I was reading this blog and I found out that there is a query that could return me all Resource Groups with the relative activities for the last 90 days:
AzureActivity
| where CategoryValue == "Administrative"
| where EventSubmissionTimestamp > ago(90d)
| summarize activityCount = count() by ResourceGroup
| order by activityCount asc
This is very useful but I would like to have the same but with the activities for each Resource instead of the Resource Group. So I tried this:
AzureActivity
| where CategoryValue == "Administrative"
| where EventSubmissionTimestamp > ago(90d)
| summarize activityCount = count() by Properties.Resource
| order by activityCount asc
but it's not working.
I know that the resource name is under Properties but I cannot project it.
I check resources activity with below KQL query:
AzureActivity
| where CategoryValue == "Administrative"
| where TimeGenerated > ago(90d)
| summarize activityCount = count() by Resource
| order by activityCount asc
Output: