Powerpipe Detection Mods →

Plugins Docs Home

turbot/tailpipe-mod-azure-activity-log-detections

activity_dashboard_logs_by_actor activity_dashboard_logs_by_event activity_dashboard_logs_by_resource_group activity_dashboard_logs_by_service activity_dashboard_logs_by_source_ip activity_dashboard_logs_by_subscription activity_dashboard_total_logs automation_account_runbook_deleted compute_disk_deleted compute_snapshot_deleted compute_vm_role_assignment_created_or_updated container_registry_deleted event_hub_namespace_deleted event_hub_namespace_rule_authorized front_door_firewall_policy_deleted iam_role_assignment_created_or_updated key_vault_access_policy_created_or_updated key_vault_deleted kubernetes_cluster_deleted monitor_diagnostic_setting_deleted network_application_gateway_deleted network_application_security_group_deleted network_dns_zone_deleted network_firewall_deleted network_firewall_policy_deleted network_firewall_rule_created_or_updated network_firewall_rule_deleted network_security_group_created_or_updated network_security_group_deleted network_virtual_network_created_or_updated network_virtual_network_deleted network_vpn_connection_created_or_updated network_vpn_connection_deleted network_watcher_deleted resource_group_deleted sql_database_deleted sql_database_tde_created_or_updated sql_server_deleted sql_server_firewall_rule_created_or_updated sql_server_role_assignment_created_or_updated storage_account_deleted storage_account_key_regenerated storage_account_lifecycle_policy_updated

Query: Top 10 Source IPs

Usage

powerpipe query azure_activity_log_detections.query.activity_dashboard_logs_by_source_ip

Tailpipe Tables

azure_activity_log

Azure plugin

SQL

select
  tp_source_ip as "Source IP",
  count(*) as "Logs"
from
  azure_activity_log
where
  tp_source_ip is not null
group by
  tp_source_ip
order by
  count(*) desc
limit 10;

Dashboards

The query is used in the dashboards:

Activity Log Activity Dashboard