Azure Monitor

Send Policy Gateway events to an Azure Log Analytics workspace via the Data Collector API.

Configure

Field	Value
Type	Azure Monitor
Workspace ID	From Azure Portal → Log Analytics workspace → Agents
Shared Key	Primary or secondary key from the same Agents page
Log Type	Custom log table name. Default `PolicyGatewayAudit`

Endpoint is derived as https://<workspace_id>.ods.opinsights.azure.com/api/logs.

Event shape

Events arrive as rows in the custom log table (suffixed _CL by Log Analytics):

{
  "TimeGenerated": "2026-04-20T18:30:00Z",
  "event_id_s": "3d14a2b8-...",
  "event_type_s": "enforcement",
  "policy_id_s": "support-bot",
  "decision_s": "refuse",
  "effective_decision_s": "allow",
  "enforced_b": false,
  "rollout_mode_s": "shadow",
  "reason_code_s": "REFUSE",
  "policy_target_s": "chat.completions",
  "project_id_s": "proj_support_bot",
  "model_s": "abliterated-model"
}

(Log Analytics auto-appends type suffixes — _s for strings, _b for booleans, _d for numbers, _t for datetimes.)

Query

PolicyGatewayAudit_CL
| where decision_s == "refuse" and enforced_b == true
| summarize count() by reason_code_s, bin(TimeGenerated, 1h)

See the full field list in connectors.

Get started

Capabilities

Integrations

Policy Gateway

Reference

Configure

Event shape

Query

​Configure

​Event shape

​Query

Configure

Event shape

Query