO4R4sH5a0vAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "kW0jgyDmbcRP3yR_rNi-PYb4iTwIvzIzWcW9z_r3jRoBdXNlYXN0LWRzbXM",
"xms_idrel": "26 1",
"xms_sub_fct": "3 16",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1785209876",
"nbf": "1785209876",
"exp": "1785215473",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAPURen4ovrhqDdFs0nhKRoSyF0GPVqO+JHPOsYdQPfzBZPUvCJEhxG5Ow/6nvUfqn2arqzvfadEGJHxGAKBILk0ph1H06195MJ99i9jv4ulIialxdbbi7QtnpHTxJggL9m/yPQGCll8eXrsZ1sRJgmg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMAAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "006ea83a-2932-54d9-1731-544dd799b8f0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "C7K3Vvx9ykO4R4sH5a0vAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "kW0jgyDmbcRP3yR_rNi-PYb4iTwIvzIzWcW9z_r3jRoBdXNlYXN0LWRzbXM",
"xms_idrel": "26 1",
"xms_sub_fct": "3 16",
"xms_tcdt": "1768616282"
},
"CorrelationId": "a4d8e876-788e-4efc-831e-7562d2c12909",
"EventDataId": "8fd465d7-321b-e93f-ca4d-d9feef3c88bc",
"EventSubmissionTimestamp": "2026-07-28T04:14:08.3142549Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE",
"Properties": {
"statusCode": "NoContent",
"serviceRequestId": "",
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkInterfaces/dwh38d665vmVMNic",
"message": "Microsoft.Network/networkInterfaces/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "8fd465d7-321b-e93f-ca4d-d9feef3c88bc",
"eventSubmissionTimestamp": "2026-07-28T04:14:08.3142549Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh38d665vmvmnic",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"activitySubstatusValue": "NoContent"
},
"Properties_d": {
"statusCode": "NoContent",
"serviceRequestId": "",
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkInterfaces/dwh38d665vmVMNic",
"message": "Microsoft.Network/networkInterfaces/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "8fd465d7-321b-e93f-ca4d-d9feef3c88bc",
"eventSubmissionTimestamp": "2026-07-28T04:14:08.3142549Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh38d665vmvmnic",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"activitySubstatusValue": "NoContent"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action
#Description
Get Network Security Groups configured On Network Interface Of The Vm
Microsoft.Network/networkInterfaces/effectiveRouteTable/action
#Description
Get Route Table configured On Network Interface Of The Vm
Microsoft.Network/networkInterfaces/ipconfigurations/join/action
#Description
Joins a Network Interface IP Configuration. Not alertable.
Microsoft.Network/networkInterfaces/join/action
#Description
Joins a Virtual Machine to a network interface. Not Alertable.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/networkInterfaces/tapConfigurations/delete
#Description
Deletes a Network Interface Tap Configuration.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/networkInterfaces/tapConfigurations/write
#Description
Creates a Network Interface Tap Configuration or updates an existing Network Interface Tap Configuration.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/networkInterfaces/UpdateParentNicAttachmentOnElasticNic/action
#Description
Updates the parent NIC associated to the elastic NIC
Microsoft.Network/networkInterfaces/write
#Description
Creates a network interface or updates an existing network interface.
Example Resource Log Record #
{
"ActivityStatus": "",
"ActivityStatusValue": "Success",
"ActivitySubstatus": "",
"ActivitySubstatusValue": "Created",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/networkInterfaces/zcvmVMNic",
"action": "Microsoft.Network/networkInterfaces/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/networkInterfaces/zcvmVMNic",
"action": "Microsoft.Network/networkInterfaces/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"Category": "",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782752670",
"nbf": "1782752670",
"exp": "1782756583",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "3 5",
"xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
"xms_idrel": "1 2",
"xms_sub_fct": "2 3",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782752670",
"nbf": "1782752670",
"exp": "1782756583",
"aio": "REDACTED",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "REDACTED",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "3 5",
"xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
"xms_idrel": "1 2",
"xms_sub_fct": "2 3",
"xms_tcdt": "1768616282",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "9c77ebc7-44a9-4722-b0f8-0bc0db8411b4",
"EventDataId": "b55dc945-962c-8050-f3c4-53c4cd4a1410",
"EventSubmissionTimestamp": "2026-06-29T18:02:41.7946944Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationId": "",
"OperationName": "",
"OperationNameValue": "MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE",
"Properties": {
"statusCode": "Created",
"serviceRequestId": "",
"responseBody": {
"name": "zcvmVMNic",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkInterfaces/zcvmVMNic",
"etag": "W/\"7cf861b2-5206-4329-968b-a00a72f9dcd1\"",
"tags": "******",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "2a1f590b-c9ae-4e82-a861-64946830289f",
"ipConfigurations": [
{
"name": "ipconfigzcvm",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkInterfaces/zcvmVMNic/ipConfigurations/ipconfigzcvm",
"etag": "W/\"7cf861b2-5206-4329-968b-a00a72f9dcd1\"",
"type": "Microsoft.Network/networkInterfaces/ipConfigurations",
"properties": {
"provisioningState": "Succeeded",
"privateIPAddress": "10.42.1.4",
"privateIPAllocationMethod": "Dynamic",
"subnet": {
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/virtualNetworks/zcvnet/subnets/zcsub"
},
"primary": true
}
}
],
"dnsSettings": {
"dnsServers": [],
"appliedDnsServers": []
},
"enableIPForwarding": false
},
"type": "Microsoft.Network/networkInterfaces",
"location": "westus2"
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/networkInterfaces/zcvmVMNic",
"message": "Microsoft.Network/networkInterfaces/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "b55dc945-962c-8050-f3c4-53c4cd4a1410",
"eventSubmissionTimestamp": "2026-06-29T18:02:41.7946944Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcvmvmnic",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"activitySubstatusValue": "Created"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/networkInterfaces/zcvmVMNic",
"message": "Microsoft.Network/networkInterfaces/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "b55dc945-962c-8050-f3c4-53c4cd4a1410",
"eventSubmissionTimestamp": "2026-06-29T18:02:41.7946944Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcvmvmnic",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"statusCode": "Created",
"serviceRequestId": "",
"responseBody": {
"name": "zcvmVMNic",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkInterfaces/zcvmVMNic",
"etag": "W/\"7cf861b2-5206-4329-968b-a00a72f9dcd1\"",
"tags": "******",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "2a1f590b-c9ae-4e82-a861-64946830289f",
"ipConfigurations": [
{
"name": "ipconfigzcvm",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkInterfaces/zcvmVMNic/ipConfigurations/ipconfigzcvm",
"etag": "W/\"7cf861b2-5206-4329-968b-a00a72f9dcd1\"",
"type": "Microsoft.Network/networkInterfaces/ipConfigurations",
"properties": {
"provisioningState": "Succeeded",
"privateIPAddress": "10.42.1.4",
"privateIPAllocationMethod": "Dynamic",
"subnet": {
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/virtualNetworks/zcvnet/subnets/zcsub"
},
"primary": true
}
}
],
"dnsSettings": {
"dnsServers": [],
"appliedDnsServers": []
},
"enableIPForwarding": false
},
"type": "Microsoft.Network/networkInterfaces",
"location": "westus2"
},
"activitySubstatusValue": "Created"
},
"Resource": "",
"ResourceGroup": "RG-LOGCAPTURE-GEN",
"ResourceId": "",
"ResourceProvider": "",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SourceSystem": "Azure",
"SubscriptionId": "22222222-2222-2222-2222-222222222222",
"TenantId": "00000000-0000-0000-0000-000000000000",
"TimeGenerated": "2026-06-29T18:02:41.7946944Z",
"Type": "AzureActivity",
"_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.network/networkinterfaces/zcvmvmnic"
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/networkManagerConnections/delete
#Description
Delete Network Manager Connection
Microsoft.Network/networkManagerConnections/write
#Description
Create Or Update Network Manager Connection
Microsoft.Network/networkManagers/commit/action
#Description
Network Manager Commit
Microsoft.Network/networkManagers/connectivityConfigurations/delete
#Description
Delete Connectivity Configuration
Microsoft.Network/networkManagers/connectivityConfigurations/write
#Description
Create Or Update Connectivity Configuration
Microsoft.Network/networkManagers/delete
#Description
Delete Network Manager
Microsoft.Network/networkManagers/ipamPools/allocateAzureResource/action
#Description
Allocate CIDR range for Azure resource from Ipam Pool
Microsoft.Network/networkManagers/ipamPools/allocateNonAzureResource/action
#Description
Allocate CIDR range for non Azure resource from Ipam Pool
Microsoft.Network/networkManagers/ipamPools/allocateResourcePrefixes/action
#Description
Allocate CIDR Range for Resource from Ipam Pool
Microsoft.Network/networkManagers/ipamPools/associatedResources/action
#Description
Action permission for list Associated Resource To Ipam Pool
Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action
#Description
Action permission for associate resources to Ipam Pool
Microsoft.Network/networkManagers/ipamPools/delete
#Description
Deletes a Ipam Pool
Microsoft.Network/networkManagers/ipamPools/disassociateResourcesFromPool/action
#Description
Disassociate Azure resources (i.e. VNet) from Ipam Pool
Microsoft.Network/networkManagers/ipamPools/getPoolUsage/action
#Description
Get pool usage for a Ipam Pool
microsoft.network/networkmanagers/ipampools/listassociatedresources/action
#Description
Action permission for list Associated Resource To Ipam Pool
microsoft.network/networkmanagers/ipampools/staticcidrs/delete
#Description
Deletes a static CIDR from an Ipam Pool
microsoft.network/networkmanagers/ipampools/staticcidrs/write
#Description
Creates or updates a static CIDR in an Ipam Pool
Microsoft.Network/networkManagers/ipamPools/write
#Description
Creates or Updates a Ipam Pool
Microsoft.Network/networkManagers/listActiveConnectivityConfigurations/action
#Description
Lists Active Connectivity Configurations
Microsoft.Network/networkManagers/listActiveSecurityAdminRules/action
#Description
Lists Active Security Admin Rules
Microsoft.Network/networkManagers/listActiveSecurityUserRules/action
#Description
Lists Active Security User Rules
Microsoft.Network/networkManagers/listDeploymentStatus/action
#Description
List Deployment Status
Microsoft.Network/networkManagers/networkGroups/delete
#Description
Delete Network Group
Microsoft.Network/networkManagers/networkGroups/join/action
#Description
Join Network Group
Microsoft.Network/networkManagers/networkGroups/staticMembers/delete
#Description
Delete Network Group Static Member
Microsoft.Network/networkManagers/networkGroups/staticMembers/write
#Description
Create Or Update Network Group Static Member
Microsoft.Network/networkManagers/networkGroups/write
#Description
Create Or Update Network Group
Microsoft.Network/networkManagers/routingConfigurations/delete
#Description
Delete Routing Configuration
Microsoft.Network/networkManagers/routingConfigurations/ruleCollections/delete
#Description
Delete Routing Rule Collection
Microsoft.Network/networkManagers/routingConfigurations/ruleCollections/rules/delete
#Description
Delete Routing Rule
Microsoft.Network/networkManagers/routingConfigurations/ruleCollections/rules/write
#Description
Create Or Update Routing Rule
Microsoft.Network/networkManagers/routingConfigurations/ruleCollections/write
#Description
Create Or Update Routing Rule Collection
Microsoft.Network/networkManagers/routingConfigurations/write
#Description
Create Or Update Routing Configuration
Microsoft.Network/networkManagers/scopeConnections/delete
#Description
Delete Network Manager Scope Connection
Microsoft.Network/networkManagers/scopeConnections/write
#Description
Create Or Update Network Manager Scope Connection
Microsoft.Network/networkManagers/securityAdminConfigurations/delete
#Description
Delete Security Admin Configuration
Microsoft.Network/networkManagers/securityAdminConfigurations/ruleCollections/delete
#Description
Delete Security Admin Rule Collection
Microsoft.Network/networkManagers/securityAdminConfigurations/ruleCollections/rules/delete
#Description
Delete Security Admin Rule
Microsoft.Network/networkManagers/securityAdminConfigurations/ruleCollections/rules/write
#Description
Create Or Update Security Admin Rule
Microsoft.Network/networkManagers/securityAdminConfigurations/ruleCollections/write
#Description
Create Or Update Security Admin Rule Collection
Microsoft.Network/networkManagers/securityAdminConfigurations/write
#Description
Create Or Update Security Admin Configuration
Microsoft.Network/networkManagers/securityUserConfigurations/delete
#Description
Delete Security User Configuration
Microsoft.Network/networkManagers/securityUserConfigurations/ruleCollections/delete
#Description
Delete Security User Rule Collection
Microsoft.Network/networkManagers/securityUserConfigurations/ruleCollections/rules/delete
#Description
Delete Security User Rule
Microsoft.Network/networkManagers/securityUserConfigurations/ruleCollections/rules/write
#Description
Create Or Update Security User Rule
Microsoft.Network/networkManagers/securityUserConfigurations/ruleCollections/write
#Description
Create Or Update Security User Rule Collection
Microsoft.Network/networkManagers/securityUserConfigurations/write
#Description
Create Or Update Security User Configuration
Microsoft.Network/networkManagers/verifierWorkspaces/delete
#Description
Deletes a Verifier Workspace
Microsoft.Network/networkManagers/verifierWorkspaces/reachabilityAnalysisIntents/delete
#Description
Deletes a Reachability Analysis Intent
Microsoft.Network/networkManagers/verifierWorkspaces/reachabilityAnalysisIntents/write
#Description
Creates or Updates a Reachability Analysis Intent
Microsoft.Network/networkManagers/verifierWorkspaces/reachabilityAnalysisRuns/delete
#Description
Deletes a Reachability Analysis Run
Microsoft.Network/networkManagers/verifierWorkspaces/reachabilityAnalysisRuns/write
#Description
Creates or Updates a Reachability Analysis Run
Microsoft.Network/networkManagers/verifierWorkspaces/write
#Description
Creates or Updates a Verifier Workspace
Microsoft.Network/networkManagers/write
#Description
Create Or Update Network Manager
Microsoft.Network/networkProfiles/delete
#Description
Deletes a Network Profile
Microsoft.Network/networkProfiles/removeContainers/action
#Description
Removes Containers
Microsoft.Network/networkProfiles/setContainers/action
#Description
Sets Containers
Microsoft.Network/networkProfiles/setNetworkInterfaces/action
#Description
Sets Container Network Interfaces
Microsoft.Network/networkProfiles/write
#Description
Creates or updates a Network Profile
Microsoft.Network/networkSecurityGroups/delete
#Description
Deletes a network security group
Example Resource Log Record #
{
"ActivityStatus": "",
"ActivityStatusValue": "Success",
"ActivitySubstatus": "",
"ActivitySubstatusValue": "",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg",
"action": "Microsoft.Network/networkSecurityGroups/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg",
"action": "Microsoft.Network/networkSecurityGroups/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"Category": "",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782752670",
"nbf": "1782752670",
"exp": "1782756583",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "3 5",
"xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
"xms_idrel": "1 2",
"xms_sub_fct": "2 3",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782752670",
"nbf": "1782752670",
"exp": "1782756583",
"aio": "REDACTED",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "REDACTED",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "3 5",
"xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
"xms_idrel": "1 2",
"xms_sub_fct": "2 3",
"xms_tcdt": "1768616282",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "923e602a-81cf-4485-880c-0f72ae08f863",
"EventDataId": "8dad7bd8-c480-9d6c-08be-bf07b69c92d2",
"EventSubmissionTimestamp": "2026-06-29T17:46:28.2996691Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationId": "",
"OperationName": "",
"OperationNameValue": "MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg",
"message": "Microsoft.Network/networkSecurityGroups/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "8dad7bd8-c480-9d6c-08be-bf07b69c92d2",
"eventSubmissionTimestamp": "2026-06-29T17:46:28.2996691Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcnsg",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg",
"message": "Microsoft.Network/networkSecurityGroups/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "8dad7bd8-c480-9d6c-08be-bf07b69c92d2",
"eventSubmissionTimestamp": "2026-06-29T17:46:28.2996691Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcnsg",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Resource": "",
"ResourceGroup": "RG-LOGCAPTURE-GEN",
"ResourceId": "",
"ResourceProvider": "",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SourceSystem": "Azure",
"SubscriptionId": "22222222-2222-2222-2222-222222222222",
"TenantId": "00000000-0000-0000-0000-000000000000",
"TimeGenerated": "2026-06-29T17:46:28.2996691Z",
"Type": "AzureActivity",
"_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.network/networksecuritygroups/zcnsg"
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Panther #
T1485, T1562.007↳ also matches Microsoft.Network/networkSecurityGroups/join/action, Microsoft.Network/networksecuritygroups/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/networkSecurityGroups/securityRules/delete, Microsoft.Network/networkSecurityGroups/securityRules/write, Microsoft.Network/networkSecurityGroups/write
Microsoft.Network/networkSecurityGroups/join/action
#Description
Joins a network security group. Not Alertable.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Panther #
T1485, T1562.007↳ also matches Microsoft.Network/networkSecurityGroups/delete, Microsoft.Network/networksecuritygroups/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/networkSecurityGroups/securityRules/delete, Microsoft.Network/networkSecurityGroups/securityRules/write, Microsoft.Network/networkSecurityGroups/write
Microsoft.Network/networksecuritygroups/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates the Network Security Groups diagnostic settings, this operation is supplemented by insights resource provider.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Panther #
T1485, T1562.007↳ also matches Microsoft.Network/networkSecurityGroups/delete, Microsoft.Network/networkSecurityGroups/join/action, Microsoft.Network/networkSecurityGroups/securityRules/delete, Microsoft.Network/networkSecurityGroups/securityRules/write, Microsoft.Network/networkSecurityGroups/write
Microsoft.Network/networkSecurityGroups/securityRules/delete
#Description
Deletes a security rule
Example Resource Log Record #
{
"ActivityStatus": "",
"ActivityStatusValue": "Success",
"ActivitySubstatus": "",
"ActivitySubstatusValue": "",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg/securityRules/zcrule",
"action": "Microsoft.Network/networkSecurityGroups/securityRules/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg/securityRules/zcrule",
"action": "Microsoft.Network/networkSecurityGroups/securityRules/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"Category": "",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782752670",
"nbf": "1782752670",
"exp": "1782756583",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "3 5",
"xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
"xms_idrel": "1 2",
"xms_sub_fct": "2 3",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782752670",
"nbf": "1782752670",
"exp": "1782756583",
"aio": "REDACTED",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "REDACTED",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "3 5",
"xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
"xms_idrel": "1 2",
"xms_sub_fct": "2 3",
"xms_tcdt": "1768616282",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "f07893dd-4d47-44be-b28b-3f818ad7a04d",
"EventDataId": "403afd45-dbf2-707e-586e-8fc1dcd42392",
"EventSubmissionTimestamp": "2026-06-29T17:46:22.8046279Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationId": "",
"OperationName": "",
"OperationNameValue": "MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg/securityRules/zcrule",
"message": "Microsoft.Network/networkSecurityGroups/securityRules/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "403afd45-dbf2-707e-586e-8fc1dcd42392",
"eventSubmissionTimestamp": "2026-06-29T17:46:22.8046279Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcnsg/zcrule",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg/securityRules/zcrule",
"message": "Microsoft.Network/networkSecurityGroups/securityRules/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "403afd45-dbf2-707e-586e-8fc1dcd42392",
"eventSubmissionTimestamp": "2026-06-29T17:46:22.8046279Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcnsg/zcrule",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Resource": "",
"ResourceGroup": "RG-LOGCAPTURE-GEN",
"ResourceId": "",
"ResourceProvider": "",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SourceSystem": "Azure",
"SubscriptionId": "22222222-2222-2222-2222-222222222222",
"TenantId": "00000000-0000-0000-0000-000000000000",
"TimeGenerated": "2026-06-29T17:46:22.8046279Z",
"Type": "AzureActivity",
"_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.network/networksecuritygroups/zcnsg/securityrules/zcrule"
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Panther #
T1485, T1562.007↳ also matches Microsoft.Network/networkSecurityGroups/delete, Microsoft.Network/networkSecurityGroups/join/action, Microsoft.Network/networksecuritygroups/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/networkSecurityGroups/securityRules/write, Microsoft.Network/networkSecurityGroups/write
Microsoft.Network/networkSecurityGroups/securityRules/write
#Description
Creates a security rule or updates an existing security rule
Example Resource Log Record #
{
"ActivityStatus": "",
"ActivityStatusValue": "Accept",
"ActivitySubstatus": "",
"ActivitySubstatusValue": "Created",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/securityRules/r",
"action": "Microsoft.Network/networkSecurityGroups/securityRules/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/securityRules/r",
"action": "Microsoft.Network/networkSecurityGroups/securityRules/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"Category": "",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"CorrelationId": "061dfa78-b770-4f39-a0c4-e543b1b0f009",
"EventDataId": "72a0a514-bb8c-d5fb-6957-b5598f8c1e40",
"EventSubmissionTimestamp": "2026-06-29T19:02:05.0211795Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationId": "",
"OperationName": "",
"OperationNameValue": "MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE",
"Properties": {
"statusCode": "Created",
"serviceRequestId": "",
"responseBody": {
"name": "r",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/securityRules/r",
"etag": "W/\"38e0ff1e-4b96-46a7-b431-59f524ceefd8\"",
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"properties": {
"provisioningState": "Updating",
"protocol": "Tcp",
"sourcePortRange": "*",
"destinationPortRange": "22",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 100,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/securityRules/r",
"message": "Microsoft.Network/networkSecurityGroups/securityRules/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "72a0a514-bb8c-d5fb-6957-b5598f8c1e40",
"eventSubmissionTimestamp": "2026-06-29T19:02:05.0211795Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcnsg3/r",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Accept",
"activitySubstatusValue": "Created"
},
"Properties_d": {
"statusCode": "Created",
"serviceRequestId": "",
"responseBody": {
"name": "r",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/securityRules/r",
"etag": "W/\"38e0ff1e-4b96-46a7-b431-59f524ceefd8\"",
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"properties": {
"provisioningState": "Updating",
"protocol": "Tcp",
"sourcePortRange": "*",
"destinationPortRange": "22",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 100,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/securityRules/r",
"message": "Microsoft.Network/networkSecurityGroups/securityRules/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "72a0a514-bb8c-d5fb-6957-b5598f8c1e40",
"eventSubmissionTimestamp": "2026-06-29T19:02:05.0211795Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcnsg3/r",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Accept",
"activitySubstatusValue": "Created"
},
"Resource": "",
"ResourceGroup": "RG-LOGCAPTURE-GEN",
"ResourceId": "",
"ResourceProvider": "",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SourceSystem": "Azure",
"SubscriptionId": "22222222-2222-2222-2222-222222222222",
"TenantId": "00000000-0000-0000-0000-000000000000",
"TimeGenerated": "2026-06-29T19:02:05.0211795Z",
"Type": "AzureActivity",
"_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.network/networksecuritygroups/zcnsg3/securityrules/r"
}
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
properties.statusCode (sigma rule field) | eq | created | 1 rule | sigma |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Panther #
T1485, T1562.007↳ also matches Microsoft.Network/networkSecurityGroups/delete, Microsoft.Network/networkSecurityGroups/join/action, Microsoft.Network/networksecuritygroups/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/networkSecurityGroups/securityRules/delete, Microsoft.Network/networkSecurityGroups/write
Microsoft.Network/networkSecurityGroups/write
#Description
Creates a network security group or updates an existing network security group
Example Resource Log Record #
{
"ActivityStatus": "",
"ActivityStatusValue": "Accept",
"ActivitySubstatus": "",
"ActivitySubstatusValue": "Created",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3",
"action": "Microsoft.Network/networkSecurityGroups/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3",
"action": "Microsoft.Network/networkSecurityGroups/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"Category": "",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"CorrelationId": "23087631-d74f-41bd-afca-5c55c0747021",
"EventDataId": "304bd4d8-e4b4-9a35-966b-dda969e54996",
"EventSubmissionTimestamp": "2026-06-29T19:02:02.4492674Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationId": "",
"OperationName": "",
"OperationNameValue": "MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/WRITE",
"Properties": {
"statusCode": "Created",
"serviceRequestId": "",
"responseBody": {
"name": "zcnsg3",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups",
"location": "westus2",
"properties": {
"provisioningState": "Updating",
"resourceGuid": "5242775b-6ebd-40fa-a1d0-261184036c09",
"securityRules": [],
"defaultSecurityRules": [
{
"name": "AllowVnetInBound",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/defaultSecurityRules/AllowVnetInBound",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Allow inbound traffic from all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"destinationAddressPrefix": "VirtualNetwork",
"access": "Allow",
"priority": 65000,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowAzureLoadBalancerInBound",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/defaultSecurityRules/AllowAzureLoadBalancerInBound",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Allow inbound traffic from azure load balancer",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "AzureLoadBalancer",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 65001,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "DenyAllInBound",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/defaultSecurityRules/DenyAllInBound",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Deny all inbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Deny",
"priority": 65500,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowVnetOutBound",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/defaultSecurityRules/AllowVnetOutBound",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Allow outbound traffic from all VMs to all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"destinationAddressPrefix": "VirtualNetwork",
"access": "Allow",
"priority": 65000,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowInternetOutBound",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/defaultSecurityRules/AllowInternetOutBound",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Allow outbound traffic from all VMs to Internet",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "Internet",
"access": "Allow",
"priority": 65001,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "DenyAllOutBound",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/defaultSecurityRules/DenyAllOutBound",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Deny all outbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Deny",
"priority": 65500,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
]
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3",
"message": "Microsoft.Network/networkSecurityGroups/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "304bd4d8-e4b4-9a35-966b-dda969e54996",
"eventSubmissionTimestamp": "2026-06-29T19:02:02.4492674Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcnsg3",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Accept",
"activitySubstatusValue": "Created"
},
"Properties_d": {
"statusCode": "Created",
"serviceRequestId": "",
"responseBody": {
"name": "zcnsg3",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups",
"location": "westus2",
"properties": {
"provisioningState": "Updating",
"resourceGuid": "5242775b-6ebd-40fa-a1d0-261184036c09",
"securityRules": [],
"defaultSecurityRules": [
{
"name": "AllowVnetInBound",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/defaultSecurityRules/AllowVnetInBound",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Allow inbound traffic from all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"destinationAddressPrefix": "VirtualNetwork",
"access": "Allow",
"priority": 65000,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowAzureLoadBalancerInBound",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/defaultSecurityRules/AllowAzureLoadBalancerInBound",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Allow inbound traffic from azure load balancer",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "AzureLoadBalancer",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 65001,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "DenyAllInBound",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/defaultSecurityRules/DenyAllInBound",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Deny all inbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Deny",
"priority": 65500,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowVnetOutBound",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/defaultSecurityRules/AllowVnetOutBound",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Allow outbound traffic from all VMs to all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"destinationAddressPrefix": "VirtualNetwork",
"access": "Allow",
"priority": 65000,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowInternetOutBound",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/defaultSecurityRules/AllowInternetOutBound",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Allow outbound traffic from all VMs to Internet",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "Internet",
"access": "Allow",
"priority": 65001,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "DenyAllOutBound",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3/defaultSecurityRules/DenyAllOutBound",
"etag": "W/\"ba2ee45d-8e31-48e3-b005-1d2601d63c25\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Deny all outbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Deny",
"priority": 65500,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
]
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/networkSecurityGroups/zcnsg3",
"message": "Microsoft.Network/networkSecurityGroups/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "304bd4d8-e4b4-9a35-966b-dda969e54996",
"eventSubmissionTimestamp": "2026-06-29T19:02:02.4492674Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcnsg3",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Accept",
"activitySubstatusValue": "Created"
},
"Resource": "",
"ResourceGroup": "RG-LOGCAPTURE-GEN",
"ResourceId": "",
"ResourceProvider": "",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SourceSystem": "Azure",
"SubscriptionId": "22222222-2222-2222-2222-222222222222",
"TenantId": "00000000-0000-0000-0000-000000000000",
"TimeGenerated": "2026-06-29T19:02:02.4492674Z",
"Type": "AzureActivity",
"_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.network/networksecuritygroups/zcnsg3"
}
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
ActivityStatusValue (kusto rule field) | eq | success | 1 rule | kusto |
count_ (kusto rule field) | ge | 5 | 1 rule | kusto |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1003Panther #
T1485, T1562.007↳ also matches Microsoft.Network/networkSecurityGroups/delete, Microsoft.Network/networkSecurityGroups/join/action, Microsoft.Network/networksecuritygroups/providers/Microsoft.Insights/diagnosticSettings/write, Microsoft.Network/networkSecurityGroups/securityRules/delete, Microsoft.Network/networkSecurityGroups/securityRules/write
Microsoft.Network/networkSecurityPerimeters/backingResourceAssociations/delete
#Description
Deletes a Network Security Perimeter Backing Resource Association
Microsoft.Network/networkSecurityPerimeters/backingResourceAssociations/write
#Description
Creates or Updates a Network Security Perimeter Backing Resource Association
Microsoft.Network/networkSecurityPerimeters/delete
#Description
Deletes a Network Security Perimeter
Microsoft.Network/networkSecurityPerimeters/joinPerimeterRule/action
#Description
Joins an NSP Access Rule
Microsoft.Network/networkSecurityPerimeters/linkPerimeter/action
#Description
Link Perimeter in Auto-Approval mode
Microsoft.Network/networkSecurityPerimeters/linkProxies/write
#Description
Updates a Network Security Perimeter Link Proxy
Microsoft.Network/networkSecurityPerimeters/linkReferenceProxies/write
#Description
Creates or Updates a Network Security Perimeter LinkReference Proxy
Microsoft.Network/networkSecurityPerimeters/linkReferences/delete
#Description
Deletes a Network Security Perimeter LinkReference
Microsoft.Network/networkSecurityPerimeters/linkReferences/reconcile/action
#Description
Reconciles a Network Security Perimeter LinkReference
Microsoft.Network/networkSecurityPerimeters/linkReferences/write
#Description
Creates or Updates a Network Security Perimeter LinkReference
Microsoft.Network/networkSecurityPerimeters/links/delete
#Description
Deletes a Network Security Perimeter Link
Microsoft.Network/networkSecurityPerimeters/links/write
#Description
Creates or Updates a Network Security Perimeter Link
Microsoft.Network/networkSecurityPerimeters/loggingConfigurations/delete
#Description
Deletes a Network Security Perimeter Logging Configuration
Microsoft.Network/networkSecurityPerimeters/loggingConfigurations/write
#Description
Creates or Updates a Network Security Perimeter Logging Configuration
Microsoft.Network/networkSecurityPerimeters/profiles/accessRules/delete
#Description
Deletes a Network Security Perimeter Access Rule
Microsoft.Network/networkSecurityPerimeters/profiles/accessRules/write
#Description
Creates or Updates a Network Security Perimeter Access Rule
Microsoft.Network/networkSecurityPerimeters/profiles/checkMembers/action
#Description
Checks if members can be accessed or not
Microsoft.Network/networkSecurityPerimeters/profiles/delete
#Description
Deletes a Network Security Perimeter Profile
Microsoft.Network/networkSecurityPerimeters/profiles/join/action
#Description
Joins a Network Security Perimeter Profile
Microsoft.Network/networkSecurityPerimeters/profiles/write
#Description
Creates or Updates a Network Security Perimeter Profile
Microsoft.Network/networkSecurityPerimeters/resourceAssociationProxies/delete
#Description
Deletes a Network Security Perimeter Resource Association Proxy
Microsoft.Network/networkSecurityPerimeters/resourceAssociationProxies/write
#Description
Creates or Updates a Network Security Perimeter Resource Association Proxy
Microsoft.Network/networkSecurityPerimeters/resourceAssociations/delete
#Description
Deletes a Network Security Perimeter Resource Association
Microsoft.Network/networkSecurityPerimeters/resourceAssociations/write
#Description
Creates or Updates a Network Security Perimeter Resource Association
Microsoft.Network/networkSecurityPerimeters/write
#Description
Creates or Updates a Network Security Perimeter
Microsoft.Network/networkVerifiers/analysisIntents/analysisRuns/delete
#Description
Deletes a Analysis Run
Microsoft.Network/networkVerifiers/analysisIntents/analysisRuns/write
#Description
Creates or Updates a Analysis Run
Microsoft.Network/networkVerifiers/analysisIntents/delete
#Description
Deletes a Analysis Intent
Microsoft.Network/networkVerifiers/analysisIntents/write
#Description
Creates or Updates a Analysis Intent
Microsoft.Network/networkVerifiers/configurationSnapshots/delete
#Description
Deletes a Configuration Snapshot
Microsoft.Network/networkVerifiers/configurationSnapshots/write
#Description
Creates or Updates a Configuration Snapshot
Microsoft.Network/networkVerifiers/delete
#Description
Deletes a Network Verifier
Microsoft.Network/networkVerifiers/write
#Description
Creates or Updates a Network Verifier
Microsoft.Network/networkVirtualAppliances/delete
#Description
Delete a Network Virtual Appliance
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/networkVirtualAppliances/getBootDiagnosticLogs/action
#Description
Get Network Virtual Appliance Boot Diagnostic Logs
Microsoft.Network/networkVirtualAppliances/getDelegatedSubnets/action
#Description
Get Network Virtual Appliance delegated subnets
Microsoft.Network/networkVirtualAppliances/getVmssResourceId/action
#Description
Get VMSS Resource ID
Microsoft.Network/networkVirtualAppliances/inboundSecurityRules/delete
#Description
Delete a InboundSecurityRule
Microsoft.Network/networkVirtualAppliances/inboundSecurityRules/write
#Description
Create or update a InboundSecurityRule
Microsoft.Network/networkVirtualAppliances/networkVirtualApplianceConnections/delete
#Description
Delete a Network Virtual Appliance Connection
Microsoft.Network/networkVirtualAppliances/networkVirtualApplianceConnections/write
#Description
Update a Network Virtual Appliance Connection
Microsoft.Network/networkVirtualAppliances/reimage/action
#Description
Reimage Network Virtual Appliance
Microsoft.Network/networkVirtualAppliances/restart/action
#Description
Restart Network Virtual Appliance
Microsoft.Network/networkVirtualAppliances/write
#Description
Create or update a Network Virtual Appliance
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/networkWatchers/agents/delete
#Description
Deletes a Network Watcher Agent
Microsoft.Network/networkWatchers/agents/register/action
#Description
Registers a network watcher agent
Microsoft.Network/networkWatchers/agents/write
#Description
Creates a Network Watcher Agent
Microsoft.Network/networkWatchers/availableProvidersList/action
#Description
Returns all available internet service providers for a specified Azure region.
Microsoft.Network/networkWatchers/azureReachabilityReport/action
#Description
Returns the relative latency score for internet service providers from a specified location to Azure regions.
Microsoft.Network/networkWatchers/configureFlowLog/action
#Description
Configures flow logging for a target resource.
Microsoft.Network/networkWatchers/connectionAnalyzers/delete
#Description
Deletes a Connection Analyzer
Microsoft.Network/networkWatchers/connectionAnalyzers/queryStatus/action
#Description
Query status and details of Connection Analyzer
Microsoft.Network/networkWatchers/connectionAnalyzers/write
#Description
Creates a Connection Analyzer
Microsoft.Network/networkWatchers/connectionMonitors/delete
#Description
Deletes a Connection Monitor
Microsoft.Network/networkWatchers/connectionMonitors/query/action
#Description
Query monitoring connectivity between specified endpoints
Microsoft.Network/networkWatchers/connectionMonitors/start/action
#Description
Start monitoring connectivity between specified endpoints
Microsoft.Network/networkWatchers/connectionMonitors/stop/action
#Description
Stop/pause monitoring connectivity between specified endpoints
Microsoft.Network/networkWatchers/connectionMonitors/write
#Description
Creates a Connection Monitor
Microsoft.Network/networkWatchers/connectivityCheck/action
#Description
Verifies the possibility of establishing a direct TCP connection from a virtual machine to a given endpoint including another VM or an arbitrary remote server.
Microsoft.Network/networkWatchers/delete
#Description
Deletes a network watcher
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Elastic #
T1562, T1562.001, T1562.008Panther #
T1562.001
Microsoft.Network/networkWatchers/flowLogs/delete
#Description
Deletes a Flow Log
Microsoft.Network/networkWatchers/flowLogs/write
#Description
Creates a Flow Log
Microsoft.Network/networkWatchers/ipFlowVerify/action
#Description
Returns whether the packet is allowed or denied to or from a particular destination.
Microsoft.Network/networkWatchers/lenses/delete
#Description
Deletes a Lens
Microsoft.Network/networkWatchers/lenses/query/action
#Description
Query monitoring network traffic on a specified endpoint
Microsoft.Network/networkWatchers/lenses/start/action
#Description
Start monitoring network traffic on a specified endpoint
Microsoft.Network/networkWatchers/lenses/stop/action
#Description
Stop/pause monitoring network traffic on a specified endpoint
Microsoft.Network/networkWatchers/lenses/write
#Description
Creates a Lens
Microsoft.Network/networkWatchers/networkConfigurationDiagnostic/action
#Description
Diagnostic of network configuration.
Microsoft.Network/networkWatchers/nextHop/action
#Description
For a specified target and destination IP address, return the next hop type and next hope IP address.
Microsoft.Network/networkWatchers/packetCaptures/delete
#Description
Deletes a packet capture
Microsoft.Network/networkWatchers/packetCaptures/queryStatus/action
#Description
Gets information about properties and status of a packet capture resource.
Microsoft.Network/networkWatchers/packetCaptures/stop/action
#Description
Stop the running packet capture session.
Microsoft.Network/networkWatchers/packetCaptures/write
#Description
Creates a packet capture
Microsoft.Network/networkWatchers/pingMeshes/delete
#Description
Deletes a PingMesh
Microsoft.Network/networkWatchers/pingMeshes/start/action
#Description
Start PingMesh between specified VMs
Microsoft.Network/networkWatchers/pingMeshes/stop/action
#Description
Stop PingMesh between specified VMs
Microsoft.Network/networkWatchers/pingMeshes/write
#Description
Creates a PingMesh
Microsoft.Network/networkWatchers/queryConnectionMonitors/action
#Description
Batch query monitoring connectivity between specified endpoints
Microsoft.Network/networkWatchers/queryFlowLogStatus/action
#Description
Gets the status of flow logging on a resource.
Microsoft.Network/networkWatchers/queryTroubleshootResult/action
#Description
Gets the troubleshooting result from the previously run or currently running troubleshooting operation.
Microsoft.Network/networkWatchers/securityGroupView/action
#Description
View the configured and effective network security group rules applied on a VM.
Microsoft.Network/networkWatchers/topology/action
#Description
Gets a network level view of resources and their relationships in a resource group.
Microsoft.Network/networkWatchers/troubleshoot/action
#Description
Starts troubleshooting on a Networking resource in Azure.
Microsoft.Network/networkWatchers/write
#Description
Creates a network watcher or updates an existing network watcher
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_westus2",
"action": "Microsoft.Network/networkWatchers/write",
"evidence": {
"role": "Azure Network Service Role",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "38b9f786807649bfbf92c21363fec2de",
"roleDefinitionId": "13ba9ab419f04804adc414ece36cc7a1",
"principalId": "d098cd85ed3e43b69a78b60191430ddc",
"principalType": "ServicePrincipal"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_westus2",
"action": "Microsoft.Network/networkWatchers/write",
"evidence": {
"role": "Azure Network Service Role",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "38b9f786807649bfbf92c21363fec2de",
"roleDefinitionId": "13ba9ab419f04804adc414ece36cc7a1",
"principalId": "d098cd85ed3e43b69a78b60191430ddc",
"principalType": "ServicePrincipal"
}
},
"Caller": "d098cd85-ed3e-43b6-9a78-b60191430ddc",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783010170",
"nbf": "1783010170",
"exp": "1783096870",
"aio": "AWQAm/8cAAAALWXjr80jLidYYy7jxMvwaUgLnQeu2nlRoMlfP7wsLMixVBp1ahfl4H10iVDIoD4sAPF3pUoQNE/fAd0OWIxST45MLJqPVVnXJloghpnL2Fvt7imY27kF1NSLX/wQmnhR",
"appid": "2cf9eb86-36b5-49dc-86ae-9a63135dfa8c",
"appidacr": "2",
"http://schemas.microsoft.com/identity/claims/identityprovider": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"idtyp": "app",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "d098cd85-ed3e-43b6-9a78-b60191430ddc",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMAAAB4AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "d098cd85-ed3e-43b6-9a78-b60191430ddc",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "nFS1_m6hnEWAUpisX9oBAA",
"ver": "1.0",
"wids": "0997a1d0-0d1d-4acb-b408-d5ca73121e90",
"xms_act_fct": "3 5",
"xms_ftd": "G5gfOS6YvVGOXxIkm_H11GABlyggo_3qb8vLbgD-9fMBdXN3ZXN0Mi1kc21z",
"xms_idrel": "7 24",
"xms_rd": "0.AW8AkP8KBQgCEgF4EhQICRIQUQFaCpTCQkKUJ3vGiHYN9RIUCAgSEEZIf3kAutdPukPawfj2MBMSFAgLEhCYgW0cJgvBfjFe1LpxvGqHIiQIAxIgYOS2w9wccSIvDSWXhRUYJrVHaMGNSgWx6gEjn6L-6bM",
"xms_sub_fct": "3 5",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783010170",
"nbf": "1783010170",
"exp": "1783096870",
"aio": "AWQAm/8cAAAALWXjr80jLidYYy7jxMvwaUgLnQeu2nlRoMlfP7wsLMixVBp1ahfl4H10iVDIoD4sAPF3pUoQNE/fAd0OWIxST45MLJqPVVnXJloghpnL2Fvt7imY27kF1NSLX/wQmnhR",
"appid": "2cf9eb86-36b5-49dc-86ae-9a63135dfa8c",
"appidacr": "2",
"http://schemas.microsoft.com/identity/claims/identityprovider": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"idtyp": "app",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "d098cd85-ed3e-43b6-9a78-b60191430ddc",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMAAAB4AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "d098cd85-ed3e-43b6-9a78-b60191430ddc",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "nFS1_m6hnEWAUpisX9oBAA",
"ver": "1.0",
"wids": "0997a1d0-0d1d-4acb-b408-d5ca73121e90",
"xms_act_fct": "3 5",
"xms_ftd": "G5gfOS6YvVGOXxIkm_H11GABlyggo_3qb8vLbgD-9fMBdXN3ZXN0Mi1kc21z",
"xms_idrel": "7 24",
"xms_rd": "0.AW8AkP8KBQgCEgF4EhQICRIQUQFaCpTCQkKUJ3vGiHYN9RIUCAgSEEZIf3kAutdPukPawfj2MBMSFAgLEhCYgW0cJgvBfjFe1LpxvGqHIiQIAxIgYOS2w9wccSIvDSWXhRUYJrVHaMGNSgWx6gEjn6L-6bM",
"xms_sub_fct": "3 5",
"xms_tcdt": "1768616282"
},
"CorrelationId": "553b3774-fc41-43a8-9e7e-21683a474470",
"EventDataId": "9e929ced-fba9-ba74-2ff8-8dd79e6e56ac",
"EventSubmissionTimestamp": "2026-07-02T17:24:29.1328514Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/NETWORKWATCHERS/WRITE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_westus2",
"message": "Microsoft.Network/networkWatchers/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "d098cd85-ed3e-43b6-9a78-b60191430ddc",
"eventDataId": "9e929ced-fba9-ba74-2ff8-8dd79e6e56ac",
"eventSubmissionTimestamp": "2026-07-02T17:24:29.1328514Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "networkwatcher_westus2",
"resourceGroup": "NETWORKWATCHERRG",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_westus2",
"message": "Microsoft.Network/networkWatchers/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "d098cd85-ed3e-43b6-9a78-b60191430ddc",
"eventDataId": "9e929ced-fba9-ba74-2ff8-8dd79e6e56ac",
"eventSubmissionTimestamp": "2026-07-02T17:24:29.1328514Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "networkwatcher_westus2",
"resourceGroup": "NETWORKWATCHERRG",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "NETWORKWATCHERRG",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
microsoft.network/p2sVpnGateways/attach/action
#Description
Attaches a P2SVpnGateway Hub from WAN Traffic manager
Microsoft.Network/p2sVpnGateways/delete
#Description
Deletes a P2SVpnGateway.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
microsoft.network/p2sVpnGateways/detach/action
#Description
Detaches a P2SVpnGateway Hub from WAN Traffic manager
Microsoft.Network/p2sVpnGateways/disconnectp2svpnconnections/action
#Description
Disconnect p2s vpn connections
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/p2sVpnGateways/generatevpnprofile/action
#Description
Generate Vpn Profile for P2SVpnGateway
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/p2sVpnGateways/getp2svpnconnectionhealth/action
#Description
Gets a P2S Vpn Connection health for P2SVpnGateway
Microsoft.Network/p2sVpnGateways/getp2svpnconnectionhealthdetailed/action
#Description
Gets a P2S Vpn Connection health detailed for P2SVpnGateway
Microsoft.Network/p2sVpnGateways/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates the P2S Vpn Gateway diagnostic settings, this operation is supplemented by insights resource provider.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
microsoft.network/p2sVpnGateways/reset/action
#Description
Resets a P2SVpnGateway
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/p2sVpnGateways/write
#Description
Puts a P2SVpnGateway.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/privateDnsZones/A/delete
#Description
Remove the record set of a given name and type 'A' from a Private DNS zone.
Microsoft.Network/privateDnsZones/A/write
#Description
Create or update a record set of type 'A' within a Private DNS zone. The records specified will replace the current records in the record set.
Microsoft.Network/privateDnsZones/AAAA/delete
#Description
Remove the record set of a given name and type 'AAAA' from a Private DNS zone.
Microsoft.Network/privateDnsZones/AAAA/write
#Description
Create or update a record set of type 'AAAA' within a Private DNS zone. The records specified will replace the current records in the record set.
Microsoft.Network/privateDnsZones/CNAME/delete
#Description
Remove the record set of a given name and type 'CNAME' from a Private DNS zone.
Microsoft.Network/privateDnsZones/CNAME/write
#Description
Create or update a record set of type 'CNAME' within a Private DNS zone.
Microsoft.Network/privateDnsZones/delete
#Description
Delete a Private DNS zone.
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwh92eef0pdns.internal",
"action": "Microsoft.Network/privateDnsZones/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwh92eef0pdns.internal",
"action": "Microsoft.Network/privateDnsZones/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "bb6b2a37-c4a5-401a-8cfa-bf4d2525f8c6",
"EventDataId": "9bb4eab6-dd8f-2737-6f08-443d55ad74b5",
"EventSubmissionTimestamp": "2026-07-02T17:16:54.4218506Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/PRIVATEDNSZONES/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwh92eef0pdns.internal",
"message": "Microsoft.Network/privateDnsZones/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "9bb4eab6-dd8f-2737-6f08-443d55ad74b5",
"eventSubmissionTimestamp": "2026-07-02T17:16:54.4218506Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0pdns.internal",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwh92eef0pdns.internal",
"message": "Microsoft.Network/privateDnsZones/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "9bb4eab6-dd8f-2737-6f08-443d55ad74b5",
"eventSubmissionTimestamp": "2026-07-02T17:16:54.4218506Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0pdns.internal",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/privateDnsZones/join/action
#Description
Joins a Private DNS Zone
Microsoft.Network/privateDnsZones/MX/delete
#Description
Remove the record set of a given name and type 'MX' from a Private DNS zone.
Microsoft.Network/privateDnsZones/MX/write
#Description
Create or update a record set of type 'MX' within a Private DNS zone. The records specified will replace the current records in the record set.
Microsoft.Network/privateDnsZones/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates the Private DNS zone diagnostic settings
Microsoft.Network/privateDnsZones/PTR/delete
#Description
Remove the record set of a given name and type 'PTR' from a Private DNS zone.
Microsoft.Network/privateDnsZones/PTR/write
#Description
Create or update a record set of type 'PTR' within a Private DNS zone. The records specified will replace the current records in the record set.
Microsoft.Network/privateDnsZones/SOA/write
#Description
Update a record set of type 'SOA' within a Private DNS zone.
Microsoft.Network/privateDnsZones/SRV/delete
#Description
Remove the record set of a given name and type 'SRV' from a Private DNS zone.
Microsoft.Network/privateDnsZones/SRV/write
#Description
Create or update a record set of type 'SRV' within a Private DNS zone. The records specified will replace the current records in the record set.
Microsoft.Network/privateDnsZones/TXT/delete
#Description
Remove the record set of a given name and type 'TXT' from a Private DNS zone.
Microsoft.Network/privateDnsZones/TXT/write
#Description
Create or update a record set of type 'TXT' within a Private DNS zone. The records specified will replace the current records in the record set.
Microsoft.Network/privateDnsZones/virtualNetworkLinks/delete
#Description
Delete a Private DNS zone link to virtual network.
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"ActivitySubstatusValue": "NoContent",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwhp3bbd4cpdz.internal/virtualNetworkLinks/dwhp3bbd4cpdl",
"action": "Microsoft.Network/privateDnsZones/virtualNetworkLinks/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwhp3bbd4cpdz.internal/virtualNetworkLinks/dwhp3bbd4cpdl",
"action": "Microsoft.Network/privateDnsZones/virtualNetworkLinks/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783041418",
"nbf": "1783041418",
"exp": "1783045937",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "tUdFU6nO4UmtUjpbHDqEAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783041418",
"nbf": "1783041418",
"exp": "1783045937",
"aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "tUdFU6nO4UmtUjpbHDqEAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "6ea61b2e-34c3-4280-a60b-5a0caa45bbd4",
"EventDataId": "dc340690-8c38-5c53-9a63-8cd4f2df344b",
"EventSubmissionTimestamp": "2026-07-03T01:48:59.0032411Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/PRIVATEDNSZONES/VIRTUALNETWORKLINKS/DELETE",
"Properties": {
"statusCode": "NoContent",
"serviceRequestId": "",
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwhp3bbd4cpdz.internal/virtualNetworkLinks/dwhp3bbd4cpdl",
"message": "Microsoft.Network/privateDnsZones/virtualNetworkLinks/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "dc340690-8c38-5c53-9a63-8cd4f2df344b",
"eventSubmissionTimestamp": "2026-07-03T01:48:59.0032411Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwhp3bbd4cpdz.internal/dwhp3bbd4cpdl",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"activitySubstatusValue": "NoContent"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwhp3bbd4cpdz.internal/virtualNetworkLinks/dwhp3bbd4cpdl",
"message": "Microsoft.Network/privateDnsZones/virtualNetworkLinks/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "dc340690-8c38-5c53-9a63-8cd4f2df344b",
"eventSubmissionTimestamp": "2026-07-03T01:48:59.0032411Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwhp3bbd4cpdz.internal/dwhp3bbd4cpdl",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"statusCode": "NoContent",
"serviceRequestId": "",
"activitySubstatusValue": "NoContent"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/privateDnsZones/virtualNetworkLinks/write
#Description
Create or update a Private DNS zone link to virtual network.
Example Resource Log Record #
{
"ActivityStatusValue": "Failure",
"ActivitySubstatusValue": "NotFound",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwhp3bbd4cpdz.internal/virtualNetworkLinks/dwhp3bbd4cpdl",
"action": "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwhp3bbd4cpdz.internal/virtualNetworkLinks/dwhp3bbd4cpdl",
"action": "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783041418",
"nbf": "1783041418",
"exp": "1783045937",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "tUdFU6nO4UmtUjpbHDqEAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783041418",
"nbf": "1783041418",
"exp": "1783045937",
"aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "tUdFU6nO4UmtUjpbHDqEAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "a3fd9f21-df7f-4f9e-8a07-5605cbe48eca",
"EventDataId": "df5d0155-50f0-4ba2-4d29-1ac22125d386",
"EventSubmissionTimestamp": "2026-07-03T01:48:57.0952751Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Error",
"OperationNameValue": "MICROSOFT.NETWORK/PRIVATEDNSZONES/VIRTUALNETWORKLINKS/WRITE",
"Properties": {
"statusCode": "NotFound",
"serviceRequestId": "",
"statusMessage": {
"error": {
"code": "ParentResourceNotFound",
"message": "Failed to perform 'write' on resource(s) of type 'privateDnsZones/virtualNetworkLinks', because the parent resource '/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwhp3bbd4cpdz.internal' could not be found."
}
},
"responseBody": {
"error": {
"code": "ParentResourceNotFound",
"message": "Failed to perform 'write' on resource(s) of type 'privateDnsZones/virtualNetworkLinks', because the parent resource '/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwhp3bbd4cpdz.internal' could not be found."
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwhp3bbd4cpdz.internal/virtualNetworkLinks/dwhp3bbd4cpdl",
"message": "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "df5d0155-50f0-4ba2-4d29-1ac22125d386",
"eventSubmissionTimestamp": "2026-07-03T01:48:57.0952751Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwhp3bbd4cpdz.internal/dwhp3bbd4cpdl",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Failure",
"activitySubstatusValue": "NotFound"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwhp3bbd4cpdz.internal/virtualNetworkLinks/dwhp3bbd4cpdl",
"message": "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "df5d0155-50f0-4ba2-4d29-1ac22125d386",
"eventSubmissionTimestamp": "2026-07-03T01:48:57.0952751Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwhp3bbd4cpdz.internal/dwhp3bbd4cpdl",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Failure",
"statusCode": "NotFound",
"serviceRequestId": "",
"activitySubstatusValue": "NotFound",
"responseBody": {
"error": {
"code": "ParentResourceNotFound",
"message": "Failed to perform 'write' on resource(s) of type 'privateDnsZones/virtualNetworkLinks', because the parent resource '/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwhp3bbd4cpdz.internal' could not be found."
}
},
"statusMessage": {
"error": {
"code": "ParentResourceNotFound",
"message": "Failed to perform 'write' on resource(s) of type 'privateDnsZones/virtualNetworkLinks', because the parent resource '/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwhp3bbd4cpdz.internal' could not be found."
}
}
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/privateDnsZones/write
#Description
Create or update a Private DNS zone within a resource group. Note that this command cannot be used to create or update virtual network links or record sets within the zone.
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwh92eef0pdns.internal",
"action": "Microsoft.Network/privateDnsZones/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwh92eef0pdns.internal",
"action": "Microsoft.Network/privateDnsZones/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "89b8c343-70ed-4374-aaae-902d907793d9",
"EventDataId": "c14aacb0-5715-70ad-f1d8-582d8d20bb72",
"EventSubmissionTimestamp": "2026-07-02T17:16:21.939653Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/PRIVATEDNSZONES/WRITE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwh92eef0pdns.internal",
"message": "Microsoft.Network/privateDnsZones/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "c14aacb0-5715-70ad-f1d8-582d8d20bb72",
"eventSubmissionTimestamp": "2026-07-02T17:16:21.939653Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0pdns.internal",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/privateDnsZones/dwh92eef0pdns.internal",
"message": "Microsoft.Network/privateDnsZones/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "c14aacb0-5715-70ad-f1d8-582d8d20bb72",
"eventSubmissionTimestamp": "2026-07-02T17:16:21.9396530Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0pdns.internal",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/privateDnsZonesInternal/action
#Description
Executes Private DNS Zones Internal APIs
Microsoft.Network/privateEndpointRedirectMaps/write
#Description
Creates Private Endpoint RedirectMap Or Updates An Existing Private Endpoint RedirectMap
Microsoft.Network/privateEndpoints/delete
#Description
Deletes an private endpoint resource.
Microsoft.Network/privateEndpoints/privateDnsZoneGroups/delete
#Description
Deletes a Private DNS Zone Group
Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write
#Description
Puts a Private DNS Zone Group
Microsoft.Network/privateEndpoints/privateLinkServiceProxies/delete
#Description
Deletes an private link service proxy resource.
Microsoft.Network/privateEndpoints/privateLinkServiceProxies/write
#Description
Creates a new private link service proxy, or updates an existing private link service proxy.
Microsoft.Network/privateEndpoints/pushPropertiesToResource/action
#Description
Operation to push private endpoint property updates from NRP client
Microsoft.Network/privateEndpoints/write
#Description
Creates a new private endpoint, or updates an existing private endpoint.
Microsoft.Network/privateLinkServices/delete
#Description
Deletes an private link service resource.
Microsoft.Network/privateLinkServices/notifyPrivateEndpointMove/action
#Description
Notifies a connected Private Link Service of Private Endpoint move
Microsoft.Network/privateLinkServices/privateEndpointConnectionProxies/delete
#Description
Deletes an private endpoint connection proxy resource.
Microsoft.Network/privateLinkServices/privateEndpointConnectionProxies/write
#Description
Creates a new private endpoint connection proxy, or updates an existing private endpoint connection proxy.
Microsoft.Network/privateLinkServices/privateEndpointConnections/delete
#Description
Deletes an private endpoint connection.
Microsoft.Network/privateLinkServices/privateEndpointConnections/write
#Description
Creates a new private endpoint connection, or updates an existing private endpoint connection.
Microsoft.Network/privateLinkServices/PrivateEndpointConnectionsApproval/action
#Description
Approve or reject PrivateEndpoint connection on PrivateLinkService
Microsoft.Network/privateLinkServices/write
#Description
Creates a new private link service, or updates an existing private link service.
Microsoft.Network/publicIPAddresses/ddosProtectionStatus/action
#Description
Gets the effective Ddos protection status for a Public IP Address resource.
Microsoft.Network/publicIPAddresses/delete
#Description
Deletes a public IP address.
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPAddresses/dwharn-pip-7000408c",
"action": "Microsoft.Network/publicIPAddresses/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPAddresses/dwharn-pip-7000408c",
"action": "Microsoft.Network/publicIPAddresses/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783008141",
"nbf": "1783008141",
"exp": "1783012267",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAA/aDiVwsbwk18GnYlWFKcBZb5UnBAQGny1deUBCpk1wvoaHC8c2/faUwhIvEz+jwqEuUDCPj+rYXDoVSb1JJf9R46RD6wFcSirzyy+XCnUul9/w/A8ltH8m9fyV37DTPYPQgVJ1Dy4Ln3oeVqMfWc/Q==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "joig862JV0W_vEH8aP97AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "MYmqIV5FdoWQjoUa-o05_qMtUfBKgIRMCe4pE3a1yrwBdXNub3J0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 8",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783008141",
"nbf": "1783008141",
"exp": "1783012267",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAA/aDiVwsbwk18GnYlWFKcBZb5UnBAQGny1deUBCpk1wvoaHC8c2/faUwhIvEz+jwqEuUDCPj+rYXDoVSb1JJf9R46RD6wFcSirzyy+XCnUul9/w/A8ltH8m9fyV37DTPYPQgVJ1Dy4Ln3oeVqMfWc/Q==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "joig862JV0W_vEH8aP97AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "MYmqIV5FdoWQjoUa-o05_qMtUfBKgIRMCe4pE3a1yrwBdXNub3J0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 8",
"xms_tcdt": "1768616282"
},
"CorrelationId": "1393de9f-0ca2-4666-a720-2e9f0f342331",
"EventDataId": "9c8ff064-01f8-6ebc-5e85-6c456da84ae8",
"EventSubmissionTimestamp": "2026-07-02T16:41:21.8745439Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/PUBLICIPADDRESSES/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPAddresses/dwharn-pip-7000408c",
"message": "Microsoft.Network/publicIPAddresses/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "9c8ff064-01f8-6ebc-5e85-6c456da84ae8",
"eventSubmissionTimestamp": "2026-07-02T16:41:21.8745439Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwharn-pip-7000408c",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPAddresses/dwharn-pip-7000408c",
"message": "Microsoft.Network/publicIPAddresses/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "9c8ff064-01f8-6ebc-5e85-6c456da84ae8",
"eventSubmissionTimestamp": "2026-07-02T16:41:21.8745439Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwharn-pip-7000408c",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/publicIPAddresses/dnsAliases/delete
#Description
Deletes a Public IP Address Dns Alias resource
Microsoft.Network/publicIPAddresses/dnsAliases/write
#Description
Creates a Public IP Address Dns Alias resource
Microsoft.Network/publicIPAddresses/join/action
#Description
Joins a public IP address. Not Alertable.
Microsoft.Network/publicIPAddresses/joinServiceEndpointNetworkIdentifier/action
#Description
Joins a Public Ip Address Service Endpoint Network Identifier
Microsoft.Network/publicIPAddresses/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Create or update the diagnostic settings of Public IP Address
Microsoft.Network/publicIPAddresses/write
#Description
Creates a public IP address or updates an existing public IP address.
Example Resource Log Record #
{
"ActivityStatus": "",
"ActivityStatusValue": "Accept",
"ActivitySubstatus": "",
"ActivitySubstatusValue": "Created",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPAddresses/zcpip3",
"action": "Microsoft.Network/publicIPAddresses/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPAddresses/zcpip3",
"action": "Microsoft.Network/publicIPAddresses/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"Category": "",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"CorrelationId": "5ac944fe-4c04-4b18-896f-bf7bbc81f9d8",
"EventDataId": "876605a6-5a7d-549d-303c-33141cf08253",
"EventSubmissionTimestamp": "2026-06-29T19:02:08.189945Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationId": "",
"OperationName": "",
"OperationNameValue": "MICROSOFT.NETWORK/PUBLICIPADDRESSES/WRITE",
"Properties": {
"statusCode": "Created",
"serviceRequestId": "",
"responseBody": {
"name": "zcpip3",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPAddresses/zcpip3",
"etag": "W/\"3c4f8075-7821-474d-8eae-bdfd61404158\"",
"location": "westus2",
"properties": {
"provisioningState": "Updating",
"resourceGuid": "580aea5d-bfff-4505-8a78-a64b2b20e260",
"publicIPAddressVersion": "IPv4",
"publicIPAllocationMethod": "Static",
"idleTimeoutInMinutes": 4,
"ipTags": [],
"ddosSettings": {
"protectionMode": "VirtualNetworkInherited"
}
},
"type": "Microsoft.Network/publicIPAddresses",
"sku": {
"name": "Standard",
"tier": "Regional"
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPAddresses/zcpip3",
"message": "Microsoft.Network/publicIPAddresses/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "876605a6-5a7d-549d-303c-33141cf08253",
"eventSubmissionTimestamp": "2026-06-29T19:02:08.189945Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcpip3",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Accept",
"activitySubstatusValue": "Created"
},
"Properties_d": {
"statusCode": "Created",
"serviceRequestId": "",
"responseBody": {
"name": "zcpip3",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPAddresses/zcpip3",
"etag": "W/\"3c4f8075-7821-474d-8eae-bdfd61404158\"",
"location": "westus2",
"properties": {
"provisioningState": "Updating",
"resourceGuid": "580aea5d-bfff-4505-8a78-a64b2b20e260",
"publicIPAddressVersion": "IPv4",
"publicIPAllocationMethod": "Static",
"idleTimeoutInMinutes": 4,
"ipTags": [],
"ddosSettings": {
"protectionMode": "VirtualNetworkInherited"
}
},
"type": "Microsoft.Network/publicIPAddresses",
"sku": {
"name": "Standard",
"tier": "Regional"
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPAddresses/zcpip3",
"message": "Microsoft.Network/publicIPAddresses/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "876605a6-5a7d-549d-303c-33141cf08253",
"eventSubmissionTimestamp": "2026-06-29T19:02:08.1899450Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcpip3",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Accept",
"activitySubstatusValue": "Created"
},
"Resource": "",
"ResourceGroup": "RG-LOGCAPTURE-GEN",
"ResourceId": "",
"ResourceProvider": "",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SourceSystem": "Azure",
"SubscriptionId": "22222222-2222-2222-2222-222222222222",
"TenantId": "00000000-0000-0000-0000-000000000000",
"TimeGenerated": "2026-06-29T19:02:08.189945Z",
"Type": "AzureActivity",
"_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.network/publicipaddresses/zcpip3"
}
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
properties.statusCode (sigma rule field) | eq | created | 1 rule | sigma |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/publicIPPrefixes/delete
#Description
Deletes A Public Ip Prefix
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPPrefixes/dwh2220afpublicipprefix",
"action": "Microsoft.Network/publicIPPrefixes/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPPrefixes/dwh2220afpublicipprefix",
"action": "Microsoft.Network/publicIPPrefixes/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "3ae43eea-91c2-4c39-b398-130d767cf5a6",
"EventDataId": "8ce80f68-4c65-0df4-b9e1-f08154c98fb7",
"EventSubmissionTimestamp": "2026-07-02T18:24:19.3775628Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/PUBLICIPPREFIXES/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPPrefixes/dwh2220afpublicipprefix",
"message": "Microsoft.Network/publicIPPrefixes/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "8ce80f68-4c65-0df4-b9e1-f08154c98fb7",
"eventSubmissionTimestamp": "2026-07-02T18:24:19.3775628Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afpublicipprefix",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPPrefixes/dwh2220afpublicipprefix",
"message": "Microsoft.Network/publicIPPrefixes/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "8ce80f68-4c65-0df4-b9e1-f08154c98fb7",
"eventSubmissionTimestamp": "2026-07-02T18:24:19.3775628Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afpublicipprefix",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/publicIPPrefixes/join/action
#Description
Joins a PublicIPPrefix. Not alertable.
Microsoft.Network/publicIPPrefixes/write
#Description
Creates A Public Ip Prefix Or Updates An Existing Public Ip Prefix
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPPrefixes/dwh2220afpublicipprefix",
"action": "Microsoft.Network/publicIPPrefixes/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPPrefixes/dwh2220afpublicipprefix",
"action": "Microsoft.Network/publicIPPrefixes/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "3d873728-f375-4fe7-b0b7-3c2625528d73",
"EventDataId": "6473b4cf-5b31-31e8-a88b-4d2cff79d553",
"EventSubmissionTimestamp": "2026-07-02T18:23:55.9739272Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/PUBLICIPPREFIXES/WRITE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPPrefixes/dwh2220afpublicipprefix",
"message": "Microsoft.Network/publicIPPrefixes/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "6473b4cf-5b31-31e8-a88b-4d2cff79d553",
"eventSubmissionTimestamp": "2026-07-02T18:23:55.9739272Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afpublicipprefix",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/publicIPPrefixes/dwh2220afpublicipprefix",
"message": "Microsoft.Network/publicIPPrefixes/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "6473b4cf-5b31-31e8-a88b-4d2cff79d553",
"eventSubmissionTimestamp": "2026-07-02T18:23:55.9739272Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afpublicipprefix",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/queryExpressRoutePortsBandwidth/action
#Description
Query ExpressRoute Ports Bandwidth
Microsoft.Network/register/action
#Description
Registers the subscription
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"ActivitySubstatusValue": "OK",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"action": "Microsoft.Network/register/action",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"action": "Microsoft.Network/register/action",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1785209876",
"nbf": "1785209876",
"exp": "1785215473",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAPURen4ovrhqDdFs0nhKRoSyF0GPVqO+JHPOsYdQPfzBZPUvCJEhxG5Ow/6nvUfqn2arqzvfadEGJHxGAKBILk0ph1H06195MJ99i9jv4ulIialxdbbi7QtnpHTxJggL9m/yPQGCll8eXrsZ1sRJgmg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMAAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "006ea83a-2932-54d9-1731-544dd799b8f0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "C7K3Vvx9ykO4R4sH5a0vAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "kW0jgyDmbcRP3yR_rNi-PYb4iTwIvzIzWcW9z_r3jRoBdXNlYXN0LWRzbXM",
"xms_idrel": "26 1",
"xms_sub_fct": "3 16",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1785209876",
"nbf": "1785209876",
"exp": "1785215473",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAPURen4ovrhqDdFs0nhKRoSyF0GPVqO+JHPOsYdQPfzBZPUvCJEhxG5Ow/6nvUfqn2arqzvfadEGJHxGAKBILk0ph1H06195MJ99i9jv4ulIialxdbbi7QtnpHTxJggL9m/yPQGCll8eXrsZ1sRJgmg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMAAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "006ea83a-2932-54d9-1731-544dd799b8f0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "C7K3Vvx9ykO4R4sH5a0vAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "kW0jgyDmbcRP3yR_rNi-PYb4iTwIvzIzWcW9z_r3jRoBdXNlYXN0LWRzbXM",
"xms_idrel": "26 1",
"xms_sub_fct": "3 16",
"xms_tcdt": "1768616282"
},
"CorrelationId": "56cd70e1-88f7-4ab2-a48a-1e2223f3a719",
"EventDataId": "a3c0d162-349c-fb51-c6e0-41467d1e65f5",
"EventSubmissionTimestamp": "2026-07-28T04:09:00.2784275Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/REGISTER/ACTION",
"Properties": {
"statusCode": "OK",
"serviceRequestId": "",
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/providers/Microsoft.Network",
"message": "Microsoft.Network/register/action",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "a3c0d162-349c-fb51-c6e0-41467d1e65f5",
"eventSubmissionTimestamp": "2026-07-28T04:09:00.2784275Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"activitySubstatusValue": "OK"
},
"Properties_d": {
"statusCode": "OK",
"serviceRequestId": "",
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/providers/Microsoft.Network",
"message": "Microsoft.Network/register/action",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "a3c0d162-349c-fb51-c6e0-41467d1e65f5",
"eventSubmissionTimestamp": "2026-07-28T04:09:00.2784275Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"activitySubstatusValue": "OK"
},
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/routeFilters/delete
#Description
Deletes a route filter definition
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/routeFilters/dwh2220afroutefilters",
"action": "Microsoft.Network/routeFilters/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/routeFilters/dwh2220afroutefilters",
"action": "Microsoft.Network/routeFilters/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "fa10fa8b-6464-45bf-8ab7-42569e47eb4c",
"EventDataId": "c8deb253-959a-3924-6bec-0a61410d2870",
"EventSubmissionTimestamp": "2026-07-02T18:34:32.5505587Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/ROUTEFILTERS/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/routeFilters/dwh2220afroutefilters",
"message": "Microsoft.Network/routeFilters/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "c8deb253-959a-3924-6bec-0a61410d2870",
"eventSubmissionTimestamp": "2026-07-02T18:34:32.5505587Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afroutefilters",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/routeFilters/dwh2220afroutefilters",
"message": "Microsoft.Network/routeFilters/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "c8deb253-959a-3924-6bec-0a61410d2870",
"eventSubmissionTimestamp": "2026-07-02T18:34:32.5505587Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afroutefilters",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/routeFilters/join/action
#Description
Joins a route filter. Not Alertable.
Microsoft.Network/routeFilters/routeFilterRules/delete
#Description
Deletes a route filter rule definition
Microsoft.Network/routeFilters/routeFilterRules/write
#Description
Creates a route filter rule or Updates an existing route filter rule
Microsoft.Network/routeFilters/write
#Description
Creates a route filter or Updates an existing route filter
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/routeFilters/dwh2220afroutefilters",
"action": "Microsoft.Network/routeFilters/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/routeFilters/dwh2220afroutefilters",
"action": "Microsoft.Network/routeFilters/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "2392ab4f-b81a-4134-b74c-5c92d8adc7c1",
"EventDataId": "552053d6-587c-06f8-4dae-bd51a18d6b7d",
"EventSubmissionTimestamp": "2026-07-02T18:24:23.5531562Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/ROUTEFILTERS/WRITE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/routeFilters/dwh2220afroutefilters",
"message": "Microsoft.Network/routeFilters/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "552053d6-587c-06f8-4dae-bd51a18d6b7d",
"eventSubmissionTimestamp": "2026-07-02T18:24:23.5531562Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afroutefilters",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/routeFilters/dwh2220afroutefilters",
"message": "Microsoft.Network/routeFilters/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "552053d6-587c-06f8-4dae-bd51a18d6b7d",
"eventSubmissionTimestamp": "2026-07-02T18:24:23.5531562Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afroutefilters",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/routeTables/delete
#Description
Deletes a route table definition
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/routeTables/dwh92eef0routetable",
"action": "Microsoft.Network/routeTables/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/routeTables/dwh92eef0routetable",
"action": "Microsoft.Network/routeTables/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "d208a7b2-f8f0-4338-8a02-a61d114d6aaf",
"EventDataId": "bd16f239-4bd5-a14f-6102-2c378b3f6094",
"EventSubmissionTimestamp": "2026-07-02T17:14:50.8383006Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/ROUTETABLES/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/routeTables/dwh92eef0routetable",
"message": "Microsoft.Network/routeTables/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "bd16f239-4bd5-a14f-6102-2c378b3f6094",
"eventSubmissionTimestamp": "2026-07-02T17:14:50.8383006Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0routetable",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/routeTables/dwh92eef0routetable",
"message": "Microsoft.Network/routeTables/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "bd16f239-4bd5-a14f-6102-2c378b3f6094",
"eventSubmissionTimestamp": "2026-07-02T17:14:50.8383006Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0routetable",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/routeTables/join/action
#Description
Joins a route table. Not Alertable.
Microsoft.Network/routeTables/routes/delete
#Description
Deletes a route definition
Microsoft.Network/routeTables/routes/write
#Description
Creates a route or Updates an existing route
Microsoft.Network/routeTables/write
#Description
Creates a route table or Updates an existing route table
Example Resource Log Record #
{
"ActivityStatus": "",
"ActivityStatusValue": "Accept",
"ActivitySubstatus": "",
"ActivitySubstatusValue": "Created",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/routeTables/zcrt3",
"action": "Microsoft.Network/routeTables/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/routeTables/zcrt3",
"action": "Microsoft.Network/routeTables/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"Category": "",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"CorrelationId": "1ffff5fe-5ea4-415d-b427-e1da169cdf64",
"EventDataId": "26849061-2316-03ab-1880-48fe3640be33",
"EventSubmissionTimestamp": "2026-06-29T19:02:11.0698822Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationId": "",
"OperationName": "",
"OperationNameValue": "MICROSOFT.NETWORK/ROUTETABLES/WRITE",
"Properties": {
"statusCode": "Created",
"serviceRequestId": "",
"responseBody": {
"name": "zcrt3",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/routeTables/zcrt3",
"etag": "W/\"50c01eea-fa28-494d-82c3-501b0c478e14\"",
"type": "Microsoft.Network/routeTables",
"location": "westus2",
"properties": {
"provisioningState": "Updating",
"resourceGuid": "47a5bc2b-d43d-4bb5-97b5-f3ce6198bde6",
"disableBgpRoutePropagation": false,
"routes": []
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/routeTables/zcrt3",
"message": "Microsoft.Network/routeTables/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "26849061-2316-03ab-1880-48fe3640be33",
"eventSubmissionTimestamp": "2026-06-29T19:02:11.0698822Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcrt3",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Accept",
"activitySubstatusValue": "Created"
},
"Properties_d": {
"statusCode": "Created",
"serviceRequestId": "",
"responseBody": {
"name": "zcrt3",
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/routeTables/zcrt3",
"etag": "W/\"50c01eea-fa28-494d-82c3-501b0c478e14\"",
"type": "Microsoft.Network/routeTables",
"location": "westus2",
"properties": {
"provisioningState": "Updating",
"resourceGuid": "47a5bc2b-d43d-4bb5-97b5-f3ce6198bde6",
"disableBgpRoutePropagation": false,
"routes": []
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/routeTables/zcrt3",
"message": "Microsoft.Network/routeTables/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "26849061-2316-03ab-1880-48fe3640be33",
"eventSubmissionTimestamp": "2026-06-29T19:02:11.0698822Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcrt3",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Accept",
"activitySubstatusValue": "Created"
},
"Resource": "",
"ResourceGroup": "RG-LOGCAPTURE-GEN",
"ResourceId": "",
"ResourceProvider": "",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SourceSystem": "Azure",
"SubscriptionId": "22222222-2222-2222-2222-222222222222",
"TenantId": "00000000-0000-0000-0000-000000000000",
"TimeGenerated": "2026-06-29T19:02:11.0698822Z",
"Type": "AzureActivity",
"_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.network/routetables/zcrt3"
}
Microsoft.Network/securityPartnerProviders/delete
#Description
Deletes a SecurityPartnerProvider
Microsoft.Network/securityPartnerProviders/join/action
#Description
Joins a SecurityPartnerProvider. Not alertable.
Microsoft.Network/securityPartnerProviders/updateReferences/action
#Description
Update references in a SecurityPartnerProvider
Microsoft.Network/securityPartnerProviders/validate/action
#Description
Validates a SecurityPartnerProvider
Microsoft.Network/securityPartnerProviders/write
#Description
Creates a SecurityPartnerProvider or Updates An Existing SecurityPartnerProvider
Microsoft.Network/serviceEndpointPolicies/delete
#Description
Deletes a Service Endpoint Policy
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/serviceEndpointPolicies/dwh2220afserviceendpoin",
"action": "Microsoft.Network/serviceEndpointPolicies/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/serviceEndpointPolicies/dwh2220afserviceendpoin",
"action": "Microsoft.Network/serviceEndpointPolicies/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "df88c839-a73a-41fb-a6c1-8d2567de02eb",
"EventDataId": "6f1b1cf2-e98e-74fa-60d1-ee3a14e6b7a1",
"EventSubmissionTimestamp": "2026-07-02T18:25:01.602995Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/SERVICEENDPOINTPOLICIES/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/serviceEndpointPolicies/dwh2220afserviceendpoin",
"message": "Microsoft.Network/serviceEndpointPolicies/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "6f1b1cf2-e98e-74fa-60d1-ee3a14e6b7a1",
"eventSubmissionTimestamp": "2026-07-02T18:25:01.602995Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afserviceendpoin",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/serviceEndpointPolicies/dwh2220afserviceendpoin",
"message": "Microsoft.Network/serviceEndpointPolicies/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "6f1b1cf2-e98e-74fa-60d1-ee3a14e6b7a1",
"eventSubmissionTimestamp": "2026-07-02T18:25:01.6029950Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afserviceendpoin",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/serviceEndpointPolicies/join/action
#Description
Joins a Service Endpoint Policy. Not alertable.
Microsoft.Network/serviceEndpointPolicies/joinSubnet/action
#Description
Joins a Subnet To Service Endpoint Policies. Not alertable.
Microsoft.Network/serviceEndpointPolicies/serviceEndpointPolicyDefinitions/delete
#Description
Deletes a Service Endpoint Policy Definition
Microsoft.Network/serviceEndpointPolicies/serviceEndpointPolicyDefinitions/write
#Description
Creates a Service Endpoint Policy Definition or updates an existing Service Endpoint Policy Definition
Microsoft.Network/serviceEndpointPolicies/write
#Description
Creates a Service Endpoint Policy or updates an existing Service Endpoint Policy
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/serviceEndpointPolicies/dwh2220afserviceendpoin",
"action": "Microsoft.Network/serviceEndpointPolicies/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/serviceEndpointPolicies/dwh2220afserviceendpoin",
"action": "Microsoft.Network/serviceEndpointPolicies/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "4d4c14a6-e5da-4fdb-bae4-67fa55c16eef",
"EventDataId": "b483f3ce-8d32-d0ee-dcbb-d8f7b1b2e518",
"EventSubmissionTimestamp": "2026-07-02T18:24:48.5572233Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/SERVICEENDPOINTPOLICIES/WRITE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/serviceEndpointPolicies/dwh2220afserviceendpoin",
"message": "Microsoft.Network/serviceEndpointPolicies/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "b483f3ce-8d32-d0ee-dcbb-d8f7b1b2e518",
"eventSubmissionTimestamp": "2026-07-02T18:24:48.5572233Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afserviceendpoin",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/serviceEndpointPolicies/dwh2220afserviceendpoin",
"message": "Microsoft.Network/serviceEndpointPolicies/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "b483f3ce-8d32-d0ee-dcbb-d8f7b1b2e518",
"eventSubmissionTimestamp": "2026-07-02T18:24:48.5572233Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afserviceendpoin",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/trafficManagerProfiles/azureEndpoints/delete
#Description
Deletes an Azure Endpoint from an existing Traffic Manager Profile. Traffic Manager will stop routing traffic to the deleted Azure Endpoint.
Microsoft.Network/trafficManagerProfiles/azureEndpoints/write
#Description
Add a new Azure Endpoint in an existing Traffic Manager Profile or update the properties of an existing Azure Endpoint in that Traffic Manager Profile.
Microsoft.Network/trafficManagerProfiles/delete
#Description
Delete the Traffic Manager profile. All settings associated with the Traffic Manager profile will be lost, and the profile can no longer be used to route traffic.
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"ActivitySubstatusValue": "OK",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/trafficmanagerprofiles/dwh2220aftrafficmanager",
"action": "Microsoft.Network/trafficmanagerprofiles/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/trafficmanagerprofiles/dwh2220aftrafficmanager",
"action": "Microsoft.Network/trafficmanagerprofiles/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783031103",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"correlationid": "87f7741a-5361-404a-a147-6b88e848f2f2"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783031103",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"correlationid": "87f7741a-5361-404a-a147-6b88e848f2f2"
},
"CorrelationId": "87f7741a-5361-404a-a147-6b88e848f2f2",
"EventDataId": "1083ebb2-9953-2c18-6086-dafb0491628b",
"EventSubmissionTimestamp": "2026-07-02T18:25:04.6320924Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/TRAFFICMANAGERPROFILES/DELETE",
"Properties": {
"statusCode": "OK",
"serviceRequestId": "",
"responseBody": {
"properties": {
"boolean": true
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/trafficmanagerprofiles/dwh2220aftrafficmanager",
"message": "Microsoft.Network/trafficmanagerprofiles/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "1083ebb2-9953-2c18-6086-dafb0491628b",
"eventSubmissionTimestamp": "2026-07-02T18:25:04.6320924Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220aftrafficmanager",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"activitySubstatusValue": "OK"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/trafficmanagerprofiles/dwh2220aftrafficmanager",
"message": "Microsoft.Network/trafficmanagerprofiles/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "1083ebb2-9953-2c18-6086-dafb0491628b",
"eventSubmissionTimestamp": "2026-07-02T18:25:04.6320924Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220aftrafficmanager",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"statusCode": "OK",
"serviceRequestId": "",
"activitySubstatusValue": "OK",
"responseBody": {
"properties": {
"boolean": true
}
}
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/trafficManagerProfiles/externalEndpoints/delete
#Description
Deletes an External Endpoint from an existing Traffic Manager Profile. Traffic Manager will stop routing traffic to the deleted External Endpoint.
Microsoft.Network/trafficManagerProfiles/externalEndpoints/write
#Description
Add a new External Endpoint in an existing Traffic Manager Profile or update the properties of an existing External Endpoint in that Traffic Manager Profile.
Microsoft.Network/trafficManagerProfiles/nestedEndpoints/delete
#Description
Deletes an Nested Endpoint from an existing Traffic Manager Profile. Traffic Manager will stop routing traffic to the deleted Nested Endpoint.
Microsoft.Network/trafficManagerProfiles/nestedEndpoints/write
#Description
Add a new Nested Endpoint in an existing Traffic Manager Profile or update the properties of an existing Nested Endpoint in that Traffic Manager Profile.
Microsoft.Network/trafficManagerProfiles/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates the Traffic Manager diagnostic settings, this operation is supplemented by insights resource provider.
Microsoft.Network/trafficManagerProfiles/validateLink/action
#Description
Establishes a link between a DNS record and a Traffic Manager Profile so that the traffic manager profile can't be removed while it is being referenced by the dns record
Microsoft.Network/trafficManagerProfiles/write
#Description
Create a Traffic Manager profile, or modify the configuration of an existing Traffic Manager profile.<br>This includes enabling or disabling a profile and modifying DNS settings, traffic routing settings, or endpoint monitoring settings.<br>Endpoints routed by the Traffic Manager profile can be added, removed, enabled or disabled.
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"ActivitySubstatusValue": "Created",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/trafficmanagerprofiles/dwh2220aftrafficmanager",
"action": "Microsoft.Network/trafficmanagerprofiles/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/trafficmanagerprofiles/dwh2220aftrafficmanager",
"action": "Microsoft.Network/trafficmanagerprofiles/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "77228109-a036-44e1-87e8-99c55a34097e",
"EventDataId": "8878816e-aa50-5683-4181-45027498f99b",
"EventSubmissionTimestamp": "2026-07-02T18:25:02.0132348Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/TRAFFICMANAGERPROFILES/WRITE",
"Properties": {
"statusCode": "Created",
"serviceRequestId": "",
"responseBody": {
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/trafficManagerProfiles/dwh2220aftrafficmanager",
"name": "dwh2220aftrafficmanager",
"type": "Microsoft.Network/trafficManagerProfiles",
"location": "global",
"properties": {
"profileStatus": "Enabled",
"trafficRoutingMethod": "Performance",
"dnsConfig": {
"relativeName": "dwh2220aftrafficmanager",
"fqdn": "dwh2220aftrafficmanager.trafficmanager.net",
"ttl": 30
},
"monitorConfig": {
"profileMonitorStatus": "Inactive",
"protocol": "HTTP",
"port": 80,
"path": "/",
"intervalInSeconds": 30,
"toleratedNumberOfFailures": 3,
"timeoutInSeconds": 10
},
"endpoints": [],
"trafficViewEnrollmentStatus": "Disabled",
"maxReturn": null,
"recordType": null
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/trafficmanagerprofiles/dwh2220aftrafficmanager",
"message": "Microsoft.Network/trafficmanagerprofiles/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "8878816e-aa50-5683-4181-45027498f99b",
"eventSubmissionTimestamp": "2026-07-02T18:25:02.0132348Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220aftrafficmanager",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"activitySubstatusValue": "Created"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/trafficmanagerprofiles/dwh2220aftrafficmanager",
"message": "Microsoft.Network/trafficmanagerprofiles/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "8878816e-aa50-5683-4181-45027498f99b",
"eventSubmissionTimestamp": "2026-07-02T18:25:02.0132348Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220aftrafficmanager",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"statusCode": "Created",
"serviceRequestId": "",
"activitySubstatusValue": "Created",
"responseBody": {
"id": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/trafficManagerProfiles/dwh2220aftrafficmanager",
"name": "dwh2220aftrafficmanager",
"type": "Microsoft.Network/trafficManagerProfiles",
"location": "global",
"properties": {
"profileStatus": "Enabled",
"trafficRoutingMethod": "Performance",
"dnsConfig": {
"relativeName": "dwh2220aftrafficmanager",
"fqdn": "dwh2220aftrafficmanager.trafficmanager.net",
"ttl": 30
},
"monitorConfig": {
"profileMonitorStatus": "Inactive",
"protocol": "HTTP",
"port": 80,
"path": "/",
"intervalInSeconds": 30,
"toleratedNumberOfFailures": 3,
"timeoutInSeconds": 10
},
"endpoints": [],
"trafficViewEnrollmentStatus": "Disabled",
"maxReturn": null,
"recordType": null
}
}
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/trafficManagerUserMetricsKeys/delete
#Description
Deletes the subscription-level key used for Realtime User Metrics collection.
Microsoft.Network/trafficManagerUserMetricsKeys/write
#Description
Creates a new subscription-level key to be used for Realtime User Metrics collection.
Microsoft.Network/unregister/action
#Description
Unregisters the subscription
Microsoft.Network/virtualHubs/bgpConnections/advertisedRoutes/action
#Description
Gets virtualrouter advertised routes
Microsoft.Network/virtualHubs/bgpConnections/delete
#Description
Deletes a Hub Bgp Connection child resource of Virtual Hub
Microsoft.Network/virtualHubs/bgpConnections/learnedRoutes/action
#Description
Gets virtualrouter learned routes
Microsoft.Network/virtualHubs/bgpConnections/write
#Description
Creates or Updates a Hub Bgp Connection child resource of Virtual Hub
Microsoft.Network/virtualHubs/connectionPolicies/delete
#Description
Deletes Connection Policy child resource of Virtual Hub
Microsoft.Network/virtualHubs/connectionPolicies/write
#Description
Creates or Updates Connection Policy child resource of Virtual Hub
Microsoft.Network/virtualHubs/delete
#Description
Deletes a Virtual Hub
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/virtualHubs/effectiveRoutes/action
#Description
Gets effective route configured on Virtual Hub
Microsoft.Network/virtualHubs/hubRouteTables/delete
#Description
Deletes a Route Table child resource of Virtual Hub
Microsoft.Network/virtualHubs/hubRouteTables/write
#Description
Creates or Updates a Route Table child resource of Virtual Hub
Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/delete
#Description
Deletes a HubVirtualNetworkConnection
Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/write
#Description
Create or update a HubVirtualNetworkConnection
Microsoft.Network/virtualHubs/inboundRoutes/action
#Description
Gets routes learnt from a virtual wan connection
Microsoft.Network/virtualHubs/ipConfigurations/delete
#Description
Deletes a Hub IpConfiguration child resource of Virtual Hub
Microsoft.Network/virtualHubs/ipConfigurations/write
#Description
Creates or Updates a Hub IpConfiguration child resource of Virtual Hub
Microsoft.Network/virtualHubs/migrateRouteService/action
#Description
Validate or execute the hub router migration
Microsoft.Network/virtualHubs/outboundRoutes/action
#Description
Get Routes advertised by a virtual wan connection
Microsoft.Network/virtualHubs/routeMaps/delete
#Description
Deletes a Route Map child resource of Virtual Hub
Microsoft.Network/virtualHubs/routeMaps/write
#Description
Creates or Updates a Route Map child resource of Virtual Hub
Microsoft.Network/virtualHubs/routeTables/delete
#Description
Delete a VirtualHubRouteTableV2
Microsoft.Network/virtualHubs/routeTables/write
#Description
Create or Update a VirtualHubRouteTableV2
Microsoft.Network/virtualHubs/routingIntent/delete
#Description
Deletes a Routing Intent child resource of Virtual Hub
Microsoft.Network/virtualHubs/routingIntent/write
#Description
Creates or Updates a Routing Intent child resource of Virtual Hub
Microsoft.Network/virtualHubs/write
#Description
Create or update a Virtual Hub
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/virtualNetworkAppliances/delete
#Description
Delete Virtual Network Appliance
Microsoft.Network/virtualNetworkAppliances/write
#Description
Create or update Virtual Network Appliance
microsoft.network/virtualnetworkgateways/abortMigration/action
#Description
Abort Migrate Virtual Network Gateway Operation
microsoft.network/virtualnetworkgateways/commitMigration/action
#Description
Commit Migrate Virtual Network Gateway Operation
Microsoft.Network/virtualNetworkGateways/delete
#Description
Deletes a virtualNetworkGateway
microsoft.network/virtualnetworkgateways/disconnectvirtualnetworkgatewayvpnconnections/action
#Description
Disconnect virtual network gateway vpn connections
microsoft.network/virtualnetworkgateways/executeMigration/action
#Description
Execute Migrate Virtual Network Gateway Operation
microsoft.network/virtualnetworkgateways/generatevpnclientpackage/action
#Description
Generate VpnClient package for virtualNetworkGateway
microsoft.network/virtualnetworkgateways/generatevpnprofile/action
#Description
Generate VpnProfile package for VirtualNetworkGateway
microsoft.network/virtualnetworkgateways/getadvertisedroutes/action
#Description
Gets virtualNetworkGateway advertised routes
microsoft.network/virtualnetworkgateways/getbgppeerstatus/action
#Description
Gets virtualNetworkGateway bgp peer status
microsoft.network/virtualnetworkgateways/geteffectiveroutes/action
#Description
Gets virtualnetworkgateway effective routes
microsoft.network/virtualnetworkgateways/getlearnedroutes/action
#Description
Gets virtualnetworkgateway learned routes
microsoft.network/virtualnetworkgateways/getvpnclientconnectionhealth/action
#Description
Get Per Vpn Client Connection Health for VirtualNetworkGateway
microsoft.network/virtualnetworkgateways/getvpnclientipsecparameters/action
#Description
Get Vpnclient Ipsec parameters for VirtualNetworkGateway P2S client.
microsoft.network/virtualnetworkgateways/getvpnprofilepackageurl/action
#Description
Gets the URL of a pre-generated vpn client profile package
microsoft.network/virtualnetworkgateways/listAllRadiusServersSecrets/action
#Description
List all VirtualNetworkGateway RadiusServer secrets
microsoft.network/virtualNetworkGateways/natRules/delete
#Description
Deletes a NAT rule resource
microsoft.network/virtualNetworkGateways/natRules/write
#Description
Puts a NAT rule resource
microsoft.network/virtualnetworkgateways/prepareMigration/action
#Description
Prepare Migrate Virtual Network Gateway Operation
Microsoft.Network/virtualNetworkGateways/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates the Virtual Network Gateway diagnostic settings, this operation is supplemented by insights resource provider.
microsoft.network/virtualnetworkgateways/reset/action
#Description
Resets a virtualNetworkGateway
microsoft.network/virtualnetworkgateways/setvpnclientipsecparameters/action
#Description
Set Vpnclient Ipsec parameters for VirtualNetworkGateway P2S client.
microsoft.network/virtualnetworkgateways/startpacketcapture/action
#Description
Starts a Virtual Network Gateway Packet Capture.
microsoft.network/virtualnetworkgateways/stoppacketcapture/action
#Description
Stops a Virtual Network Gateway Packet Capture.
Microsoft.Network/virtualnetworkgateways/supportedvpndevices/action
#Description
Lists Supported Vpn Devices
Microsoft.Network/virtualNetworkGateways/write
#Description
Creates or updates a VirtualNetworkGateway
Microsoft.Network/virtualNetworks/BastionHosts/action
#Description
Gets Bastion Host references in a Virtual Network.
Microsoft.Network/virtualNetworks/bastionHosts/default/action
#Description
Gets Bastion Host references in a Virtual Network.
Microsoft.Network/virtualNetworks/customViews/get/action
#Description
Get a Virtual Network custom view content
Microsoft.Network/virtualNetworks/ddosProtectionStatus/action
#Description
Gets the effective Ddos protection status for a Virtual Network resource.
Microsoft.Network/virtualNetworks/delete
#Description
Deletes a virtual network
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/virtualNetworks/dwh92eef0vnet",
"action": "Microsoft.Network/virtualNetworks/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/virtualNetworks/dwh92eef0vnet",
"action": "Microsoft.Network/virtualNetworks/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "d956a0cc-a613-4275-82b6-e20ade0c4b2f",
"EventDataId": "487f2e08-2522-d9b4-e1ac-a894c3df8d3b",
"EventSubmissionTimestamp": "2026-07-02T17:14:41.6803143Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/VIRTUALNETWORKS/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/virtualNetworks/dwh92eef0vnet",
"message": "Microsoft.Network/virtualNetworks/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "487f2e08-2522-d9b4-e1ac-a894c3df8d3b",
"eventSubmissionTimestamp": "2026-07-02T17:14:41.6803143Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0vnet",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/virtualNetworks/dwh92eef0vnet",
"message": "Microsoft.Network/virtualNetworks/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "487f2e08-2522-d9b4-e1ac-a894c3df8d3b",
"eventSubmissionTimestamp": "2026-07-02T17:14:41.6803143Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh92eef0vnet",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Panther #
T1485, T1499
Microsoft.Network/virtualNetworks/join/action
#Description
Joins a virtual network. Not Alertable.
Microsoft.Network/virtualNetworks/joinLoadBalancer/action
#Description
Joins a load balancer to virtual networks
Microsoft.Network/virtualNetworks/listDnsForwardingRulesets/action
#Description
Gets the DNS Forwarding Ruleset for Virtual Network, in JSON format
Microsoft.Network/virtualNetworks/listDnsResolverPolicies/action
#Description
Gets the DNS Resolver Policy associated with a Virtual Network, in JSON format.
Microsoft.Network/virtualNetworks/listDnsResolvers/action
#Description
Gets the DNS Resolver for Virtual Network, in JSON format
Microsoft.Network/virtualNetworks/listNetworkManagerEffectiveConnectivityConfigurations/action
#Description
Lists Network Manager Effective Connectivity Configurations
Microsoft.Network/virtualNetworks/listNetworkManagerEffectiveSecurityAdminRules/action
#Description
Lists Network Manager Effective Security Admin Rules
Microsoft.Network/virtualNetworks/manageIpFromPool/action
#Description
Manage Private Ip Inventory Pool Operation Description
Microsoft.Network/virtualNetworks/moveIpConfigurations/action
#Description
Moves secondary IP configurations between resources
Microsoft.Network/virtualNetworks/peer/action
#Description
Peers a virtual network with another virtual network
Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Create or update the diagnostic settings of the Virtual Network
Microsoft.Network/virtualNetworks/remoteVirtualNetworkPeeringProxies/delete
#Description
Deletes a virtual network peering proxy
Microsoft.Network/virtualNetworks/remoteVirtualNetworkPeeringProxies/write
#Description
Creates a virtual network peering proxy or updates an existing virtual network peering proxy
Microsoft.Network/virtualNetworks/removeAdminNetworkSecurityGroup/action
#Description
Removes Admin Network Security Group Reference From Virtual Network
Microsoft.Network/virtualNetworks/rnmEffectiveNetworkSecurityGroups/action
#Description
Gets Security Groups Configured On CA Of The Vnet In Rnm Format
Microsoft.Network/virtualNetworks/rnmEffectiveRouteTable/action
#Description
Gets RouteTables Configured On CA Of The Vnet In Rnm Format
Microsoft.Network/virtualNetworks/setAdminNetworkSecurityGroup/action
#Description
Sets Admin Network Security Group Reference On Virtual Network
Microsoft.Network/virtualNetworks/subnets/contextualServiceEndpointPolicies/delete
#Description
Deletes A Contextual Service Endpoint Policy
Microsoft.Network/virtualNetworks/subnets/contextualServiceEndpointPolicies/write
#Description
Creates a Contextual Service Endpoint Policy or updates an existing Contextual Service Endpoint Policy
Microsoft.Network/virtualNetworks/subnets/delete
#Description
Deletes a virtual network subnet
Microsoft.Network/virtualNetworks/subnets/join/action
#Description
Joins a virtual network. Not Alertable.
Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action
#Description
Joins a load balancer to virtual network subnets
Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action
#Description
Joins resource such as storage account or SQL database to a subnet. Not alertable.
Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action
#Description
Prepares a subnet by applying necessary Network Policies
Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/delete
#Description
Deletes a Service Association Link
Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/validate/action
#Description
Validates a Service Association Link
Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/write
#Description
Creates a Service Association Link or updates an existing Service Association Link
Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action
#Description
Unprepare a subnet by removing the applied Network Policies
Microsoft.Network/virtualNetworks/subnets/write
#Description
Creates a virtual network subnet or updates an existing virtual network subnet
Microsoft.Network/virtualNetworks/taggedTrafficConsumers/delete
#Description
Deletes a Tagged Traffic Consumer
Microsoft.Network/virtualNetworks/taggedTrafficConsumers/validate/action
#Description
Validates a Tagged Traffic Consumer
Microsoft.Network/virtualNetworks/taggedTrafficConsumers/write
#Description
Creates a Tagged Traffic Consumer or updates an existing Tagged Traffic Consumer
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete
#Description
Deletes a virtual network peering
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write
#Description
Creates a virtual network peering or updates an existing virtual network peering
Microsoft.Network/virtualNetworks/write
#Description
Creates a virtual network or updates an existing virtual network
Example Resource Log Record #
{
"ActivityStatus": "",
"ActivityStatusValue": "Success",
"ActivitySubstatus": "",
"ActivitySubstatusValue": "",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/virtualNetworks/zcvnet3",
"action": "Microsoft.Network/virtualNetworks/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/virtualNetworks/zcvnet3",
"action": "Microsoft.Network/virtualNetworks/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"Category": "",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1782755989",
"nbf": "1782755989",
"exp": "1782761191",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "REDACTED",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "REDACTED",
"rh": "REDACTED",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "REDACTED",
"ver": "1.0",
"wids": "REDACTED",
"xms_act_fct": "5 3",
"xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
"xms_idrel": "1 8",
"xms_sub_fct": "14 3",
"xms_tcdt": "1768616282"
},
"CorrelationId": "39857d95-c78a-4351-bc34-52aff21f7e57",
"EventDataId": "79a39c42-78d8-ff83-98ef-239ca2edd340",
"EventSubmissionTimestamp": "2026-06-29T19:01:51.5433442Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationId": "",
"OperationName": "",
"OperationNameValue": "MICROSOFT.NETWORK/VIRTUALNETWORKS/WRITE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/virtualNetworks/zcvnet3",
"message": "Microsoft.Network/virtualNetworks/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "79a39c42-78d8-ff83-98ef-239ca2edd340",
"eventSubmissionTimestamp": "2026-06-29T19:01:51.5433442Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcvnet3",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/virtualNetworks/zcvnet3",
"message": "Microsoft.Network/virtualNetworks/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "79a39c42-78d8-ff83-98ef-239ca2edd340",
"eventSubmissionTimestamp": "2026-06-29T19:01:51.5433442Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "zcvnet3",
"resourceGroup": "RG-LOGCAPTURE-GEN",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Resource": "",
"ResourceGroup": "RG-LOGCAPTURE-GEN",
"ResourceId": "",
"ResourceProvider": "",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SourceSystem": "Azure",
"SubscriptionId": "22222222-2222-2222-2222-222222222222",
"TenantId": "00000000-0000-0000-0000-000000000000",
"TimeGenerated": "2026-06-29T19:01:51.5433442Z",
"Type": "AzureActivity",
"_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.network/virtualnetworks/zcvnet3"
}
Microsoft.Network/virtualNetworkTaps/delete
#Description
Delete Virtual Network Tap
Microsoft.Network/virtualNetworkTaps/join/action
#Description
Joins a virtual network tap. Not Alertable.
Microsoft.Network/virtualNetworkTaps/networkInterfaceTapConfigurationProxies/delete
#Description
Deletes a Network Interface Tap Configuration Proxy.
Microsoft.Network/virtualNetworkTaps/networkInterfaceTapConfigurationProxies/write
#Description
Creates a Network Interface Tap Configuration Proxy Or updates an existing Network Interface Tap Configuration Proxy.
Microsoft.Network/virtualNetworkTaps/write
#Description
Create or Update Virtual Network Tap
Microsoft.Network/virtualRouters/delete
#Description
Deletes A VirtualRouter
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/virtualRouters/join/action
#Description
Joins A VirtualRouter. Not alertable.
Microsoft.Network/virtualRouters/peerings/delete
#Description
Deletes A VirtualRouterPeering
Microsoft.Network/virtualRouters/peerings/write
#Description
Creates A VirtualRouterPeering or Updates An Existing VirtualRouterPeering
Microsoft.Network/virtualRouters/write
#Description
Creates A VirtualRouter or Updates An Existing VirtualRouter
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/virtualWans/delete
#Description
Deletes a Virtual Wan
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/virtualWans/dwhc6a93dvirtualwans",
"action": "Microsoft.Network/virtualWans/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/virtualWans/dwhc6a93dvirtualwans",
"action": "Microsoft.Network/virtualWans/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783041418",
"nbf": "1783041418",
"exp": "1783045937",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "tUdFU6nO4UmtUjpbHDqEAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783041418",
"nbf": "1783041418",
"exp": "1783045937",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "tUdFU6nO4UmtUjpbHDqEAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"CorrelationId": "5b5bbafd-9819-4b57-8a0f-cadadeaa3f35",
"EventDataId": "7a8390df-45cd-1722-45b0-fff2c0275f86",
"EventSubmissionTimestamp": "2026-07-03T02:18:51.0373859Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/VIRTUALWANS/DELETE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/virtualWans/dwhc6a93dvirtualwans",
"message": "Microsoft.Network/virtualWans/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "7a8390df-45cd-1722-45b0-fff2c0275f86",
"eventSubmissionTimestamp": "2026-07-03T02:18:51.0373859Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwhc6a93dvirtualwans",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/virtualWans/dwhc6a93dvirtualwans",
"message": "Microsoft.Network/virtualWans/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "7a8390df-45cd-1722-45b0-fff2c0275f86",
"eventSubmissionTimestamp": "2026-07-03T02:18:51.0373859Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwhc6a93dvirtualwans",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/virtualwans/generateVpnProfile/action
#Description
Generate VirtualWanVpnServerConfiguration VpnProfile
Microsoft.Network/virtualWans/join/action
#Description
Joins a Virtual WAN. Not alertable.
Microsoft.network/virtualWans/p2sVpnServerConfigurations/delete
#Description
Deletes a virtual Wan P2SVpnServerConfiguration
Microsoft.network/virtualWans/p2sVpnServerConfigurations/write
#Description
Creates a virtual Wan P2SVpnServerConfiguration or updates an existing virtual Wan P2SVpnServerConfiguration
Microsoft.Network/virtualWans/updateVhubReferences/action
#Description
Update VirtualHub reference in VirtualWan
Microsoft.Network/virtualWans/updateVpnReferences/action
#Description
Update VPN reference in VirtualWan
Microsoft.Network/virtualWans/virtualHubProxies/delete
#Description
Deletes a Virtual Hub proxy
Microsoft.Network/virtualWans/virtualHubProxies/write
#Description
Creates a Virtual Hub proxy or updates a Virtual Hub proxy
Microsoft.Network/virtualwans/vpnconfiguration/action
#Description
Gets a Vpn Configuration
Microsoft.Network/virtualwans/vpnServerConfigurations/action
#Description
Get VirtualWanVpnServerConfigurations
Microsoft.Network/virtualWans/vpnSiteProxies/delete
#Description
Deletes a Vpn Site proxy
Microsoft.Network/virtualWans/vpnSiteProxies/write
#Description
Creates a Vpn Site proxy or updates a Vpn Site proxy
Microsoft.Network/virtualWans/write
#Description
Create or update a Virtual Wan
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/virtualWans/dwh2220afvirtualwans",
"action": "Microsoft.Network/virtualWans/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Network/virtualWans/dwh2220afvirtualwans",
"action": "Microsoft.Network/virtualWans/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783012099",
"nbf": "1783012099",
"exp": "1783017701",
"aio": "AXQAi/8cAAAAICIgGVONYdaNx/1snvX3s8KrpUMqKU1iXqIadxiu82gVEJAvHYNrOvXG+NHHfGfTck3ZHLhiYCsr3drrAIpgGkm+UY127NHbcWpDIvfua4QF6MoSbbj2Q8ekvpSlCw6WzLP3HwxTyNn70TNCRgq2Mg==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "eyUvMswr6EqJhPARR0x4AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "5 3",
"xms_ftd": "_yYfS1Dsz6HFh8q4mYaAf6M93yk_I-vt3b84gSLpQ4UBdXNub3J0aC1kc21z",
"xms_idrel": "24 1",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "17f9804f-5560-4806-a88a-caa0e9530203",
"EventDataId": "1cd09f16-dfb1-9c0d-5402-f854f993449f",
"EventSubmissionTimestamp": "2026-07-02T18:25:28.8189271Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.NETWORK/VIRTUALWANS/WRITE",
"Properties": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/virtualWans/dwh2220afvirtualwans",
"message": "Microsoft.Network/virtualWans/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "1cd09f16-dfb1-9c0d-5402-f854f993449f",
"eventSubmissionTimestamp": "2026-07-02T18:25:28.8189271Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afvirtualwans",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Network/virtualWans/dwh2220afvirtualwans",
"message": "Microsoft.Network/virtualWans/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "1cd09f16-dfb1-9c0d-5402-f854f993449f",
"eventSubmissionTimestamp": "2026-07-02T18:25:28.8189271Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwh2220afvirtualwans",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.NETWORK",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.NETWORK",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.Network/vpnGateways/delete
#Description
Deletes a VpnGateway.
microsoft.network/vpngateways/getadvertisedroutes/action
#Description
Gets advertised routes of a VpnGateway
microsoft.network/vpngateways/getbgppeerstatus/action
#Description
Gets bgp peer status of a VpnGateway
microsoft.network/vpngateways/getlearnedroutes/action
#Description
Gets learned routes of a VpnGateway
microsoft.network/vpngateways/listvpnconnectionshealth/action
#Description
Gets connection health for all or a subset of connections on a VpnGateway
microsoft.network/vpnGateways/natRules/delete
#Description
Deletes a NAT rule resource
microsoft.network/vpnGateways/natRules/write
#Description
Puts a NAT rule resource
Microsoft.Network/vpnGateways/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates the Vpn Gateway diagnostic settings, this operation is supplemented by insights resource provider.
microsoft.network/vpngateways/reset/action
#Description
Resets a VpnGateway
microsoft.network/vpngateways/startpacketcapture/action
#Description
Start Vpn gateway Packet Capture with according resource
microsoft.network/vpngateways/stoppacketcapture/action
#Description
Stop Vpn gateway Packet Capture with sasURL
microsoft.network/vpnGateways/vpnConnections/delete
#Description
Deletes a VpnConnection.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
microsoft.network/vpnGateways/vpnConnections/startpacketcapture/action
#Description
Start packet capture for selected linked in vpn connection
microsoft.network/vpnGateways/vpnConnections/stoppacketcapture/action
#Description
Stop packet capture for selected linked in vpn connection
microsoft.network/vpnGateways/vpnConnections/vpnLinkConnections/getikesas/action
#Description
Lists Vpn Link Connection IKE Security Associations
microsoft.network/vpnGateways/vpnConnections/vpnLinkConnections/resetconnection/action
#Description
Resets connection for vWAN
microsoft.network/vpnGateways/vpnConnections/write
#Description
Puts a VpnConnection.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
Microsoft.Network/vpnGateways/write
#Description
Puts a VpnGateway.
microsoft.network/vpnServerConfigurations/configurationPolicyGroups/delete
#Description
Deletes a Configuration Policy Group
Microsoft.Network/vpnServerConfigurations/configurationPolicyGroups/p2sConnectionConfigurationProxies/delete
#Description
Deletes A P2S Connection Configuration Proxy
Microsoft.Network/vpnServerConfigurations/configurationPolicyGroups/p2sConnectionConfigurationProxies/write
#Description
Creates A P2S Connection Configuration Proxy Or Updates An Existing P2S Connection Configuration Proxy
microsoft.network/vpnServerConfigurations/configurationPolicyGroups/write
#Description
Puts a Configuration Policy Group
Microsoft.Network/vpnServerConfigurations/delete
#Description
Delete VpnServerConfiguration
microsoft.network/vpnServerConfigurations/listAllRadiusServersSecrets/action
#Description
List all VpnServerConfiguration RadiusServer secrets
Microsoft.Network/vpnServerConfigurations/p2sVpnGatewayProxies/delete
#Description
Deletes a P2SVpnGateway Proxy
Microsoft.Network/vpnServerConfigurations/p2sVpnGatewayProxies/write
#Description
Creates a P2SVpnGateway Proxy or updates a P2SVpnGateway Proxy
Microsoft.Network/vpnServerConfigurations/write
#Description
Create or Update VpnServerConfiguration
Microsoft.Network/vpnsites/delete
#Description
Deletes a Vpn Site resource.
Microsoft.Network/vpnsites/write
#Description
Creates or updates a Vpn Site resource.
Microsoft.Network/azureserviceconnectioncontrollers/delete
#Description
Delete Azure Service Connection Controller
Microsoft.Network/azureserviceconnectioncontrollers/write
#Description
Create Or Update Azure Service Connection Controller
Microsoft.Network/expressRouteCircuits/routeTable/action
#Description
Get MultiCloud Circuit Route Table
Microsoft.Network/firewallPolicies/kubeSelectorGroups/delete
#Description
Delete Firewall Policy Kube Selector Group
Microsoft.Network/firewallPolicies/kubeSelectorGroups/write
#Description
Create or Update Firewall Policy Kube Selector Group
Microsoft.Network/interconnectGroups/nodeAvailability/action
#Description
Get InterconnectGroup Node Availability
Microsoft.Network/networkWatchers/packetCaptures/queryInsight/action
#Description
Query Packet Capture Insight
Microsoft.Network/networkWatchers/packetCaptures/startInsight/action
#Description
Start Packet Capture Insight
Microsoft.Network/networkWatchers/trafficAnalytics/delete
#Description
Delete Traffic Analytics
Microsoft.Network/networkWatchers/trafficAnalytics/write
#Description
Create Traffic Analytics
Microsoft.Network/privateEndpoints/copy/action
#Description
Copy an private endpoint.
Microsoft.Network/privatetrafficmanagerprofiles/delete
#Description
Delete a Private Traffic Manager Profile
Microsoft.Network/privatetrafficmanagerprofiles/endpoints/delete
#Description
Delete a Private Traffic Manager Profile Endpoint
Microsoft.Network/privatetrafficmanagerprofiles/endpoints/write
#Description
Create Or Update a Private Traffic Manager Profile Endpoint
Microsoft.Network/privatetrafficmanagerprofiles/healthPolicies/delete
#Description
Delete a Private Traffic Manager Profile Health Policy
Microsoft.Network/privatetrafficmanagerprofiles/healthPolicies/write
#Description
Create Or Update a Private Traffic Manager Profile Health Policy
Microsoft.Network/privatetrafficmanagerprofiles/validateLink/action
#Description
Establishes a link between a Private DNS record and a Private Traffic Manager Profile
Microsoft.Network/privatetrafficmanagerprofiles/write
#Description
Create Or Update a Private Traffic Manager Profile
Microsoft.Network/probinggateways/delete
#Description
Delete a Probing Gateway
Microsoft.Network/probinggateways/write
#Description
Create Or Update a Probing Gateway
Microsoft.Network/topologymaps/delete
#Description
Delete a Topology Map
Microsoft.Network/topologymaps/sites/delete
#Description
Delete a Topology Map Site
Microsoft.Network/topologymaps/sites/write
#Description
Create Or Update a Topology Map Site
Microsoft.Network/topologymaps/write
#Description
Create Or Update a Topology Map
Microsoft.Network/virtualNetworks/subnets/getNetworkPolicies/action
#Description
Get Subnet Network Intent Policies