Queries for the AegDataPlaneRequests table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Unique unauthorized or forbidden client IP addresses

Get a list of client IP addresses from which EventGrid received unauthorized or forbidden requests.

EventGridDataPlaneRequests
| where OperationResult == "Unauthorized" or OperationResult == "Forbidden"
| summarize count() by ClientIpAddress