Table: azure_log_profile - Query Azure Log Profiles using SQL

Azure Log Profiles are a system-wide logging configuration in Azure that controls how activity logs are exported. These profiles specify the storage account, event hub, or Log Analytics workspace where activity logs are sent. They are essential for managing and maintaining operational visibility in Azure environments.

Table Usage Guide

The azure_log_profile table provides insights into system-wide logging configurations in Azure. As a security analyst, you can use this table to understand how activity logs are exported, including the destinations such as storage accounts, event hubs, or Log Analytics workspaces. This table is crucial in maintaining operational visibility and ensuring compliance with logging policies in your Azure environments.

Examples

Basic info

Explore the basic details of your Azure log profiles to understand their associations with storage accounts and service bus rules, which can be beneficial in managing and troubleshooting your Azure resources.

select
  name,
  id,
  storage_account_id,
  service_bus_rule_id
from
  azure_log_profile;

select
  name,
  id,
  storage_account_id,
  service_bus_rule_id
from
  azure_log_profile;

Query examples

monitor_log_profiles_for_storage_account

Control examples

Schema for azure_log_profile

Name	Type	Operators	Description
_ctx	jsonb		Steampipe context in JSON form.
akas	jsonb		Array of globally unique identifier strings (also known as) for the resource.
categories	jsonb		The categories of the logs.
cloud_environment	text		The Azure Cloud Environment.
id	text		The resource Id.
location	text		Specifies the name of the region, the resource is created at.
log_event_location	jsonb		List of regions for which Activity Log events should be stored or streamed.
name	text	=	The name of the resource.
region	text		The Azure region/location in which the resource is located.
resource_group	text		The resource group which holds this resource.
retention_policy	jsonb		The retention policy for the events in the log.
service_bus_rule_id	text		The service bus rule ID of the service bus namespace in which you would like to have Event Hubs created for streaming the Activity Log.
sp_connection_name	text	=, !=, ~~, ~~, !~~, !~~	Steampipe connection name.
sp_ctx	jsonb		Steampipe context in JSON form.
storage_account_id	text		The resource id of the storage account to which you would like to send the Activity Log.
subscription_id	text	=, !=, ~~, ~~, !~~, !~~	The Azure Subscription ID in which the resource is located.
tags	jsonb		A map of tags for the resource.
title	text		Title of the resource.
type	text		Type of the resource.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- azure

You can pass the configuration to the command with the --config argument:

steampipe_export_azure --config '<your_config>' azure_log_profile