P2S VPN

Success

AzureDiagnostics
| where Category == "P2SDiagnosticLog" and Message has "Connection successful"

Failed

AzureDiagnostics
| where Category == "P2SDiagnosticLog" and Message has "Connection failed"
| extend OVPN_Number = tostring(split(split(Message, "[OVPN_")[1], "]")[0])
| project TimeGenerated, Resource, Message,OVPN_Number

Success + IP + Username

AzureDiagnostics
| where Category == "P2SDiagnosticLog" and Message has "Connection successful"
| extend MessageSplit = split(Message, "Username=")[-1]
| extend Username = trim(@"\s+", tostring(split(MessageSplit, "IP=")[0])),
         IP = trim(@"\s+", tostring(split(MessageSplit, "IP=")[-1])),
         OVPN_Number = tostring(split(split(Message, "[OVPN_")[1], "]")[0])
| project TimeGenerated, Username, IP, Message, Resource, OVPN_Number

Success + IP + Specific Username

AzureDiagnostics
| where Category == "P2SDiagnosticLog" and Message has "Connection successful"
| extend MessageSplit = split(Message, "Username=")[-1]
| extend Username = trim(@"\s+", tostring(split(MessageSplit, "IP=")[0])),
         IP = trim(@"\s+", tostring(split(MessageSplit, "IP=")[-1])),
         OVPN_Number = tostring(split(split(Message, "[OVPN_")[1], "]")[0])
| where Username contains "deros"
| project TimeGenerated, Username, IP, Message, Resource, OVPN_Number

successful connections per user

AzureDiagnostics
| where Category == "P2SDiagnosticLog" and Message has "Connection successful"
| project splitted=split(Message, "Username=")
| mv-expand col1=splitted[0], col2=splitted[1], col3=splitted[2]
| project user=split(col2, " ")
| mv-expand username=user[0]
| project-away ['user']
| summarize count() by tostring(username)
| sort by count_ desc