Log Analytics is a service that helps you collect and analyze data generated by resources in your cloud and on-premises environments.
This integration was integrated and tested with version 2022-10-01 of Azure Log Analytics.

Authorization

In order to connect to the Azure Log Analytics use either the Cortex XSOAR Azure App or the Self-Deployed Azure App.

Depending on the authentication method that you use, the integration parameters might change.

Note: The Azure account must have permission to manage applications in Entra ID (Azure AD). Any of the following Entra ID roles include the required permissions:

• Application administrator
• Application developer
• Cloud application administrator

In addition, the user that granted the authorization needs to be assigned the Log Analytics Reader role.
For the search job commands the user needs to be assigned the Log Analytics Contributor role.

To add these roles:
 1. In the Azure portal, go to `Log Analytics workspace` and select the workspace you are using -> Access control (IAM).
 2. From Access control (IAM) select: Add role assignment
 3. Select the user that granted the authorization and assign the Roles.

For more information, refer to the following Microsoft article.

Cortex XSOAR Azure Application

You need to grant Cortex XSOAR authorization to access Azure Log Analytics.
For more information, refer to the following article.

Note - The credentials are valid for a single instance only.

Self Deployed Application

To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal. To add the registration, see the Microsoft article.

Required permissions

• Azure Service Management - permission user_impersonation of type Delegated
• Log Analytics API - permission Data.Read of type Delegated

In the self-deployed mode you can authenticate, by using one of the following flows:

• Authorization Code flow
• Client Credentials flow

Authorization Code flow

---

1. In the instance configuration, select the Use a self-deployed Azure application - Authorization Code flow checkbox.
2. Enter your client ID in the ID / Client ID parameter (credentials username).
3. Enter your client secret in the Key / Client Secret parameter (credentials password).
4. Enter your tenant ID in the Token parameter.
5. Enter your redirect URI in the Redirect URI parameter.
6. Save the integration settings.
7. Run the !azure-log-analytics-generate-login-url command in the War Room and follow the instruction.
8. Run the azure-log-analytics-test command to test the connection and the authorization process.

Client Credentials Flow

---

Follow these steps for client-credentials configuration.

1. In the instance configuration, select the Use a self-deployed Azure application - Client Credentials Authorization Flow checkbox.
2. Enter your Client ID in the ID / Client ID parameter.
3. Enter your Client Secret in the Key / Client Secret parameter.
4. Enter your Tenant ID in the Tenant ID parameter.
5. Click Test to validate the URLs, token, and connection.

Get the additional instance parameters

To get the Subscription ID, Workspace Name, Workspace ID and Resource Group parameters, navigate in the Azure Portal to Azure Sentinel > YOUR-WORKSPACE > Settings and click the Workspace Settings tab.

Configure Azure Log Analytics on Cortex XSOAR

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for Azure Log Analytics.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Description	Required
   Token / Tenant ID	Received from the authorization process or from the self-deployed configuration process (find the tenant ID in your app overview page in the Azure portal)	False
   Token / Tenant ID		False
   ID / Client ID	Received from the authorization process or from the self-deployed configuration process.	False
   Key / Client Secret		False
   Certificate Thumbprint	Used for certificate authentication. As appears in the “Certificates & secrets” page of the app.	False
   Certificate Thumbprint	Used for certificate authentication. As appears in the “Certificates & secrets” page of the app.	False
   Private Key	Used for certificate authentication. The private key of the registered certificate.	False
   Use a self-deployed Azure application - Authorization Code flow	Check when authenticating using the Authorization Code flow.	False
   Use a self-deployed Azure application - Client Credentials Flow	Check when authenticating using the Client Credentials flow.	False
   Application redirect URI (for self-deployed mode)		False
   Authorization code	Get the Authorization code from steps 3-5 in the self deployed authorization process.	False
   Authorization code	Get the Authorization code from steps 3-5 in the self deployed authorization process.	False
   Use Azure Managed Identities	Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab.	False
   Azure Managed Identities Client ID	The Managed Identities client id for authentication - relevant only if the integration is running on Azure VM.	False
   Default Subscription ID	The parameter can be saved as 000-000 and added as an argument to each command, but Test button will fail.	True
   Default Resource Group Name	The parameter can be saved as 000-000 and added as an argument to each command, but Test button will fail.	True
   Default Workspace Name	The parameter can be saved as 000-000 and added as an argument to each command.	True
   Default Workspace ID (the UUID of the workspace, e.g. 123e4567-e89b-12d3-a456-426614174000)	The parameter can be saved as 000-000 and added as an argument to each command, but Test button will fail.	True
   Trust any certificate (not secure)		False
   Use system proxy settings		False
   Azure Cloud	Azure Cloud the K8S cluster resides in. See table below.	False
   Server URL	Use this option when required to customize the URL to the Azure management endpoint.	False

4. Azure cloud options

   Azure Cloud	Description
   Worldwide	The publicly accessible Azure Cloud
   US GCC	Azure cloud for the USA Government Cloud Community (GCC)
   US GCC-High	Azure cloud for the USA Government Cloud Community High (GCC-High)
   DoD	Azure cloud for the USA Department of Defense (DoD)
   Germany	Azure cloud for the German Government
   China	Azure cloud for the Chinese Government
   Custom	Custom endpoint configuration to the Azure cloud. See note below.

   • Note: In most cases, setting Azure cloud is preferred to setting Azure AD endpoint. Only use it in cases where a custom proxy URL is required for accessing a national cloud.
   • See further documentation in Using National Cloud.
5. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

azure-log-analytics-execute-query

---

Executes an Analytics query for data.

Base Command

azure-log-analytics-execute-query

Input

Argument Name	Description	Required
query	The query to execute.	Required
timespan	The timespan over which to query data. This is an ISO8601 time period value. This timespan is applied in addition to any timespans specified in the query expression.	Optional
timeout	The amount of time (in seconds) that a request will wait for the query response before a timeout occurs. Default is 10.	Optional
workspace_id	The Workspace ID. Note: This argument will override the instance parameter ‘Default Workspace ID’.	Optional

Context Output

Path	Type	Description
AzureLogAnalytics.Query.Query	String	The executed query.
AzureLogAnalytics.Query.TableName	String	The name of the query table.

Command Example

!azure-log-analytics-execute-query query="Usage | take 10" workspace_id=WORKSPACE_ID

Human Readable Output

Query Results

PrimaryResult

Tenant Id	Computer	Time Generated	Source System	Start Time	End Time	Resource Uri	Data Type	Solution	Batches Within Sla	Batches Outside Sla	Batches Capped	Total Batches	Avg Latency In Seconds	Quantity	Quantity Unit	Is Billable	Meter Id	Linked Meter Id	Type
TENANT_ID	Deprecated field: see http://aka.ms/LA-Usage	2020-07-30T04:00:00Z	OMS	2020-07-30T03:00:00Z	2020-07-30T04:00:00Z	/subscriptions/SUBSCRIPTION_ID/resourcegroups/RESOURCE_GROUP/providers/microsoft.operationalinsights/workspaces/WORKSPACE_NAME	Operation	LogManagement	0	0	0	0	0	0.00714	MBytes	false	METER_ID	00000000-0000-0000-0000-000000000000	Usage
TENANT_ID	Deprecated field: see http://aka.ms/LA-Usage	2020-07-30T04:00:00Z	OMS	2020-07-30T03:00:00Z	2020-07-30T04:00:00Z	/subscriptions/SUBSCRIPTION_ID/resourcegroups/RESOURCE_GROUP/providers/microsoft.operationalinsights/workspaces/WORKSPACE_NAME	SigninLogs	LogManagement	0	0	0	0	0	0.012602	MBytes	true	METER_ID	00000000-0000-0000-0000-000000000000	Usage
TENANT_ID	Deprecated field: see http://aka.ms/LA-Usage	2020-07-30T05:00:00Z	OMS	2020-07-30T04:00:00Z	2020-07-30T05:00:00Z	/subscriptions/SUBSCRIPTION_ID/resourcegroups/RESOURCE_GROUP/providers/microsoft.operationalinsights/workspaces/WORKSPACE_NAME	OfficeActivity	Office365/SecurityInsights	0	0	0	0	0	0.00201499908978072	MBytes	false	METER_ID	00000000-0000-0000-0000-000000000000	Usage
TENANT_ID	Deprecated field: see http://aka.ms/LA-Usage	2020-07-30T05:00:00Z	OMS	2020-07-30T04:00:00Z	2020-07-30T05:00:00Z	/subscriptions/SUBSCRIPTION_ID/resourcegroups/RESOURCE_GROUP/providers/microsoft.operationalinsights/workspaces/WORKSPACE_NAME	SigninLogs	LogManagement	0	0	0	0	0	0.009107	MBytes	true	METER_ID	00000000-0000-0000-0000-000000000000	Usage

azure-log-analytics-test

---

Tests connectivity to Azure Log Analytics.

Base Command

azure-log-analytics-test

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

#### Human Readable Output

>```✅ Success!```

### azure-log-analytics-list-saved-searches

***
Gets the saved searches of the Log Analytics workspace.

#### Base Command

`azure-log-analytics-list-saved-searches`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| limit | The maximum number of saved searches to return. Default is 50. | Optional |
| page | The page number from which to start a search. Default is 0. | Optional |
| subscription_id | The subscription ID to use. Note: This argument will override the instance parameter 'Default Subscription ID'. | Optional |
| resource_group_name | The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'. | Optional |
| workspace_name | The name of the resource group. Note: This argument will override the instance parameter 'Default Workspace Name'. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AzureLogAnalytics.SavedSearch.id | String | The ID of the saved search. |
| AzureLogAnalytics.SavedSearch.etag | String | The ETag of the saved search. |
| AzureLogAnalytics.SavedSearch.category | String | The category of the saved search. This helps users quickly find a saved search. |
| AzureLogAnalytics.SavedSearch.displayName | String | Display name of the saved search. |
| AzureLogAnalytics.SavedSearch.functionAlias | String | The function alias if the query serves as a function. |
| AzureLogAnalytics.SavedSearch.functionParameters | String | The optional function parameters if the query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax, refer to <https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions> |
| AzureLogAnalytics.SavedSearch.query | String | The query expression for the saved search. |
| AzureLogAnalytics.SavedSearch.tags | String | The tags attached to the saved search. |
| AzureLogAnalytics.SavedSearch.version | Number | The version number of the query language. The current version and default is 2. |
| AzureLogAnalytics.SavedSearch.type | String | The resource type, e.g., Microsoft.Compute/virtualMachines or Microsoft.Storage/storageAccounts. |

#### Command Example

```!azure-log-analytics-list-saved-searches limit=3```

#### Human Readable Output

>### Saved searches

>|Etag|Id|Category|Display Name|Function Alias|Function Parameters|Query|Tags|Version|Type|
>|---|---|---|---|---|---|---|---|---|---|
>| W/"datetime'2020-07-05T13%3A38%3A41.053438Z'" | test2 | category1 | test2 | heartbeat_func | a:int=1 | Heartbeat \| summarize Count() by Computer \| take a | {'name': 'Group', 'value': 'Computer'} | 2 | Microsoft.OperationalInsights/savedSearches |
>| W/"datetime'2020-07-28T18%3A43%3A56.8625448Z'" | test123 | Saved Search Test Category | test123 | heartbeat_func | a:int=1 | Heartbeat \| summarize Count() by Computer \| take a | {'name': 'Group', 'value': 'Computer'} | 2 | Microsoft.OperationalInsights/savedSearches |
>| W/"datetime'2020-07-30T11%3A41%3A35.1459664Z'" | test1234 | test | test |  |  |  SecurityAlert<br/>\| summarize arg_max(TimeGenerated, *) by SystemAlertId<br/>\| where SystemAlertId in("TEST_SYSTEM_ALERT_ID") |  | 2 | Microsoft.OperationalInsights/savedSearches |

### azure-log-analytics-get-saved-search-by-id

***
Gets a specified saved search from the Log Analytics workspace.

#### Base Command

`azure-log-analytics-get-saved-search-by-id`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| saved_search_id | The ID of the saved search. | Required |
| subscription_id | The subscription ID to use. Note: This argument will override the instance parameter 'Default Subscription ID'. | Optional |
| resource_group_name | The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'. | Optional |
| workspace_name | The name of the resource group. Note: This argument will override the instance parameter 'Default Workspace Name'. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AzureLogAnalytics.SavedSearch.id | String | The ID of the saved search. |
| AzureLogAnalytics.SavedSearch.etag | String | The ETag of the saved search. |
| AzureLogAnalytics.SavedSearch.category | String | The category of the saved search. This helps users quickly find a saved search. |
| AzureLogAnalytics.SavedSearch.displayName | String | The display name of the saved search. |
| AzureLogAnalytics.SavedSearch.functionAlias | String | The function alias if the query serves as a function. |
| AzureLogAnalytics.SavedSearch.functionParameters | String | The optional function parameters if the query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax see the Microsoft documentation, <https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions> |
| AzureLogAnalytics.SavedSearch.query | String | The query expression for the saved search. |
| AzureLogAnalytics.SavedSearch.tags | String | The tags attached to the saved search. |
| AzureLogAnalytics.SavedSearch.version | Number | The version number of the query language. The current version and default is 2. |
| AzureLogAnalytics.SavedSearch.type | String | The resource type, e.g., Microsoft.Compute/virtualMachines or Microsoft.Storage/storageAccounts. |

#### Command Example

```!azure-log-analytics-get-saved-search-by-id saved_search_id=test1234```

#### Human Readable Output

>### Saved search `test1234` properties

>|Etag|Id|Category|Display Name|Query|Version|
>|---|---|---|---|---|---|
>| W/"datetime'2020-07-30T12%3A21%3A05.3197505Z'" | test1234 | test | test | SecurityAlert &#124; summarize arg_max(TimeGenerated, *) by SystemAlertId &#124; where SystemAlertId in("TEST_SYSTEM_ALERT_ID") | 2 |

### azure-log-analytics-create-or-update-saved-search

***
Creates or updates a saved search from the Log Analytics workspace.

#### Base Command

`azure-log-analytics-create-or-update-saved-search`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| saved_search_id | The ID of the saved search. | Required |
| etag | The ETag of the saved search. This argument is required for updating an existing saved search. | Optional |
| category | The category of the saved search. This helps users quickly find a saved search. | Required |
| display_name | The display name of the saved search. | Required |
| function_alias | The function alias if the query serves as a function. | Optional |
| function_parameters | The optional function parameters if the query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax, refer to <https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions>. | Optional |
| query | The query expression for the saved search. | Required |
| tags | The tags attached to the saved search. Value should be in the following format: 'name=value;name=value'. | Optional |
| subscription_id | The subscription ID to use. Note: This argument will override the instance parameter 'Default Subscription ID'. | Optional |
| resource_group_name | The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'. | Optional |
| workspace_name | The name of the resource group. Note: This argument will override the instance parameter 'Default Workspace Name'. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AzureLogAnalytics.SavedSearch.id | String | The ID of the saved search. |
| AzureLogAnalytics.SavedSearch.etag | String | The ETag of the saved search. |
| AzureLogAnalytics.SavedSearch.category | String | The category of the saved search. This helps users quickly find a saved search. |
| AzureLogAnalytics.SavedSearch.displayName | String | The display name of the saved search. |
| AzureLogAnalytics.SavedSearch.functionAlias | String | The function alias if the query serves as a function. |
| AzureLogAnalytics.SavedSearch.functionParameters | String | The optional function parameters if the query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax, refer to <https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions>. |
| AzureLogAnalytics.SavedSearch.query | String | The query expression for the saved search. |
| AzureLogAnalytics.SavedSearch.tags | String | The tags attached to the saved search. |
| AzureLogAnalytics.SavedSearch.version | Number | The version number of the query language. The current version and default is 2. |
| AzureLogAnalytics.SavedSearch.type | String | The resource type, e.g., Microsoft.Compute/virtualMachines or Microsoft.Storage/storageAccounts. |

#### Command Example

!azure-log-analytics-create-or-update-saved-search saved_search_id=”test1234” category=”test” display_name=”new display name test” query=`SecurityAlert
| summarize arg_max(TimeGenerated, *) by SystemAlertId
| where SystemAlertId in(“TEST_SYSTEM_ALERT_ID”)

#### Human Readable Output

>### Saved search `test1234` properties

>|Etag|Id|Category|Display Name|Query|Version|
>|---|---|---|---|---|---|
>| W/"datetime'2020-07-30T12%3A21%3A05.3197505Z'" | test1234 | test | new display name test | SecurityAlert | summarize arg_max(TimeGenerated, *) by SystemAlertId | where SystemAlertId in("TEST_SYSTEM_ALERT_ID") | 2 |

### azure-log-analytics-delete-saved-search

***
Deletes a specified saved search in the Log Analytics workspace.

#### Base Command

`azure-log-analytics-delete-saved-search`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| saved_search_id | The ID of the saved search. | Required |
| subscription_id | The subscription ID to use. Note: This argument will override the instance parameter 'Default Subscription ID'. | Optional |
| resource_group_name | The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'. | Optional |
| workspace_name | The name of the resource group. Note: This argument will override the instance parameter 'Default Workspace Name'. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!azure-log-analytics-delete-saved-search saved_search_id=test1234```

#### Human Readable Output

>Successfully deleted the saved search test1234.

### azure-log-analytics-generate-login-url

***
Generate the login url used for Authorization code flow.

#### Base Command

`azure-log-analytics-generate-login-url`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example

```azure-log-analytics-generate-login-url```

#### Human Readable Output

>### Authorization instructions
>
>1. Click on the login URL to sign in and grant Cortex XSOAR permissions for your Azure Service Management.
You will be automatically redirected to a link with the following structure:
```REDIRECT_URI?code=AUTH_CODE&session_state=SESSION_STATE```
>2. Copy the `AUTH_CODE` (without the `“code=”` prefix, and the `session_state` parameter)
and paste it in your instance configuration under the **Authorization code** parameter.

### azure-log-analytics-subscriptions-list

***
List all subscriptions for a tenant.

#### Base Command

`azure-log-analytics-subscriptions-list`

#### Input

There are no input arguments for this command.

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AzureLogAnalytics.Subscription.authorizationSource | String | The authorization source of the request. |
| AzureLogAnalytics.Subscription.displayName | String | The subscription display name. |
| AzureLogAnalytics.Subscription.id | String | The fully qualified ID for the subscription. For example, /subscriptions/8d65815f-a5b6-402f-9298-045155da7d74. |
| AzureLogAnalytics.Subscription.managedByTenants | Unknown | An array containing the tenants managing the subscription. |
| AzureLogAnalytics.Subscription.state | Unknown | The subscription state. Possible values are Enabled, Warned, PastDue, Disabled, and Deleted. |
| AzureLogAnalytics.Subscription.subscriptionId | String | The subscription ID. |
| AzureLogAnalytics.Subscription.subscriptionPolicies | Unknown | The subscription policies. |
| AzureLogAnalytics.Subscription.tags | Object | The tags attached to the subscription. |
| AzureLogAnalytics.Subscription.tenantId | String | The subscription tenant ID. |

### azure-log-analytics-workspace-list

***
Gets workspaces in a resource group.

#### Base Command

`azure-log-analytics-workspace-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| subscription_id | The subscription ID. Note: This argument will override the instance parameter 'Default Subscription ID'. | Optional |
| resource_group_name | The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AzureLogAnalytics.workspace.etag | String | The etag of the workspace. |
| AzureLogAnalytics.workspace.id | String | Fully qualified resource ID for the resource. |
| AzureLogAnalytics.workspace.identity.principalId | String | The principal ID of resource identity. |
| AzureLogAnalytics.workspace.identity.tenantId | String | The tenant ID of resource. |
| AzureLogAnalytics.workspace.identity.type | String | Type of managed service identity. |
| AzureLogAnalytics.workspace.identity.userAssignedIdentities.clientId | String | The client id of user assigned identity. |
| AzureLogAnalytics.workspace.identity.userAssignedIdentities.principalId | String | The principal id of user assigned identity. |
| AzureLogAnalytics.workspace.location | String | The geo-location where the resource lives. |
| AzureLogAnalytics.workspace.name | String | The name of the resource. |
| AzureLogAnalytics.workspace.properties.createdDate | String | Workspace creation date. |
| AzureLogAnalytics.workspace.properties.customerId | String | This is a read-only property. Represents the ID associated with the workspace. |
| AzureLogAnalytics.workspace.properties.defaultDataCollectionRuleResourceId | String | The resource ID of the default Data Collection Rule to use for this workspace. |
| AzureLogAnalytics.workspace.properties.features.clusterResourceId | String | Dedicated LA cluster resourceId that is linked to the workspaces. |
| AzureLogAnalytics.workspace.properties.features.disableLocalAuth | Boolean | Disable Non-AAD based Auth. |
| AzureLogAnalytics.workspace.properties.features.enableDataExport | Boolean | Flag that indicate if data should be exported. |
| AzureLogAnalytics.workspace.properties.features.enableLogAccessUsingOnlyResourcePermissions | Boolean | Flag that indicate which permission to use - resource or workspace or both. |
| AzureLogAnalytics.workspace.properties.features.immediatePurgeDataOn30Days | Boolean | Flag that describes if we want to remove the data after 30 days. |
| AzureLogAnalytics.workspace.properties.forceCmkForQuery | Boolean | Indicates whether customer managed storage is mandatory for query management. |
| AzureLogAnalytics.workspace.properties.modifiedDate | String | Workspace modification date. |
| AzureLogAnalytics.workspace.properties.privateLinkScopedResources.resourceId | String | The full resource Id of the private link scope resource. |
| AzureLogAnalytics.workspace.properties.privateLinkScopedResources.scopeId | String | The private link scope unique Identifier. |
| AzureLogAnalytics.workspace.properties.provisioningState | String | The provisioning state of the workspace. |
| AzureLogAnalytics.workspace.properties.publicNetworkAccessForIngestion | String | The network access type for accessing Log Analytics ingestion. |
| AzureLogAnalytics.workspace.properties.publicNetworkAccessForQuery | String | The network access type for accessing Log Analytics query. |
| AzureLogAnalytics.workspace.properties.retentionInDays | Number | The workspace data retention in days. Allowed values are per pricing plan. See pricing tiers documentation for details. |
| AzureLogAnalytics.workspace.properties.sku.capacityReservationLevel | Number | The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected. |
| AzureLogAnalytics.workspace.properties.sku.lastSkuUpdate | String | lastSkuUpdate |
| AzureLogAnalytics.workspace.properties.sku.name | String | The name of the SKU. |
| AzureLogAnalytics.workspace.properties.workspaceCapping.dailyQuotaGb | Number | The workspace daily quota for ingestion. |
| AzureLogAnalytics.workspace.properties.workspaceCapping.dataIngestionStatus | String | The status of data ingestion for this workspace. |
| AzureLogAnalytics.workspace.properties.workspaceCapping.quotaNextResetTime | String | The time when the quota will be rest. |
| AzureLogAnalytics.workspace.systemData.createdAt | String | The timestamp of resource creation \(UTC\). |
| AzureLogAnalytics.workspace.systemData.createdBy | String | The identity that created the resource. |
| AzureLogAnalytics.workspace.systemData.createdByType | String | The type of identity that created the resource. |
| AzureLogAnalytics.workspace.systemData.lastModifiedAt | String | The timestamp of resource last modification \(UTC\). |
| AzureLogAnalytics.workspace.systemData.lastModifiedBy | String | The identity that last modified the resource. |
| AzureLogAnalytics.workspace.systemData.lastModifiedByType | String | lastModifiedByType |
| AzureLogAnalytics.workspace.tags | Object | Resource tags. |
| AzureLogAnalytics.workspace.type | String | The type of the resource. |

### azure-log-analytics-resource-group-list

***
List all resource groups for a subscription.

#### Base Command

`azure-log-analytics-resource-group-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| subscription_id | The subscription ID. Note: This argument will override the instance parameter 'Default Subscription ID'. | Optional |
| limit | Limit on the number of resource groups to return. Default is 50. | Optional |
| tag | A single tag in the form of '{"Tag Name":"Tag Value"}' to filter the list by. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AzureLogAnalytics.ResourceGroup.id | String | The ID of the resource group. |
| AzureLogAnalytics.ResourceGroup.location | String | The location of the resource group. |
| AzureLogAnalytics.ResourceGroup.managedBy | String | The ID of the resource that manages this resource group. |
| AzureLogAnalytics.ResourceGroup.name | String | The name of the resource group. |
| AzureLogAnalytics.ResourceGroup.properties.provisioningState | String | The provisioning state. |
| AzureLogAnalytics.ResourceGroup.tags | Object | The tags attached to the resource group. |
| AzureLogAnalytics.ResourceGroup.type | String | The type of the resource group. |

### azure-log-analytics-auth-reset

***
Run this command if for some reason you need to rerun the authentication process.

#### Base Command

`azure-log-analytics-auth-reset`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

### azure-log-analytics-run-search-job

***
Run a search job to fetch records from large datasets into a new search results table in your workspace.

#### Base Command

`azure-log-analytics-run-search-job`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| table_name | The name of the table to add. Must contain '_SRCH' suffix. Example value: AuditLogs_SRCH. | Required |
| limit | Maximum number of records in the result set, up to one million records. Default is 50. | Optional |
| query | Log query written in KQL format to retrieve data. Search job queries must always start with a table name. For the proper syntax, see <https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/whereoperator> | Required |
| start_search_time | Start of the time range to search. The value can either be in minutes, days, weeks, or a simple ISO 8601 format such as "2023-10-31T00:00:00Z". Default is 1 day. | Optional |
| end_search_time | End of the time range to search. The value can either be in minutes, days, weeks, or a simple ISO 8601 format such as "2023-10-31T00:00:00Z". Default is now. | Optional |
| timeout | The timeout in seconds until polling ends. Default is 600. | Optional |
| interval | The interval in seconds between each poll. Default is 60. | Optional |
| subscription_id | The subscription ID to use. Note: This argument will override the instance parameter 'Default Subscription ID'. | Optional |
| resource_group_name | The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'. | Optional |
| workspace_name | The name of the resource group. Note: This argument will override the instance parameter 'Default Workspace Name'. | Optional |
| first_run | This argument is used to determine whether the current execution of the command is the initial run. After the command is executed, the argument is updated to 'false.' During polling, the code checks the status only for the first execution. This argument is for a developer, not for a user. Default is True. | Optional |
| hide_polling_output | Hide the polling message and only print the final status at the end. This argument is for a developer, not for a user. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AzureLogAnalytics.RunSearchJob.TableName | String | Table name. |
| AzureLogAnalytics.RunSearchJob.Query | String | The query that was used to create the table. |

#### Command example

```!azure-log-analytics-run-search-job table_name=test_SRCH query=AuditLogs limit=10```

#### Human Readable Output

>The command was sent successfully. You can check the status of the command by running `!azure-log-analytics-get-search-job` command or wait.

After polling is ending
> The test_SRCH table created successfully. In order to get the table, run `!azure-log-analytics-execute-query query=test_SRCH`

### azure-log-analytics-get-search-job

***
Gets a Log Analytics workspace table.

#### Base Command

`azure-log-analytics-get-search-job`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| table_name | The name of the table. Example value: AuditLogs_SRCH. | Optional |
| subscription_id | The subscription ID to use. Note: This argument will override the instance parameter 'Default Subscription ID'. | Optional |
| resource_group_name | The name of the resource group within the user's subscription. Note: This argument will override the instance parameter 'Default Resource Group Name'. | Optional |
| workspace_name | The name of the resource group. Note: This argument will override the instance parameter 'Default Workspace Name'. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AzureLogAnalytics.SearchJob.systemData.createdBy | String | The identity that created the resource. |
| AzureLogAnalytics.SearchJob.systemData.createdAt | Date | The timestamp of resource creation (UTC). |
| AzureLogAnalytics.SearchJob.properties.resultStatistics.progress | Number | Search job completion percentage. |
| AzureLogAnalytics.SearchJob.properties.resultStatistics.ingestedRecords | Number | The number of rows that were returned by the search job. |
| AzureLogAnalytics.SearchJob.properties.resultStatistics.scannedGb | Number | Amount of scanned data in the search job. |
| AzureLogAnalytics.SearchJob.properties.searchResults.query | String | Search job query. |
| AzureLogAnalytics.SearchJob.properties.searchResults.description | String | Search job description. |
| AzureLogAnalytics.SearchJob.properties.searchResults.limit | Number | Limit the search job to return up to the specified number of rows. |
| AzureLogAnalytics.SearchJob.properties.searchResults.startSearchTime | Date | The timestamp to start the search from (UTC). |
| AzureLogAnalytics.SearchJob.properties.searchResults.endSearchTime | Date | The timestamp to end the search by (UTC). |
| AzureLogAnalytics.SearchJob.properties.searchResults.sourceTable | String | The table used in the search job. |
| AzureLogAnalytics.SearchJob.properties.schema.name | String | Table name. |
| AzureLogAnalytics.SearchJob.properties.schema.tableSubType | String | The subtype describes what APIs can be used to interact with the table, and what features are available against it (Any, Classic, DataCollectionRuleBased). |
| AzureLogAnalytics.SearchJob.properties.schema.tableType | String | Table's creator. |
| AzureLogAnalytics.SearchJob.properties.schema.displayName | String | Table display name. |
| AzureLogAnalytics.SearchJob.properties.schema.description | String | Table description. |
| AzureLogAnalytics.SearchJob.properties.schema.columns | List | A list of table custom columns. |
| AzureLogAnalytics.SearchJob.properties.schema.standardColumns.isHidden | Boolean | Is column hidden. |
| AzureLogAnalytics.SearchJob.properties.schema.standardColumns.name | String | Column name. |
| AzureLogAnalytics.SearchJob.properties.schema.standardColumns.type | String | Column data type (bool, datetime, dynamic, guid, int, long, real, string). |
| AzureLogAnalytics.SearchJob.properties.schema.standardColumns.dataTypeHint | String | Column data type logical hint (armPath, guid, ip, uri). |
| AzureLogAnalytics.SearchJob.properties.schema.standardColumns.displayName | String | Column display name. |
| AzureLogAnalytics.SearchJob.properties.schema.standardColumns.description | String | Column description. |
| AzureLogAnalytics.SearchJob.properties.schema.standardColumns.isDefaultDisplay | Boolean | Is displayed by default. |
| AzureLogAnalytics.SearchJob.properties.schema.categories | String | Table category. |
| AzureLogAnalytics.SearchJob.properties.schema.labels | String | Table labels. |
| AzureLogAnalytics.SearchJob.properties.schema.source | String | Table's creator (customer, microsoft). |
| AzureLogAnalytics.SearchJob.properties.schema.solutions | String | List of solutions the table is affiliated with. |
| AzureLogAnalytics.SearchJob.properties.provisioningState | String | Table's current provisioning state (Deleting, InProgress, Succeeded, Updating). If set to 'updating', indicates a resource lock due to an ongoing operation, forbidding any update to the table until the ongoing operation is concluded. |
| AzureLogAnalytics.SearchJob.properties.retentionInDays | Number | The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention. |
| AzureLogAnalytics.SearchJob.properties.totalRetentionInDays | Number | The table total retention in days, between 4 and 2556. Setting this property to -1 will default to table retention. |
| AzureLogAnalytics.SearchJob.properties.archiveRetentionInDays | Number | The table data archive retention in days. Calculated as (totalRetentionInDays-retentionInDays). |
| AzureLogAnalytics.SearchJob.properties.retentionInDaysAsDefault | Boolean | True - Value originates from workspace retention in days, False - Customer specific. |
| AzureLogAnalytics.SearchJob.properties.totalRetentionInDaysAsDefault | Boolean | True - Value originates from retention in days, False - Customer specific. |
| AzureLogAnalytics.SearchJob.properties.plan | String | Instruct the system how to handle and charge the logs ingested to this table. |
| AzureLogAnalytics.SearchJob.id | String | Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. |
| AzureLogAnalytics.SearchJob.name | String | The name of the resource. |

#### Command example

```!azure-log-analytics-get-search-job table_name=test_SRCH```

#### Context Example

```json
{
    "AzureLogAnalytics": {
        "SearchJob": {
            "id": "/tables/test_SRCH",
            "name": "test_SRCH",
            "properties": {
                "archiveRetentionInDays": 0,
                "createDate": "2023-11-01T21:27:50.3032268Z",
                "createdBy": "TEST",
                "lastPlanModifiedDate": "2023-11-01T21:27:50.3031023Z",
                "plan": "Analytics",
                "provisioningState": "InProgress",
                "resultStatistics": {
                    "ingestedRecords": 0,
                    "progress": 0,
                    "scannedGb": 0
                },
                "retentionInDays": 30,
                "retentionInDaysAsDefault": true,
                "schema": {
                    "columns": [
                        {
                            "isDefaultDisplay": false,
                            "isHidden": false,
                            "name": "_OriginalTenantId",
                            "type": "string"
                        },
                        {
                            "isDefaultDisplay": false,
                            "isHidden": false,
                            "name": "SourceSystem",
                            "type": "string"
                        }
                    ],
                    "isTroubleshootingAllowed": false,
                    "name": "test_SRCH",
                    "solutions": [
                        "LogManagement"
                    ],
                    "standardColumns": [
                        {
                            "isDefaultDisplay": false,
                            "isHidden": false,
                            "name": "TenantId",
                            "type": "guid"
                        }
                    ],
                    "tableSubType": "DataCollectionRuleBased",
                    "tableType": "SearchResults"
                },
                "searchResults": {
                    "azureAsyncOperationId": "TEST",
                    "description": "This table was created using a Search Job with the following query: 'AuditLogs'.",
                    "endSearchTime": "2023-11-01T21:27:43.744Z",
                    "limit": 10,
                    "query": "AuditLogs",
                    "sourceTable": "AuditLogs",
                    "startSearchTime": "2023-10-31T21:27:43.735Z"
                },
                "totalRetentionInDays": 30,
                "totalRetentionInDaysAsDefault": true
            },
            "systemData": {
                "createdAt": "2023-11-01T21:27:50.3032268Z",
                "createdBy": "TEST",
                "createdByType": null,
                "lastModifiedAt": null,
                "lastModifiedBy": null,
                "lastModifiedByType": null
            }
        }
    }
}

Human Readable Output

Search Job

Create Date	Description	Name	Plan	Query	endSearchTime	provisioningState	startSearchTime
2023-11-02T17:28:22.9374877Z	This table was created using a Search Job with the following query: ‘AuditLogs’.	test_SRCH	Analytics	AuditLogs	2023-11-02T17:28:18.602Z	InProgress	2023-11-01T17:28:18.592Z

azure-log-analytics-delete-search-job

---

Delete a Log Analytics workspace table. We recommend you delete the search job when you’re done querying the table. This reduces workspace clutter and extra charges for data retention.

Base Command

azure-log-analytics-delete-search-job

Input

Argument Name	Description	Required
table_name	The name of the table. Must contain ‘_SRCH’ suffix. Example value: AuditLogs_SRCH.	Optional
subscription_id	The subscription ID to use. Note: This argument will override the instance parameter ‘Default Subscription ID’.	Optional
resource_group_name	The name of the resource group within the user’s subscription. Note: This argument will override the instance parameter ‘Default Resource Group Name’.	Optional
workspace_name	The name of the resource group. Note: This argument will override the instance parameter ‘Default Workspace Name’.	Optional

Context Output

There is no context output for this command.

Command example

!azure-log-analytics-delete-search-job table_name=test_SRCH

Human Readable Output

Search job test_SRCH deleted successfully.

Troubleshooting

In case of a hash verification error:

1. Use the Oproxy flow to generate a new pair of credentials. This is crucial as it ensures that any issues related to authentication can be mitigated with fresh credentials.
2. Execute the command !azure-log-analytics-auth-reset. This command resets the authentication mechanism, allowing for the new credentials to be accepted.
3. Insert the newly created credentials into the original instance where the error occurred. Make sure the credentials are entered correctly to avoid further errors.
4. After updating the credentials, test the integration.