(AutoIt) Azure Monitor - List Activity Logs

Provides the list of records from the activity logs.

Note: The $filter criteria cannot specify a time range that begins more than 90 days in the past.

For more information, see https://docs.microsoft.com/en-us/rest/api/monitor/activitylogs/list

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

; This example requires the Chilkat API to have been previously unlocked.
; See Global Unlock Sample for sample code.

$oHttp = ObjCreate("Chilkat.Http")

; Load an OAuth2 access token previously fetched by this example:  Get Azure OAuth2 Access Token
$oJsonToken = ObjCreate("Chilkat.JsonObject")
Local $bSuccess = $oJsonToken.LoadFile("qa_data/tokens/azureToken.json")
; Assuming success..
$oHttp.AuthToken = $oJsonToken.StringOf("access_token")
ConsoleWrite("AuthToken: " & $oHttp.AuthToken & @CRLF)

$oHttp.Accept = "application/json"

Local $oResp = $oHttp.QuickRequest("GET","https://management.azure.com/subscriptions/{subscriptionId}/providers/microsoft.insights/eventtypes/management/values?api-version=2015-04-01&$filter=eventTimestamp%20ge%20%272019-05-16T04%3A36%3A37.6407898Z%27%20and%20eventTimestamp%20le%20%272019-06-12T04%3A36%3A37.6407898Z%27")
If ($oHttp.LastMethodSuccess <> True) Then
    ConsoleWrite($oHttp.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite("Response Status Code: " & $oResp.StatusCode & @CRLF)

$oJsonResponse = ObjCreate("Chilkat.JsonObject")
$oJsonResponse.Load($oResp.BodyStr)
$oJsonResponse.EmitCompact = False
ConsoleWrite($oJsonResponse.Emit() & @CRLF)

If ($oResp.StatusCode <> 200) Then
    ConsoleWrite("Failed." & @CRLF)

    Exit
EndIf

; Sample output...
; (See the parsing code below..)
; 
; Use the this online tool to generate parsing code from sample JSON: 
; Generate Parsing Code from JSON

; {
;   "value": [
;     {
;       "authorization": {
;         "action": "microsoft.support/supporttickets/write",
;         "role": "Subscription Admin",
;         "scope": "/subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/MSSupportGroup/providers/microsoft.support/supporttickets/115012112305841"
;       },
;       "caller": "admin@contoso.com",
;       "claims": {
;         "aud": "https://management.core.windows.net/",
;         "iss": "https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/",
;         "iat": "1421876371",
;         "nbf": "1421876371",
;         "exp": "1421880271",
;         "ver": "1.0",
;         "http://schemas.microsoft.com/identity/claims/tenantid": "1e8d8218-c5e7-4578-9acc-9abbd5d23315 ",
;         "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd",
;         "http://schemas.microsoft.com/identity/claims/objectidentifier": "2468adf0-8211-44e3-95xq-85137af64708",
;         "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "admin@contoso.com",
;         "puid": "20030000801A118C",
;         "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "9vckmEGF7zDKk1YzIY8k0t1_EAPaXoeHyPRn6f413zM",
;         "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John",
;         "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Smith",
;         "name": "John Smith",
;         "groups": "cacfe77c-e058-4712-83qw-f9b08849fd60,7f71d11d-4c41-4b23-99d2-d32ce7aa621c,31522864-0578-4ea0-9gdc-e66cc564d18c",
;         "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": " admin@contoso.com",
;         "appid": "c44b4083-3bq0-49c1-b47d-974e53cbdf3c",
;         "appidacr": "2",
;         "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
;         "http://schemas.microsoft.com/claims/authnclassreference": "1"
;       },
;       "correlationId": "1e121103-0ba6-4300-ac9d-952bb5d0c80f",
;       "description": "",
;       "eventDataId": "44ade6b4-3813-45e6-ae27-7420a95fa2f8",
;       "eventName": {
;         "value": "EndRequest",
;         "localizedValue": "End request"
;       },
;       "httpRequest": {
;         "clientRequestId": "27003b25-91d3-418f-8eb1-29e537dcb249",
;         "clientIpAddress": "192.168.35.115",
;         "method": "PUT"
;       },
;       "id": "/subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/MSSupportGroup/providers/microsoft.support/supporttickets/115012112305841/events/44ade6b4-3813-45e6-ae27-7420a95fa2f8/ticks/635574752669792776",
;       "level": "Informational",
;       "resourceGroupName": "MSSupportGroup",
;       "resourceProviderName": {
;         "value": "microsoft.support",
;         "localizedValue": "microsoft.support"
;       },
;       "operationId": "1e121103-0ba6-4300-ac9d-952bb5d0c80f",
;       "operationName": {
;         "value": "microsoft.support/supporttickets/write",
;         "localizedValue": "microsoft.support/supporttickets/write"
;       },
;       "properties": {
;         "statusCode": "Created"
;       },
;       "status": {
;         "value": "Succeeded",
;         "localizedValue": "Succeeded"
;       },
;       "subStatus": {
;         "value": "Created",
;         "localizedValue": "Created (HTTP Status Code: 201)"
;       },
;       "eventTimestamp": "2015-01-21T22:14:26.9792776Z",
;       "submissionTimestamp": "2015-01-21T22:14:39.9936304Z",
;       "subscriptionId": "089bd33f-d4ec-47fe-8ba5-0753aa5c5b33"
;     }
;   ],
;   "nextLink": "https://management.azure.com/########-####-####-####-############$skiptoken=######"
; }
; 

Local $sNextLink
Local $i
Local $iCount_i
Local $sAuthorizationAction
Local $sAuthorizationRole
Local $sAuthorizationScope
Local $sCaller
Local $sClaimsAud
Local $sClaimsIss
Local $sClaimsIat
Local $sClaimsNbf
Local $sClaimsExp
Local $sClaimsVer
Local $sClaims_identity_claims_tenantid
Local $sClaims_claims_authnmethodsreferences
Local $sClaims_identity_claims_objectidentifier
Local $sClaims_ws_2005_05_identity_claims_upn
Local $sClaimsPuid
Local $sClaims_ws_2005_05_identity_claims_nameidentifier
Local $sClaims_ws_2005_05_identity_claims_givenname
Local $sClaims_ws_2005_05_identity_claims_surname
Local $sClaimsName
Local $sClaimsGroups
Local $sClaims_ws_2005_05_identity_claims_name
Local $sClaimsAppid
Local $sClaimsAppidacr
Local $sClaims_identity_claims_scope
Local $sClaims_claims_authnclassreference
Local $sCorrelationId
Local $sDescription
Local $sEventDataId
Local $sEventNameValue
Local $sEventNameLocalizedValue
Local $sHttpRequestClientRequestId
Local $sHttpRequestClientIpAddress
Local $sHttpRequestMethod
Local $sId
Local $sLevel
Local $sResourceGroupName
Local $sResourceProviderNameValue
Local $sResourceProviderNameLocalizedValue
Local $sOperationId
Local $sOperationNameValue
Local $sOperationNameLocalizedValue
Local $sPropertiesStatusCode
Local $statusValue
Local $statusLocalizedValue
Local $subStatusValue
Local $subStatusLocalizedValue
Local $sEventTimestamp
Local $submissionTimestamp
Local $subscriptionId

$sNextLink = $oJsonResponse.StringOf("nextLink")
$i = 0
$iCount_i = $oJsonResponse.SizeOfArray("value")
While $i < $iCount_i
    $oJsonResponse.I = $i
    $sAuthorizationAction = $oJsonResponse.StringOf("value[i].authorization.action")
    $sAuthorizationRole = $oJsonResponse.StringOf("value[i].authorization.role")
    $sAuthorizationScope = $oJsonResponse.StringOf("value[i].authorization.scope")
    $sCaller = $oJsonResponse.StringOf("value[i].caller")
    $sClaimsAud = $oJsonResponse.StringOf("value[i].claims.aud")
    $sClaimsIss = $oJsonResponse.StringOf("value[i].claims.iss")
    $sClaimsIat = $oJsonResponse.StringOf("value[i].claims.iat")
    $sClaimsNbf = $oJsonResponse.StringOf("value[i].claims.nbf")
    $sClaimsExp = $oJsonResponse.StringOf("value[i].claims.exp")
    $sClaimsVer = $oJsonResponse.StringOf("value[i].claims.ver")
    $sClaims_identity_claims_tenantid = $oJsonResponse.StringOf("value[i].claims.""http://schemas.microsoft.com/identity/claims/tenantid""")
    $sClaims_claims_authnmethodsreferences = $oJsonResponse.StringOf("value[i].claims.""http://schemas.microsoft.com/claims/authnmethodsreferences""")
    $sClaims_identity_claims_objectidentifier = $oJsonResponse.StringOf("value[i].claims.""http://schemas.microsoft.com/identity/claims/objectidentifier""")
    $sClaims_ws_2005_05_identity_claims_upn = $oJsonResponse.StringOf("value[i].claims.""http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn""")
    $sClaimsPuid = $oJsonResponse.StringOf("value[i].claims.puid")
    $sClaims_ws_2005_05_identity_claims_nameidentifier = $oJsonResponse.StringOf("value[i].claims.""http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier""")
    $sClaims_ws_2005_05_identity_claims_givenname = $oJsonResponse.StringOf("value[i].claims.""http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname""")
    $sClaims_ws_2005_05_identity_claims_surname = $oJsonResponse.StringOf("value[i].claims.""http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname""")
    $sClaimsName = $oJsonResponse.StringOf("value[i].claims.name")
    $sClaimsGroups = $oJsonResponse.StringOf("value[i].claims.groups")
    $sClaims_ws_2005_05_identity_claims_name = $oJsonResponse.StringOf("value[i].claims.""http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name""")
    $sClaimsAppid = $oJsonResponse.StringOf("value[i].claims.appid")
    $sClaimsAppidacr = $oJsonResponse.StringOf("value[i].claims.appidacr")
    $sClaims_identity_claims_scope = $oJsonResponse.StringOf("value[i].claims.""http://schemas.microsoft.com/identity/claims/scope""")
    $sClaims_claims_authnclassreference = $oJsonResponse.StringOf("value[i].claims.""http://schemas.microsoft.com/claims/authnclassreference""")
    $sCorrelationId = $oJsonResponse.StringOf("value[i].correlationId")
    $sDescription = $oJsonResponse.StringOf("value[i].description")
    $sEventDataId = $oJsonResponse.StringOf("value[i].eventDataId")
    $sEventNameValue = $oJsonResponse.StringOf("value[i].eventName.value")
    $sEventNameLocalizedValue = $oJsonResponse.StringOf("value[i].eventName.localizedValue")
    $sHttpRequestClientRequestId = $oJsonResponse.StringOf("value[i].httpRequest.clientRequestId")
    $sHttpRequestClientIpAddress = $oJsonResponse.StringOf("value[i].httpRequest.clientIpAddress")
    $sHttpRequestMethod = $oJsonResponse.StringOf("value[i].httpRequest.method")
    $sId = $oJsonResponse.StringOf("value[i].id")
    $sLevel = $oJsonResponse.StringOf("value[i].level")
    $sResourceGroupName = $oJsonResponse.StringOf("value[i].resourceGroupName")
    $sResourceProviderNameValue = $oJsonResponse.StringOf("value[i].resourceProviderName.value")
    $sResourceProviderNameLocalizedValue = $oJsonResponse.StringOf("value[i].resourceProviderName.localizedValue")
    $sOperationId = $oJsonResponse.StringOf("value[i].operationId")
    $sOperationNameValue = $oJsonResponse.StringOf("value[i].operationName.value")
    $sOperationNameLocalizedValue = $oJsonResponse.StringOf("value[i].operationName.localizedValue")
    $sPropertiesStatusCode = $oJsonResponse.StringOf("value[i].properties.statusCode")
    $statusValue = $oJsonResponse.StringOf("value[i].status.value")
    $statusLocalizedValue = $oJsonResponse.StringOf("value[i].status.localizedValue")
    $subStatusValue = $oJsonResponse.StringOf("value[i].subStatus.value")
    $subStatusLocalizedValue = $oJsonResponse.StringOf("value[i].subStatus.localizedValue")
    $sEventTimestamp = $oJsonResponse.StringOf("value[i].eventTimestamp")
    $submissionTimestamp = $oJsonResponse.StringOf("value[i].submissionTimestamp")
    $subscriptionId = $oJsonResponse.StringOf("value[i].subscriptionId")
    $i = $i + 1
Wend