AZKVAuditLogs

AZKVAuditLogs Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular LogManagement Audit logs can be used to monitor how and when your key vaults are accessed, and by whom. Customers will be able to log all authentication api requests. Operations on the key vault itself, including creation, deletion, setting key vault access policies, and updating key vault attributes such as tags.Operation on keys and secrets in keyvault including creating, deleting, signing.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 76 90

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
_ResourceId A unique identifier for the resource that the record is associated with String
_SubscriptionId A unique identifier for the subscription that the record is associated with String
AddressAuthorizationType Address type (Public IP, subnet, private connection) String
Algorithm Algorithm used to generate the key String
AppliedAssignmentId AssignmentId that eiher granted or denied access as part of access check String
CallerIpAddress IP address of the client that made the request String
CertificateIssuerProperties Information about certificate issuer properties including provider, id Object
CertificatePolicyProperties Information about certificate policy properties including keyproperties, secretproperties, issuerproperties Object
CertificateProperties Information about certificate audit properties including atttributes, subject, hashing algorithm Object
CertificateRequestProperties Boolean value indicating if certificate request operation was cancelled Object
ClientInfo User agent information String
CorrelationId An optional GUID that the client can pass to correlate client-side logs with service-side (Key Vault) logs. String
DurationMs Time it took to service the REST API request, in milliseconds. This does not include the network latency, so the time you measure on the client side might not match this time Int32
EnabledForDeployment Specifies if the vault is enabled for deployment Boolean
EnabledForDiskEncryption Specifes if disk encryption is enabled Boolean
EnabledForTemplateDeployment Specifies whether template deployment is enabled Boolean
EnablePurgeProtection Specifies if purge protection is enabled Boolean
EnableRbacAuthorization Specifies if RBAC authorization is enabled Boolean
EnableSoftDelete Specified is the vault is enabled for soft delete Boolean
HsmPoolResourceId Resource ID of the HSM pool String
HttpStatusCode HTTP status code of the request Int32
Id Resourceidentifier (Key ID or secret ID) String
Identity Identity from the token that was presented in the REST API request. This is usually a user, a service principal, or the combination user+appId, as in the case of a request that results from an Azure PowerShell cmdlet. Object
IsAccessPolicyMatch True if the tenant matches vault tenant, and if the policy explicitly gives permission to the principal attempting the access. Boolean
IsAddressAuthorized Specifies whether request came from an authorized entity Boolean
IsRbacAuthorized Specifies whether an access was granted or not as part of an access check Boolean
KeyProperties Information about key properties including type, size, curve Object
NetworkAcls Information about network acls that govern access to the vault Object
Nsp Network security perimeter properties including access control list, nsp id’s associated with profiles. Object
OperationName Name of the operation String
OperationVersion REST api version requested by the client. String
Properties Information that varies based on the operation (Operationname). In most cases, this field contains client information (the user agent string passed by the client), the exact REST API request URI, and the HTTP status code. In addition, when an object is returned as a result of a request (for example, KeyCreate or VaultGet), it also contains the key URI (as id), vault URI, or secret URI. Object
RequestUri URI of the request String
ResultDescription Additional description about the result, when available. String
ResultSignature HTTP status of the request/response String
ResultType Result of the REST API request. String
SecretProperties Information about secret properties including type, atttributes Object
Sku Information about vault including family, name and capacity Object
SoftDeleteRetentionInDays Specifies soft delete retention in days Int32
SourceSystem String
StorageAccountProperties Information about storage account properties including activekeyname, resourceid Object
StorageSasDefinitionProperties Information about storage sas definition properties including sastype, validityperiod Object
SubnetId Id of subnet if request comes from a known subnet String
TenantId String
TimeGenerated Timestamp (in UTC) when operation occured. DateTime
Tlsversion Network crypto protocol String
TrustedService Specifies whether the principal access the service is a trusted Service. If this field is null, principal is not a trusted service String
Type The name of the table String
VaultProperties Detailed vault properties containing accesspolicy, iprule, virtualnetwork etc Object

Schema changes #

Date Action
2024-10-19 Table added to tracking