You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: 'View Azure DDoS Protection logs in Log Analytics workspace'
3
+
description: Learn how to view DDoS protection diagnostic logs in Log Analytics workspace.
4
+
services: ddos-protection
5
+
author: AbdullahBell
6
+
ms.service: ddos-protection
7
+
ms.topic: how-to
8
+
ms.workload: infrastructure-services
9
+
ms.date: 03/22/2023
10
+
ms.author: abell
11
+
---
12
+
13
+
# View Azure DDoS Protection logs in Log Analytics workspace
14
+
15
+
In this guide, you'll learn how to view Azure DDoS Protection diagnostic logs, including notifications, mitigation reports and mitigation flow logs.
16
+
## Prerequisites
17
+
18
+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
19
+
-[DDoS Network Protection](manage-ddos-protection.md) must be enabled on a virtual network or [DDoS IP Protection](manage-ddos-protection-powershell-ip.md) must be enabled on a public IP address.
20
+
- Configure DDoS Protection diagnostic logs. To learn more, see [Configure diagnostic logs](diagnostic-logging.md).
21
+
- Simulate an attack using one of our simulation partners. To learn more, see [Test with simulation partners](test-through-simulations.md).
22
+
23
+
### View in log analytics workspace
24
+
25
+
1. Sign in to the [Azure portal](https://portal.azure.com/).
26
+
1. In the search box at the top of the portal, enter **Log Analytics workspace**. Select **Log Analytics workspace** in the search results.
27
+
1. Under the **Log Analytics workspaces** blade, select your workspace.
28
+
1. On the left-side tab, select **Logs**. Here you'll see the query explorer. Exit out the *Queries* pane to utilize the *Logs* page.
29
+
30
+
:::image type="content" source="./media/ddos-view-diagnostic-logs/ddos-select-logs-in-workspace.png" alt-text="Screenshot of viewing a log analytics workspace.":::
31
+
32
+
1. In the *Logs* page, type in your query then hit *Run* to view results.
33
+
34
+
:::image type="content" source="./media/ddos-view-diagnostic-logs/ddos-notification-logs.png" alt-text="Screenshot of viewing DDoS Protection notification logs in log analytics workspace.":::
35
+
36
+
## Example log queries
37
+
38
+
### DDoS Protection Notifications
39
+
40
+
Notifications will notify you anytime a public IP resource is under attack, and when attack mitigation is over.
41
+
42
+
```kusto
43
+
AzureDiagnostics
44
+
| where Category == "DDoSProtectionNotifications"
45
+
```
46
+
47
+
48
+
The following table lists the field names and descriptions:
49
+
50
+
| Field name | Description |
51
+
| --- | --- |
52
+
|**TimeGenerated**| The date and time in UTC when the notification was created. |
53
+
|**ResourceId**| The resource ID of your public IP address. |
54
+
|**Category**| For notifications, this will be `DDoSProtectionNotifications`.|
55
+
|**ResourceGroup**| The resource group that contains your public IP address and virtual network. |
56
+
|**SubscriptionId**| Your DDoS protection plan subscription ID. |
57
+
|**Resource**| The name of your public IP address. |
58
+
|**ResourceType**| This will always be `PUBLICIPADDRESS`. |
59
+
|**OperationName**| For notifications, this will be `DDoSProtectionNotifications`. |
60
+
|**Message**| Details of the attack. |
61
+
|**Type**| Type of notification. Possible values include `MitigationStarted`. `MitigationStopped`. |
62
+
|**PublicIpAddress**| Your public IP address. |
63
+
64
+
### DDoS Mitigation FlowLogs
65
+
66
+
Attack mitigation flow logs allow you to review the dropped traffic, forwarded traffic and other interesting data-points during an active DDoS attack in near-real time. You can ingest the constant stream of this data into Microsoft Sentinel or to your third-party SIEM systems via event hub for near-real time monitoring, take potential actions and address the need of your defense operations.
67
+
68
+
```kusto
69
+
AzureDiagnostics
70
+
| where Category == "DDoSMitigationFlowLogs"
71
+
```
72
+
73
+
| Field name | Description |
74
+
| --- | --- |
75
+
|**TimeGenerated**| The date and time in UTC when the flow log was created. |
76
+
|**ResourceId**| The resource ID of your public IP address. |
77
+
|**Category**| For flow logs, this will be `DDoSMitigationFlowLogs`.|
78
+
|**ResourceGroup**| The resource group that contains your public IP address and virtual network. |
79
+
|**SubscriptionId**| Your DDoS protection plan subscription ID. |
80
+
|**Resource**| The name of your public IP address. |
81
+
|**ResourceType**| This will always be `PUBLICIPADDRESS`. |
82
+
|**OperationName**| For flow logs, this will be `DDoSMitigationFlowLogs`. |
83
+
|**Message**| Details of the attack. |
84
+
|**SourcePublicIpAddress**| The public IP address of the client generating traffic to your public IP address. |
85
+
|**SourcePort**| Port number ranging from 0 to 65535. |
86
+
|**DestPublicIpAddress**| Your public IP address. |
87
+
|**DestPort**| Port number ranging from 0 to 65535. |
88
+
|**Protocol**| Type of protocol. Possible values include `tcp`, `udp`, `other`.|
89
+
90
+
### DDoS Mitigation FlowLogs
91
+
92
+
Attack mitigation reports use the Netflow protocol data, which is aggregated to provide detailed information about the attack on your resource. Anytime a public IP resource is under attack, the report generation will start as soon as the mitigation starts. There will be an incremental report generated every 5 mins and a post-mitigation report for the whole mitigation period. This is to ensure that in an event the DDoS attack continues for a longer duration of time, you'll be able to view the most current snapshot of mitigation report every 5 minutes and a complete summary once the attack mitigation is over.
93
+
94
+
```kusto
95
+
AzureDiagnostics
96
+
| where Category == "DDoSMitigationReports"
97
+
```
98
+
99
+
| Field name | Description |
100
+
| --- | --- |
101
+
|**TimeGenerated**| The date and time in UTC when the notification was created. |
102
+
|**ResourceId**| The resource ID of your public IP address. |
103
+
|**Category**| For notifications, this will be `DDoSProtectionNotifications`.|
104
+
|**ResourceGroup**| The resource group that contains your public IP address and virtual network. |
105
+
|**SubscriptionId**| Your DDoS protection plan subscription ID. |
106
+
|**Resource**| The name of your public IP address. |
107
+
|**ResourceType**| This will always be `PUBLICIPADDRESS`. |
108
+
|**OperationName**| For notifications, this will be `DDoSProtectionNotifications`. |
109
+
|**Message**| Details of the attack. |
110
+
|**Type**| Type of notification. Possible values include `MitigationStarted`. `MitigationStopped`. |
See [Tutorial: View and configure Azure DDoS Protection diagnostic logging](diagnostic-logging.md) for details on attack insights and visualization with DDoS Attack Analytics.
62
-
63
-
The following diagnostic logs are available for Azure DDoS Protection:
64
-
65
-
-**DDoSProtectionNotifications**: Notifications will notify you anytime a public IP resource is under attack, and when attack mitigation is over.
66
-
-**DDoSMitigationFlowLogs**: Attack mitigation flow logs allow you to review the dropped traffic, forwarded traffic and other interesting data-points during an active DDoS attack in near-real time. You can ingest the constant stream of this data into Microsoft Sentinel or to your third-party SIEM systems via event hub for near-real time monitoring, take potential actions and address the need of your defense operations.
67
-
-**DDoSMitigationReports**: Attack mitigation reports use the Netflow protocol data, which is aggregated to provide detailed information about the attack on your resource. Anytime a public IP resource is under attack, the report generation will start as soon as the mitigation starts. There will be an incremental report generated every 5 mins and a post-mitigation report for the whole mitigation period. This is to ensure that in an event the DDoS attack continues for a longer duration of time, you'll be able to view the most current snapshot of mitigation report every 5 minutes and a complete summary once the attack mitigation is over.
68
-
-**AllMetrics**: Provides all possible metrics available during the duration of a DDoS attack.
69
-
70
-
## Log schemas
71
-
72
-
The following table lists the field names and descriptions:
0 commit comments