Áreas de trabajo/tablas de Microsoft.OperationalInsights 2025-07-01

Definición de recursos de Bicep

El tipo de recurso workspaces/tables se puede implementar con operaciones destinadas a:

• grupos de recursos: consulte comandos de implementación de grupos de recursos

Para obtener una lista de las propiedades modificadas en cada versión de API, consulte registro de cambios.

Formato de recurso

Para crear un recurso Microsoft.OperationalInsights/workspaces/tables, agregue el siguiente bicep a la plantilla.

resource symbolicname 'Microsoft.OperationalInsights/workspaces/tables@2025-07-01' = {
  parent: resourceSymbolicName
  name: 'string'
  properties: {
    plan: 'string'
    restoredLogs: {
      endRestoreTime: 'string'
      sourceTable: 'string'
      startRestoreTime: 'string'
    }
    retentionInDays: int
    schema: {
      columns: [
        {
          dataTypeHint: 'string'
          description: 'string'
          displayName: 'string'
          name: 'string'
          type: 'string'
        }
      ]
      description: 'string'
      displayName: 'string'
      name: 'string'
    }
    searchResults: {
      description: 'string'
      endSearchTime: 'string'
      limit: int
      query: 'string'
      startSearchTime: 'string'
    }
    totalRetentionInDays: int
  }
}

Valores de propiedad

Microsoft.OperationalInsights/workspaces/tables

Columna

RestoredLogs (Registros restaurados)

Schema

Resultados de búsqueda

TableProperties (Propiedades de la tabla)

Ejemplos de uso

Ejemplos de Bicep

Un ejemplo de registro de auditoría de la implementación de tablas de áreas de trabajo de Operational Insights.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

var auditLogTableName = 'AuditLog_CL'
var auditLogColumns = [
  {
    name: 'appId'
    type: 'string'
  }
  {
    name: 'correlationId'
    type: 'string'
  }
  {
    name: 'TimeGenerated'
    type: 'datetime'
  }
]

resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: resourceName
  location: location
  properties: {
    features: {
      disableLocalAuth: false
      enableLogAccessUsingOnlyResourcePermissions: true
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
    retentionInDays: 30
    sku: {
      name: 'PerGB2018'
    }
    workspaceCapping: {
      dailyQuotaGb: -1
    }
  }
}

resource table 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = {
  name: auditLogTableName
  parent: workspace
  properties: {
    schema: {
      columns: auditLogColumns
      name: auditLogTableName
    }
  }
}

Un ejemplo básico de implementación de tablas de áreas de trabajo de Operational Insights.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

var sentinelTiAlertsTableName = 'SentinelTIAlerts_CL'
var sentinelTiAlertsColumns = [
  {
    name: 'ConfidenceScore'
    type: 'int'
  }
  {
    type: 'string'
    name: 'ExternalIndicatorId'
  }
  {
    name: 'IndicatorType'
    type: 'string'
  }
  {
    name: 'Indicator'
    type: 'string'
  }
  {
    name: 'TimeGenerated'
    type: 'datetime'
  }
  {
    name: 'MatchType'
    type: 'string'
  }
  {
    name: 'OriginTimestamp'
    type: 'datetime'
  }
  {
    name: 'Details'
    type: 'dynamic'
  }
]

resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: resourceName
  location: location
  properties: {
    features: {
      disableLocalAuth: false
      enableLogAccessUsingOnlyResourcePermissions: true
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
    retentionInDays: 30
    sku: {
      name: 'PerGB2018'
    }
    workspaceCapping: {
      dailyQuotaGb: -1
    }
  }
}

resource table 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = {
  name: sentinelTiAlertsTableName
  parent: workspace
  properties: {
    retentionInDays: 30
    schema: {
      columns: sentinelTiAlertsColumns
      name: sentinelTiAlertsTableName
    }
    totalRetentionInDays: 30
  }
}

Un ejemplo de datacollectionlogs de implementación de tablas de áreas de trabajo de Operational Insights.

param location string = 'westeurope'
param resourceName string = 'acctest0001'

var dataCollectionLogColumns = [
  {
    name: 'RawData'
    type: 'string'
  }
  {
    type: 'string'
    name: 'FilePath'
  }
  {
    type: 'datetime'
    name: 'TimeGenerated'
  }
]
var dataCollectionLogTableName = 'DataCollectionLog_CL'

resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: resourceName
  location: location
  properties: {
    features: {
      disableLocalAuth: false
      enableLogAccessUsingOnlyResourcePermissions: true
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
    retentionInDays: 30
    sku: {
      name: 'PerGB2018'
    }
    workspaceCapping: {
      dailyQuotaGb: -1
    }
  }
}

resource table 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = {
  name: dataCollectionLogTableName
  parent: workspace
  properties: {
    schema: {
      columns: dataCollectionLogColumns
      name: dataCollectionLogTableName
    }
  }
}

Definición de recursos de plantilla de ARM

El tipo de recurso workspaces/tables se puede implementar con operaciones destinadas a:

• grupos de recursos: consulte comandos de implementación de grupos de recursos

Para obtener una lista de las propiedades modificadas en cada versión de API, consulte registro de cambios.

Formato de recurso

Para crear un recurso Microsoft.OperationalInsights/workspaces/tables, agregue el siguiente JSON a la plantilla.

{
  "type": "Microsoft.OperationalInsights/workspaces/tables",
  "apiVersion": "2025-07-01",
  "name": "string",
  "properties": {
    "plan": "string",
    "restoredLogs": {
      "endRestoreTime": "string",
      "sourceTable": "string",
      "startRestoreTime": "string"
    },
    "retentionInDays": "int",
    "schema": {
      "columns": [
        {
          "dataTypeHint": "string",
          "description": "string",
          "displayName": "string",
          "name": "string",
          "type": "string"
        }
      ],
      "description": "string",
      "displayName": "string",
      "name": "string"
    },
    "searchResults": {
      "description": "string",
      "endSearchTime": "string",
      "limit": "int",
      "query": "string",
      "startSearchTime": "string"
    },
    "totalRetentionInDays": "int"
  }
}

Valores de propiedad

Microsoft.OperationalInsights/workspaces/tables

Columna

RestoredLogs (Registros restaurados)

Schema

Resultados de búsqueda

TableProperties (Propiedades de la tabla)

Ejemplos de uso

Definición de recursos de Terraform (proveedor AzAPI)

El tipo de recurso workspaces/tables se puede implementar con operaciones destinadas a:

• Grupos de recursos

Para obtener una lista de las propiedades modificadas en cada versión de API, consulte registro de cambios.

Formato de recurso

Para crear un recurso Microsoft.OperationalInsights/workspaces/tables, agregue el siguiente terraform a la plantilla.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.OperationalInsights/workspaces/tables@2025-07-01"
  name = "string"
  parent_id = "string"
  body = {
    properties = {
      plan = "string"
      restoredLogs = {
        endRestoreTime = "string"
        sourceTable = "string"
        startRestoreTime = "string"
      }
      retentionInDays = int
      schema = {
        columns = [
          {
            dataTypeHint = "string"
            description = "string"
            displayName = "string"
            name = "string"
            type = "string"
          }
        ]
        description = "string"
        displayName = "string"
        name = "string"
      }
      searchResults = {
        description = "string"
        endSearchTime = "string"
        limit = int
        query = "string"
        startSearchTime = "string"
      }
      totalRetentionInDays = int
    }
  }
}

Valores de propiedad

Microsoft.OperationalInsights/workspaces/tables

Columna

RestoredLogs (Registros restaurados)

Schema

Resultados de búsqueda

TableProperties (Propiedades de la tabla)

Ejemplos de uso

Ejemplos de Terraform

Un ejemplo de registro de auditoría de la implementación de tablas de áreas de trabajo de Operational Insights.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

locals {
  audit_log_table_name = "AuditLog_CL"
  audit_log_columns = [
    {
      "name" : "appId",
      "type" : "string"
    },
    {
      "name" : "correlationId",
      "type" : "string"
    },
    {
      "name" : "TimeGenerated",
      "type" : "datetime"
    }
  ]
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "table" {
  type      = "Microsoft.OperationalInsights/workspaces/tables@2022-10-01"
  parent_id = azapi_resource.workspace.id
  name      = local.audit_log_table_name
  body = {
    properties = {
      schema = {
        name    = local.audit_log_table_name
        columns = local.audit_log_columns
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

Un ejemplo básico de implementación de tablas de áreas de trabajo de Operational Insights.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

locals {
  sentinel_ti_alerts_table_name = "SentinelTIAlerts_CL"
  sentinel_ti_alerts_columns = [
    {
      "name" : "ConfidenceScore",
      "type" : "int"
    },
    {
      "name" : "ExternalIndicatorId",
      "type" : "string"
    },
    {
      "name" : "IndicatorType",
      "type" : "string"
    },
    {
      "name" : "Indicator",
      "type" : "string"
    },
    {
      "name" : "TimeGenerated",
      "type" : "datetime"
    },
    {
      "name" : "MatchType",
      "type" : "string"
    },
    {
      "name" : "OriginTimestamp",
      "type" : "datetime"
    },
    {
      "name" : "Details",
      "type" : "dynamic"
    }
  ]
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "table" {
  type      = "Microsoft.OperationalInsights/workspaces/tables@2022-10-01"
  parent_id = azapi_resource.workspace.id
  name      = local.sentinel_ti_alerts_table_name
  body = {
    properties = {
      schema = {
        name    = local.sentinel_ti_alerts_table_name
        columns = local.sentinel_ti_alerts_columns
      }
      retentionInDays      = 30
      totalRetentionInDays = 30
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

Un ejemplo de datacollectionlogs de implementación de tablas de áreas de trabajo de Operational Insights.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

locals {
  data_collection_log_table_name = "DataCollectionLog_CL"
  data_collection_log_columns = [
    {
      "name" : "RawData",
      "type" : "string"
    },
    {
      "name" : "FilePath",
      "type" : "string"
    },
    {
      "name" : "TimeGenerated",
      "type" : "datetime"
    }
  ]
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "table" {
  type      = "Microsoft.OperationalInsights/workspaces/tables@2022-10-01"
  parent_id = azapi_resource.workspace.id
  name      = local.data_collection_log_table_name
  body = {
    properties = {
      schema = {
        name    = local.data_collection_log_table_name
        columns = local.data_collection_log_columns
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}