Azure AKS - Diag Logs - KQL

AzureDiagnostics
| where Category == "kube-audit"
| summarize requests = count() by bin(TimeGenerated, 5m), userAgent_s
| order by requests desc


AzureDiagnostics
| where Category == "kube-audit"
| summarize requests = count() by userAgent_s
| order by requests desc

AzureDiagnostics
| where Category == "kube-audit"
| take 5

AzureDiagnostics
| where Category == "kube-audit"
| summarize count() by verb_s
| order by count_ desc


AzureDiagnostics
| where Category == "kube-audit"
| extend logData = parse_json(log_s)
| summarize count() by tostring(logData.objectRef.resource)
| order by count_ desc


AzureDiagnostics
| where Category == "kube-audit"
| extend logData = parse_json(log_s)
| where isempty(tostring(logData.objectRef.resource))
| summarize count() by tostring(logData.requestURI)
| order by count_ desc


AzureDiagnostics
| where Category == "kube-audit"
| extend logData = parse_json(log_s)
| where tostring(logData.requestURI) == "/readyz"
| summarize count() by tostring(logData.userAgent)
| order by count_ desc

Windows 2016 - Install AZ CLI & KUBECTL

#AZ CLI
msiexec /i https://aka.ms/installazurecliwindows

#Kubectl
curl.exe -LO "https://dl.k8s.io/release/v1.30.1/bin/windows/amd64/kubectl.exe"
kubectl version --client

az login --use-device-code