JSONExample.JSON

[{
  "subject": "/subscriptions/ffffffff-6666-4444-bbbb-999999999999/resourcegroups/rg-azpolicy/providers/Microsoft.Compute/virtualMachines/VM01",
  "eventType": "Microsoft.Resources.ResourceWriteSuccess",
  "eventTime": "2018-10-29T05:13:54.8681093Z",
  "id": "b1d0f685-e55a-496b-a40d-12ba12e3870c",
  "data": {
    "authorization": {
      "scope": "/subscriptions/ffffffff-6666-4444-bbbb-999999999999/resourceGroups/rg-azpolicy/providers/Microsoft.Compute/virtualMachines/VM01",
      "action": "Microsoft.Compute/virtualMachines/write",
      "evidence": {
        "role": "Subscription Admin"
      }
    },
    "claims": {
      "aud": "https://management.core.windows.net/",
      "iss": "https://sts.windows.net/23ae57df-8a51-444a-a59a-328118705efc/",
      "iat": "1540788967",
      "nbf": "1540788967",
      "exp": "1540792867",
      "http://schemas.microsoft.com/claims/authnclassreference": "1",
      "aio": "AVQAq/8JAAAAJYZH0qER9A0aLm6GGmwCgtY/c9/AEwzUj2QRagb6fa8pGZYXL5jVosoKxmEvxTsH3tEUzoycO1grGGCEO5BmoBupeXtKz23GaF6ZYYYaFS8=",
      "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
      "appid": "1950a258-227b-4e31-a9cf-717495945fc2",
      "appidacr": "0",
      "e_exp": "262800",
      "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Thom",
      "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Dan",
      "groups": "3631208c-16ae-4966-800c-45e84338c7e8,221ec7d8-05dd-49cc-85f7-9a793bb6122c,69b3d3b2-16a6-41c2-b817-69e67b857131",
      "ipaddr": "120.21.51.198",
      "name": "Dan Thom",
      "http://schemas.microsoft.com/identity/claims/objectidentifier": "5af834eb-24ae-4695-b64b-2ef6d480ebba",
      "onprem_sid": "S-1-5-21-325202249014901-520224901-46520224901-3062",
      "puid": "10037FFE8227AFCA",
      "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
      "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "LrE7xiAejxxaD5vuZtEHelgzEHelgzPVa8vv2acsG-I",
      "http://schemas.microsoft.com/identity/claims/tenantid": "23ae57df-23ae57df-23ae57df-23ae57df-23ae57df",
      "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "dan.thom@kloud.com.au",
      "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "dan.thom@kloud.com.au",
      "uti": "E3m0XhJWq0eSy8dTTOJSAA",
      "ver": "1.0"
    },
    "correlationId": "5bdf9ce5-8705-4428-8889-86bfb83e7512",
    "resourceProvider": "Microsoft.Compute",
    "resourceUri": "/subscriptions/ffffffff-6666-4444-bbbb-999999999999/resourcegroups/rg-azpolicy/providers/Microsoft.Compute/virtualMachines/VM01",
    "operationName": "Microsoft.Compute/virtualMachines/write",
    "status": "Succeeded",
    "subscriptionId": "ffffffff-6666-4444-bbbb-999999999999",
    "tenantId": "23ae57df-8a51-444a-a59a-328118705efc"
  },
  "dataVersion": "2",
  "metadataVersion": "1",
  "topic": "/subscriptions/ffffffff-6666-4444-bbbb-999999999999"
}]