{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Azure Activity Logs for Azure Service Health Analysis Workbook" }, "name": "text - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "76e0f423-6828-47f3-aa86-522604bbbc6f", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "description": "Azure Subscription where is the Log Analytics with Activity Logs informaiton", "isRequired": true, "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\",subscriptionId), label = subscriptionId\r\n| order by value ", "crossComponentResources": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": "/subscriptions/fcb7d51b-418f-45a9-8418-5c0f17e343c8" }, { "id": "ea100a5b-3c79-4761-8235-6a7989c83da5", "version": "KqlParameterItem/1.0", "name": "LAworkspace", "label": "Log Analytics workspace", "type": 5, "description": "Log Analytics workspace where the Activity Logs information is sent", "isRequired": true, "query": "where type == 'microsoft.operationalinsights/workspaces'\r\n| project id\r\n| order by id asc", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": "" }, { "id": "6b112ffe-a3a2-4b9e-a17a-c4ea5af739d7", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 86400000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 2592000000 } } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{LAworkspace}" ], "parameters": [ { "id": "2fb175cb-a2b6-4dd3-9473-886a8db4cd9c", "version": "KqlParameterItem/1.0", "name": "TrackingID_P", "label": "Tracking ID", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "AzureActivity\r\n| where CategoryValue == \"ServiceHealth\"\r\n| extend TrackingId = tostring(Properties_d.trackingId)\r\n| distinct TrackingId\r\n| order by TrackingId asc", "crossComponentResources": [ "{LAworkspace}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where CategoryValue == \"ServiceHealth\" \r\n| summarize TimeGenerated=arg_max(TimeGenerated,*) by SubscriptionId\r\n| extend SubscriptionId == strcat('/subscriptions/', SubscriptionId)", "size": 1, "showAnalytics": true, "title": "Subscriptions Impacted", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LAworkspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "22ch" } }, { "columnMatch": "TrackingId", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "14ch" } }, { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Active", "representation": "2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Resolved", "representation": "Resolved", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "more", "text": "{0}{1}" } ], "customColumnWidthSetting": "12ch" } }, { "columnMatch": "Impact Start Time", "formatter": 5 }, { "columnMatch": "Level", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Information", "representation": "info", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Warning", "representation": "warning", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Error", "representation": "error", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Unknown", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentType", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Incident", "representation": "error", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Maintenance", "representation": "Tools", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "ActionRequired", "representation": "Clock", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Informational", "representation": "1", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "more", "text": "{0}{1}" } ] } }, { "columnMatch": "ImpactedSubscriptions", "formatter": 5 }, { "columnMatch": "# Subs.", "formatter": 8, "formatOptions": { "min": -1, "palette": "red" } }, { "columnMatch": "ImpactedRegions", "formatter": 5 }, { "columnMatch": "# Regions", "formatter": 8, "formatOptions": { "min": -1, "palette": "magenta" } }, { "columnMatch": "ImpactMitigationTime", "formatter": 5 }, { "columnMatch": "ResolutionTime (hours)", "formatter": 4, "formatOptions": { "min": -1, "palette": "orange", "customColumnWidthSetting": "26ch" } } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SubscriptionId", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true } }, "showBorder": false } }, "customWidth": "30", "name": "query - 0 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where CategoryValue == \"ServiceHealth\"\r\n| extend TrackingId = tostring(Properties_d.trackingId)\r\n| summarize arg_max(TimeGenerated,*) by TrackingId\r\n| where TrackingId in ({TrackingID_P:value}) or '{TrackingID_P:label}'=='All'\r\n| extend ImpactedRegions = tostring(Properties_d.region)\r\n| summarize count() by ImpactedRegions", "size": 1, "title": "Impacted Regions", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "ImpactedRegions", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "35", "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where CategoryValue == \"ServiceHealth\"\r\n| extend TrackingId = tostring(Properties_d.trackingId)\r\n| summarize arg_max(TimeGenerated,*) by TrackingId\r\n| where TrackingId in ({TrackingID_P:value}) or '{TrackingID_P:label}'=='All'\r\n| extend IncidentType= tostring(Properties_d.incidentType)\r\n| summarize count() by IncidentType", "size": 1, "title": "Type of Incidents", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "titleContent": { "columnMatch": "IncidentType", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Maintenance", "color": "gray" }, { "seriesName": "Incident", "color": "yellowDark" }, { "seriesName": "ActionRequired", "color": "redBright" } ] } }, "customWidth": "35", "name": "query - 4 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where CategoryValue == \"ServiceHealth\"\r\n| extend TrackingId = tostring(Properties_d.trackingId)\r\n| summarize arg_max(TimeGenerated,*) by TrackingId\r\n| where TrackingId in ({TrackingID_P:value}) or '{TrackingID_P:label}'=='All'\r\n| extend Status = tostring(Properties_d.activityStatusValue)\r\n| summarize count() by Status", "size": 0, "title": "Service Health on Status", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "titleContent": { "columnMatch": "IncidentType", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Active", "color": "red" }, { "seriesName": "Resolved", "color": "green" } ] } }, "customWidth": "45", "name": "query - 4 - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where CategoryValue == \"ServiceHealth\"\r\n| extend TrackingId = tostring(Properties_d.trackingId)\r\n| summarize arg_max(TimeGenerated,*) by TrackingId\r\n| where TrackingId in ({TrackingID_P:value}) or '{TrackingID_P:label}'=='All'\r\n| extend Service = tostring(Properties_d.service)\r\n| summarize count() by Service", "size": 0, "title": "Service Health Across Services", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "tileSettings": { "titleContent": { "columnMatch": "IncidentType", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Active", "color": "red" }, { "seriesName": "Resolved", "color": "green" } ] } }, "customWidth": "55", "name": "query - 4 - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where CategoryValue == \"ServiceHealth\"\r\n| extend TrackingId = tostring(Properties_d.trackingId)\r\n| summarize arg_max(TimeGenerated,*) by TrackingId\r\n| where TrackingId in ({TrackingID_P:value}) or '{TrackingID_P:label}'=='All'\r\n| extend Service = tostring(Properties_d.service)\r\n| extend ImpactMitigationTime = tostring(Properties_d.impactMitigationTime)\r\n| extend ImpactStartTime = tostring(Properties_d.impactStartTime)\r\n| extend [\"ResolutionTime\"]=datetime_diff('hour',todatetime(ImpactMitigationTime),todatetime(ImpactStartTime))\r\n| extend ImpactedRegions = todynamic(parse_json(tostring(parse_json(tostring(parse_json(Properties).impactedServices))[0].ImpactedRegions)))\r\n| mv-expand ImpactedRegions\r\n| project Service,ImpactedRegions.RegionName, [\"ResolutionTime\"], _ResourceId", "size": 0, "title": "Resolution Time", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "ResolutionTime", "formatter": 8, "formatOptions": { "palette": "redDark" }, "numberFormat": { "unit": 25, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "_ResourceId", "formatter": 5 } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "_ResourceId" ], "expandTopLevel": true } }, "tileSettings": { "titleContent": { "columnMatch": "IncidentType", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Active", "color": "red" }, { "seriesName": "Resolved", "color": "green" } ] } }, "customWidth": "70", "name": "query - 4 - Copy - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where CategoryValue == \"ServiceHealth\"\r\n| extend TrackingId = tostring(Properties_d.trackingId)\r\n| summarize arg_max(TimeGenerated,*) by TrackingId\r\n| where TrackingId in ({TrackingID_P:value}) or '{TrackingID_P:label}'=='All'\r\n| extend Stage = tostring(parse_json(Properties).stage)\r\n| summarize count() by Stage", "size": 0, "title": "Current Stage", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Stage", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Active", "color": "red" }, { "seriesName": "Resolved", "color": "green" } ] } }, "customWidth": "30", "name": "query - 4 - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where CategoryValue == \"ServiceHealth\"\r\n| extend TrackingId = tostring(Properties_d.trackingId)\r\n| summarize arg_max(TimeGenerated,) by TrackingId\r\n| where TrackingId in ({TrackingID_P:value}) or '{TrackingID_P:label}'=='All'\r\n//| where Level in ('Warning','Error','Information')\r\n| extend IncidentType= tostring(Properties_d.incidentType)\r\n//| where IncidentType in ('Incident','Maintenance','ActionRequired')\r\n| extend ImpactMitigationTime = tostring(Properties_d.impactMitigationTime)\r\n| extend ImpactStartTime = tostring(Properties_d.impactStartTime)\r\n| extend Status = tostring(Properties_d.activityStatusValue)\r\n| extend Service = tostring(Properties_d.service)\r\n| extend Title = tostring(Properties_d.defaultLanguageTitle)\r\n| extend ImpactedRegions = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).impactedServices))[0].ImpactedRegions)))\r\n| summarize ImpactedSubscriptions=make_set(SubscriptionId), TimeGenerated=arg_max(TimeGenerated,) by Level, ImpactedRegions, Service, TrackingId, Status\r\n| project TimeGenerated\r\n , TrackingId\r\n , Title\r\n , Status\r\n , [\"Impact Start Time\"]=todatetime(ImpactStartTime)\r\n , Level\r\n , IncidentType\r\n , ImpactedSubscriptions\r\n , Service\r\n , [\"# Subs.\"]=array_length(ImpactedSubscriptions)\r\n , ImpactedRegions\r\n , [\"# Regions\"]=array_length(parse_json(ImpactedRegions))\r\n , todatetime(ImpactMitigationTime)\r\n , [\"ResolutionTime (hours)\"]=datetime_diff('hour',todatetime(ImpactMitigationTime),todatetime(ImpactStartTime))\r\n| order by TimeGenerated ", "size": 0, "showAnalytics": true, "title": "Analysis of incident", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LAworkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "22ch" } }, { "columnMatch": "TrackingId", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "14ch" } }, { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Active", "representation": "2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Resolved", "representation": "Resolved", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "more", "text": "{0}{1}" } ], "customColumnWidthSetting": "12ch" } }, { "columnMatch": "Impact Start Time", "formatter": 5 }, { "columnMatch": "Level", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Information", "representation": "info", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Warning", "representation": "warning", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Error", "representation": "error", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Unknown", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentType", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Incident", "representation": "error", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Maintenance", "representation": "Tools", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "ActionRequired", "representation": "Clock", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Informational", "representation": "1", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "more", "text": "{0}{1}" } ] } }, { "columnMatch": "ImpactedSubscriptions", "formatter": 5 }, { "columnMatch": "# Subs.", "formatter": 8, "formatOptions": { "min": -1, "palette": "red" } }, { "columnMatch": "ImpactedRegions", "formatter": 5 }, { "columnMatch": "# Regions", "formatter": 8, "formatOptions": { "min": -1, "palette": "magenta" } }, { "columnMatch": "ImpactMitigationTime", "formatter": 5 }, { "columnMatch": "ResolutionTime (hours)", "formatter": 4, "formatOptions": { "min": -1, "palette": "orange", "customColumnWidthSetting": "26ch" } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_link_TrackingId_1", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "$gen_link_TrackingId_1", "sortOrder": 1 } ] }, "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where CategoryValue == \"ServiceHealth\"\r\n| extend TrackingId = tostring(Properties_d.trackingId)\r\n| where TrackingId in ({TrackingID_P:value}) or '{TrackingID_P:label}'=='All'\r\n| summarize ImpactedSubscriptions=make_set(SubscriptionId) by TrackingId\r\n| project ImpactedSubscriptions, TrackingId\r\n| mv-expand ImpactedSubscriptions\r\n| project Subscription=strcat('/subscriptions/',ImpactedSubscriptions), TrackingId\r\n| extend Info=strcat('https://app.azure.com/h/',TrackingId)\r\n| order by TrackingId asc", "size": 0, "showAnalytics": true, "title": "Affected subscriptions", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LAworkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TrackingId", "formatter": 1, "formatOptions": { "linkColumn": "Info", "linkTarget": "Url" } }, { "columnMatch": "Info", "formatter": 5, "formatOptions": { "linkTarget": "Url", "linkLabel": "Shareable link" } } ], "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where CategoryValue == \"ServiceHealth\"\r\n| extend TrackingId = tostring(Properties_d.trackingId)\r\n| where TrackingId in ({TrackingID_P:value}) or '{TrackingID_P:label}'=='All'\r\n| extend ImpactedRegions = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).impactedServices))[0].ImpactedRegions)))\r\n| project todynamic(ImpactedRegions), TrackingId\r\n| mv-expand ImpactedRegions\r\n| project Region=strcat(tostring(ImpactedRegions.RegionName),' (',tostring(ImpactedRegions.RegionId),')'),TrackingId\r\n| distinct Region, TrackingId\r\n| extend Info=strcat('https://app.azure.com/h/', TrackingId)\r\n| order by TrackingId asc\r\n", "size": 0, "showAnalytics": true, "title": "Affected regions", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{LAworkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TrackingId", "formatter": 1, "formatOptions": { "linkColumn": "Info", "linkTarget": "Url" } }, { "columnMatch": "Info", "formatter": 5 } ], "filter": true } }, "customWidth": "50", "name": "query - 1", "styleSettings": { "showBorder": true } } ] }, "name": "GroupActivityLogs01", "styleSettings": { "showBorder": true } } ], "fallbackResourceIds": [], "fromTemplateId": "sentinel-AzureServiceHealthWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }