In this video, we go over how to get scheduled events for an Azure virtual machine by querying the Instance Metadata service API endpoint with a PowerShell Scheduled Task. That data is then sent to a Log Analytics Workspace to be queried or alerted on.
Sample query to get all events:
| sort by DateTime_t desc
Sample query to get all events that are not blank:
IMDSScheduledEvents_CL | where Events_s != "" | sort by DateTime_t desc
Udemy course, Zero to Hero with Windows Virtual Desktop
Two IP’s you should know: