Azure DevOps Parsing Rule

Details

Rules (XQL)

[INGEST:vendor="msft", product="azure", target_dataset="msft_azure_devops_raw", no_hit = drop]
// Supported timestamp is for UTC time YYYY-mm-ddTHH:MM:SS.ssssZ format. E.g; 2025-02-04T11:23:29.0324070Z
// This filter supports ingestion from Log Analytics
filter to_string(TimeGenerated) ~= "\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+Z"
       AND Type = "AzureDevOpsAuditing"
| alter
    _time = TimeGenerated;

 // This filter supports ingestion from Azure Event Hub.
filter to_string(_raw_log->[0].eventTime) ~= "\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+Z" AND _raw_log->[0].eventType = "AzureDevOpsAuditEvent"
| alter
     tmp_time = _raw_log->[0].eventTime
| alter
     _time = parse_timestamp("%Y-%m-%dT%H:%M:%E*SZ", tmp_time)
| fields -tmp_*;