Skip to content

Instantly share code, notes, and snippets.

@jeroensmink98

jeroensmink98/git-bypassed.kql

Created February 19, 2024 14:23
Show Gist options
  • Save jeroensmink98/3f6cd5c47b4e71da6343a816a9cd4504 to your computer and use it in GitHub Desktop.
Save jeroensmink98/3f6cd5c47b4e71da6343a816a9cd4504 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
git-bypassed.kql
AzureDevOpsAuditing
| where TimeGenerated > ago(30d)
| where OperationName == "Git.RefUpdatePoliciesBypassed"
| extend DataParsed = parse_json(Data)
| project TimeGenerated, OperationName, ProjectName = tostring(DataParsed.ProjectName), PullRequestId = toint(DataParsed.PullRequestId), BypassReason = tostring(DataParsed.BypassReason), RepoName = tostring(DataParsed.RepoName), NewObjectId = tostring(DataParsed.NewObjectId), OldObjectId = tostring(DataParsed.OldObjectId)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment