{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "6545085e-819e-45e6-82ec-b9f6577edecf", "version": "KqlParameterItem/1.0", "name": "parameterManagementGroup", "label": "Management Group", "type": 5, "description": "To filter the list of Susbcriptions, you can select a Management Group(s).", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resourcecontainers\r\n| where type == 'microsoft.resources/subscriptions'\r\n| mv-expand properties\r\n| extend mgroup = properties['managementGroupAncestorsChain']\r\n| where mgroup != ''\r\n| mv-expand mgroup\r\n| extend mgroupDisplayName = tostring(mgroup.displayName)\r\n| extend mgroupName = mgroup.name\r\n| summarize by id=mgroupDisplayName\r\n| order by id asc", "crossComponentResources": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "defaultValue": "value::all", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "da1af45c-1dd8-4082-aa00-c65e54f63626", "version": "KqlParameterItem/1.0", "name": "parameterSubscription", "label": "Subscription", "type": 5, "description": "The selected Subscription(s) is used to populate the resources within.", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resourcecontainers\r\n| where type == 'microsoft.resources/subscriptions'\r\n| mv-expand properties\r\n| extend mgroup = properties['managementGroupAncestorsChain']\r\n| where mgroup != ''\r\n| mv-expand mgroup\r\n| extend mgroupDisplayName = mgroup.displayName\r\n| extend mgroupName = mgroup.name\r\n| where mgroup.displayName in({parameterManagementGroup})\r\n| summarize by id, label=name\r\n| order by label", "crossComponentResources": [ "value::all" ], "value": [], "typeSettings": { "additionalResourceOptions": [ "value::1", "value::all" ], "showDefault": false }, "defaultValue": "value::1", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "d70b8dc8-f41d-4f94-9c50-fb29e5022b9a", "version": "KqlParameterItem/1.0", "name": "parameterWorkspaceType", "label": "Workspace Type", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [] }, "jsonData": "[{\"value\":\"Sentinel\", \"selected\":true}, {\"value\":\"All\", \"selected\":false}]", "value": "All" }, { "id": "aa3a2415-581b-4b5a-adb6-c4c1487ac978", "version": "KqlParameterItem/1.0", "name": "parameterWorkspace", "label": "Target Workspace", "type": 5, "description": "The selected Log Analytics workspace(s) is checked to see if the resources have sent data to the workspace within the timeframe specified in the Lookback Period parameter. This is what determines the LAW Connection Status field/column.", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resources\r\n| where type contains \"microsoft.operationalinsights/workspaces\"\r\n| extend id = tolower(id)\r\n| join kind=leftouter (\r\n resources\r\n | where type == \"microsoft.operationsmanagement/solutions\"\r\n | extend solutionName = tostring(plan.product)\r\n | where solutionName == \"OMSGallery/SecurityInsights\"\r\n | extend wsRId = tolower(tostring(properties.workspaceResourceId))\r\n | where solutionName contains \"SecurityInsights\"\r\n ) on $left.id == $right.wsRId\r\n| where case(\"{parameterWorkspaceType}\" == \"Sentinel\", solutionName == \"OMSGallery/SecurityInsights\", type contains \"microsoft.operationalinsights/workspaces\")\r\n| summarize by id=tolower(id), tostring(solutionName)\r\n| project id", "crossComponentResources": [ "value::all" ], "typeSettings": { "limitSelectTo": 100, "additionalResourceOptions": [ "value::1" ], "showDefault": false }, "defaultValue": "value::1", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [] }, { "id": "a26f4134-a085-4657-9e06-1339676a7eea", "version": "KqlParameterItem/1.0", "name": "parameterLookback", "label": "Lookback Period", "type": 4, "description": "This is used to check if a resource has reported to the selected Log Analytics workspace within the selected amount of time.", "isRequired": true, "value": { "durationMs": 172800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true } }, { "id": "b9c3c4fe-5fde-45a7-bcee-4790e3ddf83a", "version": "KqlParameterItem/1.0", "name": "Documentation", "type": 10, "isRequired": true, "value": "On", "typeSettings": { "additionalResourceOptions": [] }, "jsonData": "[\"On\", \"Off\"]" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parametersTop" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "43dc3eda-f529-4028-adee-c8926e01f11e", "cellValue": "parameterTab", "linkTarget": "parameter", "linkLabel": "Virtual Machines", "subTarget": "vm", "style": "link" }, { "id": "49968b31-71bc-47ba-916a-f21e0ff77230", "cellValue": "parameterTab", "linkTarget": "parameter", "linkLabel": "PaaS Services", "subTarget": "paas", "style": "link" }, { "id": "8dc8837c-b5cf-449b-b4b2-7c61aa4099ba", "cellValue": "parameterTab", "linkTarget": "parameter", "linkLabel": "Azure Activity Logs", "subTarget": "activity", "style": "link" }, { "id": "bd5c8bc3-89c3-49e0-a395-54f6cec468ae", "cellValue": "parameterTab", "linkTarget": "parameter", "linkLabel": "NSG Flow Logs (Traffic Analytics)", "subTarget": "nsgflowlogs", "style": "link" }, { "id": "4d369286-45c2-41ea-b410-1a1481581b3f", "cellValue": "parameterTab", "linkTarget": "parameter", "linkLabel": "Azure AD Logs", "subTarget": "aadlogs", "style": "link" }, { "id": "3074e87b-9b9e-46c8-9076-376abc947ed5", "cellValue": "parameterTab", "linkTarget": "parameter", "linkLabel": "Log Analytics Workspaces", "subTarget": "law", "style": "link" } ] }, "name": "linksTabs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "For more information about onboarding the Microsoft Monitoring Agent or the Azure Monitor Agent, please see:
\r\n- [Microsoft Monitoring Agent](https://docs.microsoft.com/services-hub/health/mma-setup)\r\n- [Azure Monitor Agent](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-overview?tabs=PowerShellWindows)", "style": "info" }, "conditionalVisibility": { "parameterName": "Documentation", "comparison": "isEqualTo", "value": "On" }, "name": "text - 8" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "value::all" ], "parameters": [ { "id": "66ab46b7-6686-450c-b6f6-aee6ffde3185", "version": "KqlParameterItem/1.0", "name": "parameterResourceType", "label": "Resource Type", "type": 7, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resources\r\n | where type == \"microsoft.compute/virtualmachines\" or type == \"microsoft.hybridcompute/machines\"\r\n | summarize by ['type'] | project type, selected=case(type == \"microsoft.compute/virtualmachines\", true, false)\r\n", "crossComponentResources": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type in ({parameterResourceType})\r\n| extend\r\n operatingSystem = case(type == \"microsoft.compute/virtualmachines\", tostring(properties.storageProfile.osDisk.osType), properties.osType),\r\n imagePublisher = case(tostring(properties.storageProfile.imageReference.publisher) == \"\", \"Custom\", tostring(properties.storageProfile.imageReference.publisher)),\r\n vmSize = tostring(properties.hardwareProfile.vmSize),\r\n vmPowerState = case(type == \"microsoft.compute/virtualmachines\", properties.extended.instanceView.powerState.displayStatus, properties.status),\r\n vmId = tolower(id),\r\n provisioningState = properties.provisioningState\r\n| join kind=leftouter(\r\n resourcecontainers\r\n | where type == \"microsoft.resources/subscriptions\"\r\n | extend subscriptionName = tostring(name)\r\n | project id, subscriptionId, subscriptionName\r\n) on $left.subscriptionId == $right.subscriptionId\r\n| join kind=leftouter(\r\n resources\r\n | where type == \"microsoft.compute/virtualmachines/extensions\" or type == \"microsoft.hybridcompute/machines/extensions\"\r\n | where name =~ \"MicrosoftMonitoringAgent\" or name =~ \"AzureMonitorWindowsAgent\" or name =~ \"OmsAgentForLinux\" or name=~ \"AzureMonitorLinuxAgent\" or name =~ \"MMAExtension\" or name =~ \"MSMonitoringAgent\"\r\n | extend name = case(type == \"microsoft.hybridcompute/machines/extensions\" and name =~ \"MSMonitoringAgent\", \"AzureMonitorWindowsAgent\", name)\r\n | extend lawId = tostring(properties.settings[\"workspaceId\"])\r\n | join kind=leftouter(\r\n resources\r\n | where type == \"microsoft.operationalinsights/workspaces\"\r\n | extend \r\n lawId = tostring(properties.customerId),\r\n lawRId = id,\r\n lawName = name\r\n ) on $left.lawId == $right.lawId\r\n | extend\r\n extensions = pack(\"name\", name, \"provisioningState\", properties.provisioningState, \"lawName\", case(name contains \"AzureMonitorWindowsAgent\", \"Check associated DCR.\", lawName), \"lawId\", case(name contains \"AzureMonitorWindowsAgent\", \"Check associated DCR.\", lawId)),\r\n vmId = tolower(substring(id, 0, indexof(id, \"/extensions\")))\r\n | summarize extensions=make_list(extensions) by vmId\r\n) on $left.vmId == $right.vmId\r\n| project id=tolower(id), resourceName= name, subscriptionId, subscriptionName, resourceGroupId = strcat(\"/subscriptions/\", subscriptionId,\"/resourceGroups/\", resourceGroup), vmPowerState=case(provisioningState == \"Failed\", \"Failed\", vmPowerState), \r\noperatingSystem, imagePublisher, extensionCount=array_length(extensions), extensions, \r\nextensionType=case(extensions has \"MicrosoftMonitoringAgent\" and extensions has \"AzureMonitorWindowsAgent\", \"Both\", extensions has \"AzureMonitorLinuxAgent\" and extensions has \"OMSAgentforLinux\", \"Both\", extensions has \"MicrosoftMonitoringAgent\" or extensions has \"OMSAgentforLinux\", \"MMA\", extensions has \"AzureMonitorWindowsAgent\" or extensions has \"AzureMonitorLinuxAgent\", \"AMA\", extensions has \"MMAExtension\", \"MMA\", \"None\"),\r\nextensionStatus=case(extensions has \"Succeeded\", \"Succeeded\", extensions has \"Failed\", \"Failed\", extensions has \"Updating\", \"Updating\", \"N/A\")\r\n| order by subscriptionName asc, resourceGroupId asc, resourceName asc", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{parameterSubscription}" ], "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "id", "comparison": "isEqualTo", "value": "9999" }, "name": "queryVMInventory" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Heartbeat \r\n| where strcat(\"/subscriptions/\", SubscriptionId) in({parameterSubscription})\r\n| summarize LastHeartbeat = max(TimeGenerated) by ResourceId, Category, Computer, TenantId\r\n| extend agentInfo = pack(\"Computer\", Computer, \"Category\", Category, \"WorkspaceID\", TenantId, \"LastHeartbeat\", LastHeartbeat)\r\n| summarize agentInfo=make_list(agentInfo), distinctWorkspaces = dcount(TenantId) by ResourceId\r\n| project ResourceId=tolower(ResourceId), agentCount=array_length(agentInfo), agentInfo, distinctWorkspaces\r\n| order by ResourceId", "size": 0, "timeContextFromParameter": "parameterLookback", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{parameterWorkspace}" ], "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "id", "comparison": "isEqualTo", "value": "9999" }, "name": "queryHeartbeat" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"1905b8fb-3c96-43bb-bc1e-0fd45f2c3041\",\"mergeType\":\"leftouter\",\"leftTable\":\"queryVMInventory\",\"rightTable\":\"queryHeartbeat\",\"leftColumn\":\"id\",\"rightColumn\":\"ResourceId\"}],\"projectRename\":[{\"originalName\":\"[queryVMInventory].subscriptionId\",\"mergedName\":\"Subscription\",\"fromId\":\"1905b8fb-3c96-43bb-bc1e-0fd45f2c3041\"},{\"originalName\":\"[queryVMInventory].resourceGroupId\",\"mergedName\":\"Resource Group\",\"fromId\":\"1905b8fb-3c96-43bb-bc1e-0fd45f2c3041\"},{\"originalName\":\"[queryVMInventory].id\",\"mergedName\":\"Resource\",\"fromId\":\"1905b8fb-3c96-43bb-bc1e-0fd45f2c3041\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"LAW Connection Status\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"ResourceId\",\"operator\":\"isNotNull\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"🟢Connected\"}},{\"criteriaContext\":{\"leftOperand\":\"ResourceId\",\"operator\":\"is Empty\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"⚪Disconnected\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\"}}]},{\"originalName\":\"[queryHeartbeat].distinctWorkspaces\",\"mergedName\":\"distinctWorkspaces\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryVMInventory].vmPowerState\",\"mergedName\":\"Power State\",\"fromId\":\"1905b8fb-3c96-43bb-bc1e-0fd45f2c3041\"},{\"originalName\":\"[queryVMInventory].operatingSystem\",\"mergedName\":\"Operating System\",\"fromId\":\"1905b8fb-3c96-43bb-bc1e-0fd45f2c3041\"},{\"originalName\":\"[queryVMInventory].imagePublisher\",\"mergedName\":\"Image Publisher\",\"fromId\":\"1905b8fb-3c96-43bb-bc1e-0fd45f2c3041\"},{\"originalName\":\"[queryVMInventory].extensionType\",\"mergedName\":\"Extension Type\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryVMInventory].extensionStatus\",\"mergedName\":\"Extension Status\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryVMInventory].extensionCount\",\"mergedName\":\"Extension Count\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryVMInventory].extensions\",\"mergedName\":\"Extension Info\",\"fromId\":\"1905b8fb-3c96-43bb-bc1e-0fd45f2c3041\"},{\"originalName\":\"[queryHeartbeat].ResourceId\",\"mergedName\":\"ResourceId\",\"fromId\":\"1905b8fb-3c96-43bb-bc1e-0fd45f2c3041\"},{\"originalName\":\"[queryHeartbeat].TenantId\",\"mergedName\":\"TenantId\",\"fromId\":\"1905b8fb-3c96-43bb-bc1e-0fd45f2c3041\"},{\"originalName\":\"[queryHeartbeat].agentCount\",\"mergedName\":\"Agent Count\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryHeartbeat].agentInfo\",\"mergedName\":\"Agent Info\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryHeartbeat].workspaceInfo\",\"mergedName\":\"workspaceInfo\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryVMInventory].subscriptionName\",\"mergedName\":\"subscriptionName\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryVMInventory].resourceName\",\"mergedName\":\"resourceName\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryVMInventory].osType\"},{\"originalName\":\"[queryHeartbeat].LastHeartBeat\"},{\"originalName\":\"[queryHeartbeat].LastHeartbeat\"},{\"originalName\":\"[queryVMInventory].agentType\"}]}", "size": 3, "title": "Azure Virtual Machine Coverage", "showExportToExcel": true, "exportToExcelOptions": "all", "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "linkIsContextBlade": true, "showIcon": true }, "tooltipFormat": { "tooltip": "If green (\"Connected\"), this means the resource has sent data to at least one of the selected Log Analytics workspaces within the specified lookback period. If gray (\"Disconnected\"), no data was found in any of the selected Log Analytics workspaces within the specified lookback period." } }, { "columnMatch": "Subscription", "formatter": 5 }, { "columnMatch": "Resource Group", "formatter": 5 }, { "columnMatch": "Resource", "formatter": 5 }, { "columnMatch": "LAW Connection Status", "formatter": 5 }, { "columnMatch": "distinctWorkspaces", "formatter": 18, "formatOptions": { "linkColumn": "Agent Info", "linkTarget": "CellDetails", "linkIsContextBlade": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "1", "representation": "success", "text": "View agent details." }, { "operator": "==", "thresholdValue": "1", "representation": "more", "text": "View agent details." }, { "operator": "is Empty", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] }, "tooltipFormat": { "tooltip": "If green, this resource is sending data to more than one Log Analytics workspace. If gray, this resource is just sending to a single Log Analytics workspace. You can click on \"View agent details\" to see which agent(s) (MMA or AMA) are reporting and to which workspace(s)." } }, { "columnMatch": "Power State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "VM running", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "VM deallocated", "representation": "stopped", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Disconnected", "representation": "Disconnect", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Connected", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Expired", "representation": "2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Failed", "representation": "3", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Operating System", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true } }, { "columnMatch": "Extension Type", "formatter": 18, "formatOptions": { "linkColumn": "Extension Info", "linkTarget": "CellDetails", "linkIsContextBlade": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Extension Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Succeeded", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Failed", "representation": "3", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Updating", "representation": "pending", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "N/A", "representation": "more", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "1", "text": "{0}{1}" } ] } }, { "columnMatch": "Extension Count", "formatter": 5 }, { "columnMatch": "Extension Info", "formatter": 5 }, { "columnMatch": "ResourceId", "formatter": 5 }, { "columnMatch": "Agent Count", "formatter": 5 }, { "columnMatch": "Agent Info", "formatter": 5 }, { "columnMatch": "subscriptionName", "formatter": 5 }, { "columnMatch": "resourceName", "formatter": 5 }, { "columnMatch": "TenantId", "formatter": 5 } ], "rowLimit": 10000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "LAW Connection Status", "Subscription", "Resource Group" ], "expandTopLevel": false, "finalBy": "Resource" }, "labelSettings": [ { "columnId": "distinctWorkspaces", "label": "Multi-homing" } ] }, "sortBy": [] }, "name": "queryMerge" }, { "type": 1, "content": { "json": "Use the below section to install the MMA or AMA agent to VMs.", "style": "info" }, "conditionalVisibility": { "parameterName": "Documentation", "comparison": "isEqualTo", "value": "On" }, "name": "text - 8" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "46871c9f-a3ae-4000-b719-7a76fb661f70", "version": "KqlParameterItem/1.0", "name": "OS", "label": "Operating System", "type": 10, "isRequired": true, "value": "Windows", "typeSettings": { "additionalResourceOptions": [] }, "jsonData": "[\"Windows\", \"Linux\"]", "timeContext": { "durationMs": 86400000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "f25e250e-3430-432f-a59a-543cc4ff7458", "linkTarget": "OpenBlade", "linkLabel": "Deploy Windows MMA", "style": "primary", "linkIsContextBlade": true, "bladeOpenContext": { "bladeName": "CreateAssignmentBladeV2", "extensionName": "Microsoft_Azure_Policy", "bladeJsonParameters": "{\r\n \"assignMode\": 1,\r\n \"definitionId\": \"/providers/Microsoft.Authorization/policyDefinitions/0868462e-646c-4fe3-9ced-a733534b6a2c\"\r\n}" } }, { "id": "1e65520a-5f45-45a6-9ffe-469cf435a212", "linkTarget": "OpenBlade", "linkLabel": "Deploy Windows AMA to VMs and Arc VMs", "style": "primary", "linkIsContextBlade": true, "bladeOpenContext": { "bladeName": "CreateAssignmentBladeV2", "extensionName": "Microsoft_Azure_Policy", "bladeJsonParameters": "{\r\n \"assignMode\": 0,\r\n \"definitionId\": \"/providers/Microsoft.Authorization/policySetDefinitions/9575b8b7-78ab-4281-b53b-d3c1ace2260b\"\r\n}" } } ] }, "conditionalVisibility": { "parameterName": "OS", "comparison": "isEqualTo", "value": "Windows" }, "name": "links - 5" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "3096d3dc-6b6c-4a36-b985-ad906cf0e5bd", "linkTarget": "OpenBlade", "linkLabel": "Deploy Linux MMA", "style": "primary", "linkIsContextBlade": true, "bladeOpenContext": { "bladeName": "CreateAssignmentBladeV2", "extensionName": "Microsoft_Azure_Policy", "bladeJsonParameters": "{\r\n \"assignMode\": 1,\r\n \"definitionId\": \"/providers/Microsoft.Authorization/policyDefinitions/053d3325-282c-4e5c-b944-24faffd30d77\"\r\n}" } }, { "id": "c91495b8-cc44-4238-a6fd-dd81e5ef1802", "linkTarget": "OpenBlade", "linkLabel": "Deploy Linux AMA to VMs and Arc VMs", "style": "primary", "linkIsContextBlade": true, "bladeOpenContext": { "bladeName": "CreateAssignmentBladeV2", "extensionName": "Microsoft_Azure_Policy", "bladeJsonParameters": "{\r\n \"assignMode\": 0,\r\n \"definitionId\": \"/providers/Microsoft.Authorization/policySetDefinitions/118f04da-0375-44d1-84e3-0fd9e1849403\"\r\n}" } } ] }, "conditionalVisibility": { "parameterName": "OS", "comparison": "isEqualTo", "value": "Linux" }, "name": "links - 5 - Copy" } ] }, "conditionalVisibility": { "parameterName": "parameterTab", "comparison": "isEqualTo", "value": "vm" }, "name": "groupVM" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "For more information regarding ingesting NSG Flow Logs (Traffic Analytics) into Microsoft Sentinel, please refer to this documentation: https://learn.microsoft.com/en-us/azure/network-watcher/enable-network-watcher-flow-log-settings. If the below query shows an error, this is likely because Traffic Analytics has not been enabled for the selected workspace.", "style": "info" }, "conditionalVisibilities": [ { "parameterName": "Documentation", "comparison": "isEqualTo", "value": "On" }, { "parameterName": "parameterTab", "comparison": "isNotEqualTo", "value": "vm" }, { "parameterName": "parameterTab", "comparison": "isNotEqualTo", "value": "activity" }, { "parameterName": "parameterTab", "comparison": "isNotEqualTo", "value": "aadlogs" }, { "parameterName": "parameterTab", "comparison": "isNotEqualTo", "value": "law" } ], "name": "text - 4" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{parameterSubscription}" ], "parameters": [ { "id": "4c3442ff-dcd6-41c4-b9f1-319bfa60680c", "version": "KqlParameterItem/1.0", "name": "nsgWithTrafficAnalytics", "type": 1, "query": "Resources\r\n| where type =~ 'Microsoft.Network/networkWatchers/flowlogs'\r\n| extend provisioningState = parse_json(properties).provisioningState \r\n| extend workspaceResourceId = tostring(parse_json(parse_json(parse_json(properties).flowAnalyticsConfiguration).networkWatcherFlowAnalyticsConfiguration).workspaceResourceId)\r\n| extend targetResourceId = iff(notempty(workspaceResourceId) and provisioningState == \"Succeeded\", tostring(parse_json(properties).targetResourceId), \"null\" ) \r\n| distinct targetResourceId", "crossComponentResources": [ "{parameterSubscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "d9f68f96-6a93-46c1-beb9-69ac918658a4", "version": "KqlParameterItem/1.0", "name": "nsgWithFlowLogs", "type": 1, "query": "Resources\r\n| where type =~ 'Microsoft.Network/networkWatchers/flowlogs'\r\n| extend provisioningState = parse_json(properties).provisioningState \r\n| extend targetResourceId = iff(provisioningState == \"Succeeded\", tostring(parse_json(properties).targetResourceId), \"null\" ) \r\n| distinct targetResourceId", "crossComponentResources": [ "{parameterSubscription}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources\r\n| where type =~ 'microsoft.network/networksecuritygroups'\r\n| extend flowLogs = \"{nsgWithFlowLogs}\" has id\r\n| extend trafficAnalytics = \"{nsgWithTrafficAnalytics}\" has id\r\n| project subscriptionId, [\"Resource group\"] = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), ['Network Security Group'] = id, name, [\"Location\"]=location, [\"Flow Logs\"]=flowLogs, [\"Traffic Analytics\"]=trafficAnalytics, Enable = 'Enable'\r\n| order by name asc", "size": 3, "title": "NSG Flow Log Coverage", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{parameterSubscription}" ], "gridSettings": { "rowLimit": 10000, "labelSettings": [ { "columnId": "subscriptionId", "label": "Subscription" } ] } }, "conditionalVisibility": { "parameterName": "id", "comparison": "isEqualTo", "value": "999" }, "name": "queryNSGFlowLogs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureNetworkAnalytics_CL\r\n| extend nsgs = split(NSGList_s, \"/\")\r\n| mv-expand nsgs\r\n| where nsgs != \"\"\r\n| summarize by tostring(nsgs)", "size": 0, "timeContextFromParameter": "parameterLookback", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{parameterWorkspace}" ] }, "conditionalVisibility": { "parameterName": "id", "comparison": "isEqualTo", "value": "999" }, "name": "queryTA" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"3411a43a-e8d0-4f5b-a42a-a91b255c303a\",\"mergeType\":\"leftouter\",\"leftTable\":\"queryNSGFlowLogs\",\"rightTable\":\"queryTA\",\"leftColumn\":\"name\",\"rightColumn\":\"nsgs\"}],\"projectRename\":[{\"originalName\":\"[queryNSGFlowLogs].subscriptionId\",\"mergedName\":\"Subscription\",\"fromId\":\"3411a43a-e8d0-4f5b-a42a-a91b255c303a\"},{\"originalName\":\"[queryNSGFlowLogs].Resource group\",\"mergedName\":\"Resource group\",\"fromId\":\"3411a43a-e8d0-4f5b-a42a-a91b255c303a\"},{\"originalName\":\"[queryNSGFlowLogs].Network Security Group\",\"mergedName\":\"Network Security Group\",\"fromId\":\"3411a43a-e8d0-4f5b-a42a-a91b255c303a\"},{\"originalName\":\"[queryNSGFlowLogs].name\",\"mergedName\":\"name\",\"fromId\":\"3411a43a-e8d0-4f5b-a42a-a91b255c303a\"},{\"originalName\":\"[queryNSGFlowLogs].Location\",\"mergedName\":\"Location\",\"fromId\":\"3411a43a-e8d0-4f5b-a42a-a91b255c303a\"},{\"originalName\":\"[queryNSGFlowLogs].Flow Logs\",\"mergedName\":\"Flow Logs\",\"fromId\":\"3411a43a-e8d0-4f5b-a42a-a91b255c303a\"},{\"originalName\":\"[queryNSGFlowLogs].Traffic Analytics\",\"mergedName\":\"Traffic Analytics\",\"fromId\":\"3411a43a-e8d0-4f5b-a42a-a91b255c303a\"},{\"originalName\":\"[queryTA].nsgs\",\"mergedName\":\"nsgs\",\"fromId\":\"3411a43a-e8d0-4f5b-a42a-a91b255c303a\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"LAW Connection Status\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"nsgs\",\"operator\":\"isNotNull\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"🟢Connected\"}},{\"criteriaContext\":{\"leftOperand\":\"nsgs\",\"operator\":\"is Empty\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"⚪Disconnected\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\"}}]},{\"originalName\":\"[queryNSGFlowLogs].Enable\",\"mergedName\":\"Enable\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryNSGFlowLogs].resourceGroup\",\"mergedName\":\"resourceGroup\",\"fromId\":\"unknown\"}]}", "size": 3, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "Subscription", "formatter": 5 }, { "columnMatch": "Resource group", "formatter": 5 }, { "columnMatch": "Network Security Group", "formatter": 5 }, { "columnMatch": "name", "formatter": 5 }, { "columnMatch": "Location", "formatter": 17 }, { "columnMatch": "Flow Logs", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "success", "text": "Enabled" }, { "operator": "==", "thresholdValue": "0", "representation": "disabled", "text": "Disabled" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "Traffic Analytics", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "success", "text": "Enabled" }, { "operator": "==", "thresholdValue": "0", "representation": "disabled", "text": "Disabled" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "nsgs", "formatter": 5 }, { "columnMatch": "LAW Connection Status", "formatter": 5, "tooltipFormat": { "tooltip": "If green (\"Connected\"), this means the resource has sent data to at least one of the selected Log Analytics workspaces within the specified lookback period. If gray (\"Disconnected\"), no data was found in any of the selected Log Analytics workspaces within the specified lookback period." } }, { "columnMatch": "Enable", "formatter": 13, "formatOptions": { "linkColumn": "Network Security Group", "linkTarget": "Resource", "subTarget": "flowLogs", "linkIsContextBlade": true, "showIcon": false } } ], "rowLimit": 10000, "hierarchySettings": { "treeType": 1, "groupBy": [ "LAW Connection Status", "Subscription", "Resource group" ], "expandTopLevel": false, "finalBy": "Network Security Group" } } }, "showPin": false, "name": "queryMergeNSGFlowLogs" } ] }, "conditionalVisibility": { "parameterName": "parameterTab", "comparison": "isEqualTo", "value": "nsgflowlogs" }, "name": "groupNSGFlowLogs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{parameterSubscription}" ], "parameters": [ { "id": "7dbfdccb-a001-4fe4-8c6d-6194718356ce", "version": "KqlParameterItem/1.0", "name": "parameterResourceType", "label": "Resource Type", "type": 7, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resources\r\n| where type in~ (\r\n//!'microsoft.automation/automationaccounts',\r\n//'microsoft.avs/privateclouds',\r\n//'microsoft.cache/redis',\r\n//'microsoft.cdn/cdnwebapplicationfirewallpolicies',\r\n'microsoft.cdn/profiles',\r\n//'microsoft.cdn/profiles/endpoints',\r\n'microsoft.classicstorage/storageaccounts',\r\n//'microsoft.cognitiveservices/accounts',\r\n'microsoft.containerregistry/registries',\r\n'microsoft.containerservice/managedclusters',\r\n'microsoft.datafactory/factories',\r\n//'microsoft.datalakestore/accounts',\r\n//'microsoft.datashare/accounts',\r\n//'microsoft.dbformysql/servers',\r\n//'microsoft.dbforpostgresql/servers',\r\n//Not populating 'microsoft.desktopvirtualization/applicationgroups',\r\n//Not populating 'microsoft.desktopvirtualization/hostpools',\r\n//'microsoft.desktopvirtualization/workspaces',\r\n'microsoft.devices/iothubs',\r\n'microsoft.eventhub/namespaces',\r\n//'microsoft.insights/webtests',\r\n'microsoft.keyvault/vaults',\r\n//'microsoft.kusto/clusters',\r\n//'microsoft.logic/integrationaccounts',\r\n//'microsoft.logic/workflows',\r\n//'microsoft.machinelearningservices/workspaces',\r\n//'microsoft.media/mediaservices',\r\n'microsoft.network/applicationgateways',\r\n'microsoft.network/azurefirewalls',\r\n'microsoft.network/bastionhosts',\r\n'microsoft.network/frontdoors',\r\n'microsoft.network/networksecuritygroups',\r\n'microsoft.network/publicipaddresses',\r\n//'microsoft.network/serviceendpointpolicies',\r\n'microsoft.network/trafficmanagerprofiles',\r\n'microsoft.purview/accounts',\r\n'microsoft.recoveryservices/vaults',\r\n//'microsoft.redhatopenshift/openshiftclusters',\r\n'microsoft.servicebus/namespaces',\r\n'microsoft.sql/managedinstances',\r\n'microsoft.sql/managedinstances/databases',\r\n'microsoft.sql/servers',\r\n'microsoft.sql/servers/databases',\r\n'microsoft.storage/storageaccounts',\r\n//'microsoft.synapse/workspaces',\r\n//'microsoft.synapse/workspaces/bigdatapools',\r\n//'microsoft.synapse/workspaces/sqlpools',\r\n//'microsoft.web/serverfarms',\r\n'microsoft.web/sites',\r\n'microsoft.web/sites/slots'\r\n)\r\n| summarize by type\r\n", "crossComponentResources": [ "{parameterSubscription}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parametersResourceType" }, { "type": 1, "content": { "json": "For more information regarding connecting logs from Azure service to Microsoft Sentinel, please refer to this documentation: https://docs.microsoft.com/azure/sentinel/connect-azure-windows-microsoft-services?tabs=SA%2CAMA#diagnostic-settings-based-connections", "style": "info" }, "conditionalVisibility": { "parameterName": "Documentation", "comparison": "isEqualTo", "value": "On" }, "name": "text - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type in~ ({parameterResourceType})\r\n| extend resourceGroup=strcat(\"/subscriptions/\", subscriptionId, \"/resourceGroups/\", resourceGroup)\r\n| join kind=leftouter(\r\n resourcecontainers\r\n | where type == \"microsoft.resources/subscriptions\"\r\n | extend subscriptionName = tostring(name)\r\n | extend subscriptionRId = tostring(id)\r\n | project id, subscriptionId, subscriptionRId, subscriptionName\r\n) on $left.subscriptionId == $right.subscriptionId\r\n| extend typeDisplayName=case(type =~ 'microsoft.insights/components','Application Insights',type =~ 'microsoft.insights/privatelinkscopes','Azure Monitor Private Link Scope',type =~ 'microsoft.insights/webtests','Availability test',type =~ 'microsoft.insights/workbooks','Azure Workbook',type =~ 'microsoft.insights/workbooktemplates','Azure Workbook Template',type =~ 'microsoft.appplatform/spring','Azure Spring Cloud',type =~ 'microsoft.cache/redisenterprise','Redis Enterprise',type =~ 'microsoft.cache/redisenterprise/databases','Cache',type =~ 'microsoft.cache/redis','Azure Cache for Redis',type =~ 'microsoft.visualstudio/account','Azure DevOps organization',(type =~ 'microsoft.visualstudio/account/project') and (kind =~ ''),'DevOps Starter',(type =~ 'microsoft.visualstudio/account/project') and (kind =~ 'project'),'DevOps Starter',(type =~ 'microsoft.visualstudio/account/project') and (kind =~ 'bootstrappedproject'),'DevOps Starter',type =~ 'microsoft.visualstudio/account/project','DevOps Starter',type =~ 'microsoft.devops/pipelines','DevOps Starter',type =~ 'microsoft.confluent/organizations','Confluent organization',type =~ 'microsoft.datadog/monitors','Datadog',type =~ 'dynatrace.observability/monitors','Dynatrace',type =~ 'microsoft.elastic/monitors','Elasticsearch (Elastic Cloud)',type =~ 'microsoft.logz/monitors','Logz main account',type =~ 'microsoft.logz/monitors/accounts','Logz sub account',type =~ 'microsoft.logz/monitors/metricssource','Logz metrics data source',type =~ 'nginx.nginxplus/nginxdeployments','NGINX Deployment',type =~ 'citrix.services/xenappessentials','Citrix Virtual Apps Essentials',type =~ 'citrix.services/xendesktopessentials','Citrix Virtual Desktops Essentials',type =~ 'microsoft.vmwarecloudsimple/virtualmachines','CloudSimple Virtual Machine',type =~ 'microsoft.vmwarecloudsimple/dedicatedcloudservices','CloudSimple Service',type =~ 'microsoft.vmwarecloudsimple/dedicatedcloudnodes','CloudSimple Node',type =~ 'microsoft.resourcegraph/queries','Resource Graph query',type =~ 'microsoft.portal/virtual-privatedashboards','Private dashboard',type =~ 'microsoft.portal/dashboards','Shared dashboard',type =~ 'microsoft.resources/subscriptions/resourcegroups','Resource group',type =~ 'microsoft.azureactivedirectory/b2cdirectories','B2C Tenant',type =~ 'microsoft.azureactivedirectory/guestusages','Guest Usage',type =~ 'microsoft.aad/domainservices','Azure AD Domain Services',type =~ 'microsoft.aadiam/privatelinkforazuread','Private Link for Azure AD',type =~ 'microsoft.azurestackhci/clusters','Azure Stack HCI',type =~ 'microsoft.deviceupdate/accounts','Device Update for IoT Hub',type =~ 'microsoft.agfoodplatform/farmbeats','Azure FarmBeats',type =~ 'microsoft.analysisservices/servers','Analysis Services',type =~ 'microsoft.anybuild/clusters','AnyBuild cluster',type =~ 'microsoft.apimanagement/service','API Management service',type =~ 'microsoft.solutions/applicationdefinitions','Service catalog managed application definition',type =~ 'microsoft.solutions/applications','Managed application',type =~ 'microsoft.vsonline/plans','Visual Studio Online Plan',type =~ 'microsoft.attestation/attestationproviders','Attestation provider',type =~ 'microsoft.automation/automationaccounts','Automation Account',type =~ 'microsoft.automation/automationaccounts/modules','Module',type =~ 'microsoft.automation/automationaccounts/hybridrunbookworkergroups','Hybrid Worker Group',type =~ 'microsoft.automation/automationaccounts/runbooks','Runbook',type =~ 'microsoft.appconfiguration/configurationstores','App Configuration',type =~ 'microsoft.batch/batchaccounts','Batch account',type =~ 'microsoft.resources/subscriptions','Subscription',type =~ 'microsoft.autonomoussystems/workspaces','Bonsai',(type =~ 'microsoft.botservice/botservices') and (kind =~ 'bot'),'Bot Channels Registration',(type =~ 'microsoft.botservice/botservices') and (kind =~ 'sdk'),'Web App Bot',(type =~ 'microsoft.botservice/botservices') and (kind =~ 'function'),'Functions Bot',(type =~ 'microsoft.botservice/botservices') and (kind =~ 'designer'),'Conversation Designer Bot',(type =~ 'microsoft.botservice/botservices') and (kind =~ 'azurebot'),'Azure Bot',type =~ 'microsoft.botservice/botservices','Bot Service',type =~ 'microsoft.cdn/profiles/endpoints/customdomains','Custom domain',type =~ 'microsoft.cdn/profiles/endpoints','Endpoint',type =~ 'microsoft.cdn/profiles/endpoints/origins','Origin',type =~ 'microsoft.cdn/profiles','Front Door and CDN profiles',type =~ 'microsoft.cdn/profiles/afdendpoints','Endpoint',type =~ 'microsoft.cdn/profiles/customdomains','Custom domain',type =~ 'microsoft.cdn/profiles/origingroups','Origin group',type =~ 'microsoft.cdn/profiles/rulesets','Rule set',type =~ 'microsoft.cdn/profiles/secrets','Secret',type =~ 'microsoft.cdn/profiles/securitypolicies','Security policy',type =~ 'microsoft.cdn/profiles/afdendpoints/routes','Route',type =~ 'microsoft.cdn/profiles/origingroups/origins','Origin',type =~ 'microsoft.cdn/profiles/rulesets/rules','Rule',type =~ 'microsoft.chaos/experiments','Chaos Experiment',type =~ 'microsoft.chaos/chaosexperiments','Chaos Experiment (Classic)',type =~ 'microsoft.classicstorage/storageaccounts/disks','Disk (classic)',type =~ 'microsoft.classicstorage/storageaccounts/osimages','OS image (classic)',type =~ 'microsoft.classicstorage/storageaccounts/vmimages','VM image (classic)',type =~ 'microsoft.classiccompute/virtualmachines','Virtual machine (classic)',type =~ 'microsoft.loadtestservice/loadtests','Azure Load Testing',type =~ 'microsoft.classiccompute/domainnames','Cloud service (classic)',type =~ 'microsoft.classiccompute/domainnames/slots/roles','Cloud service role (classic)',type =~ 'microsoft.compute/cloudservices','Cloud service (extended support)',type =~ 'microsoft.cloudtest/accounts','CloudTest Account',type =~ 'microsoft.cloudtest/hostedpools','1ES Hosted Pool',type =~ 'microsoft.cloudtest/images','CloudTest Image',type =~ 'microsoft.cloudtest/pools','CloudTest Pool',type =~ 'microsoft.communication/communicationservices','Communication Service',type =~ 'microsoft.compute/availabilitysets','Availability set',type =~ 'microsoft.compute/capacityreservationgroups','Capacity Reservation Group',type =~ 'microsoft.compute/hostgroups','Host group',type =~ 'microsoft.compute/hostgroups/hosts','Host',type =~ 'microsoft.compute/proximityplacementgroups','Proximity placement group',type =~ 'microsoft.compute/sshpublickeys','SSH key',type =~ 'microsoft.all/virtualmachines','Virtual machine',type =~ 'microsoft.compute/virtualmachines','Virtual machine',type =~ 'microsoft.compute/virtualmachinescalesets','Virtual machine scale set',type =~ 'microsoft.confidentialledger/ledgers','Confidential Ledger',type =~ 'microsoft.connectedvehicle/platformaccounts','Connected Vehicle Platform',type =~ 'microsoft.containerregistry/registries','Container registry',type =~ 'microsoft.containerregistry/registries/replications','Container registry replication',type =~ 'microsoft.containerregistry/registries/scopemaps','Container registry scope map',type =~ 'microsoft.containerregistry/registries/tokens','Container registry token',type =~ 'microsoft.containerregistry/registries/webhooks','Container registry webhook',type =~ 'microsoft.kubernetes/connectedclusters','Kubernetes - Azure Arc',type =~ 'microsoft.containerservice/managedclusters','Kubernetes service',type =~ 'microsoft.containerinstance/containergroups','Container instances',type =~ 'microsoft.kubernetes/connectedclusters/microsoft.kubernetesconfiguration/namespaces','Kubernetes - Azure Arc Namespace',type =~ 'microsoft.containerservice/managedclusters/microsoft.kubernetesconfiguration/namespaces','Kubernetes Namespace',type =~ 'microsoft.kubernetes/connectedclusters/microsoft.kubernetesconfiguration/fluxconfigurations','GitOps configuration',type =~ 'microsoft.containerservice/managedclusters/microsoft.kubernetesconfiguration/fluxconfigurations','GitOps configuration',type =~ 'microsoft.portalservices/extensions/deployments','Extension Deployment',type =~ 'microsoft.portalservices/extensions','Portal Extension',type =~ 'microsoft.portalservices/extensions/slots','Extension Slot',type =~ 'microsoft.portalservices/extensions/versions','Extension Version',type =~ 'microsoft.dashboard/grafana','Azure Managed Grafana',type =~ 'microsoft.azuredata/sqlserverregistrations','SQL Server registry',type =~ 'microsoft.databricks/workspaces','Azure Databricks Service',type =~ 'microsoft.datacatalog/catalogs','Data Catalog',type =~ 'microsoft.datacollaboration/workspaces','Project CI',type =~ 'microsoft.datafactory/datafactories','Data factory',type =~ 'microsoft.datafactory/factories','Data factory (V2)',type =~ 'microsoft.datalakeanalytics/accounts','Data Lake Analytics',type =~ 'microsoft.datalakestore/accounts','Data Lake Storage Gen1',type =~ 'microsoft.dataprotection/backupvaults','Backup vault',type =~ 'microsoft.datashare/accounts','Data Share',type =~ 'microsoft.clusterstor/nodes','ClusterStor',type =~ 'microsoft.baremetal/crayservers','Cray Server',type =~ 'microsoft.baremetal/monitoringservers','Monitoring Server',type =~ 'microsoft.securitydetonation/chambers','Security Detonation Chamber',type =~ 'microsoft.devtestlab/labs','DevTest Lab',type =~ 'microsoft.devtestlab/labs/virtualmachines','Virtual machine',type =~ 'microsoft.digitaltwins/digitaltwinsinstances','Azure Digital Twins',type =~ 'microsoft.compute/disks','Disk',type =~ 'microsoft.compute/diskaccesses','Disk Access',type =~ 'microsoft.compute/diskencryptionsets','Disk Encryption Set',type =~ 'microsoft.storagepool/diskpools','Disk Pool',type =~ 'microsoft.compute/galleries/applications','VM application definition',type =~ 'microsoft.compute/galleries/applications/versions','VM application version',type =~ 'microsoft.compute/galleries/images','VM image definition',type =~ 'microsoft.compute/images','Image',type =~ 'microsoft.virtualmachineimages/imagetemplates','Image Template',type =~ 'microsoft.compute/galleries/images/versions','VM image version',type =~ 'microsoft.compute/restorepointcollections/restorepoints','Restore Point',type =~ 'microsoft.compute/restorepointcollections','Restore Point Collection',type =~ 'microsoft.compute/galleries','Azure compute gallery',type =~ 'microsoft.compute/snapshots','Snapshot',type =~ 'microsoft.datamigration/services','Azure Database Migration Service',type =~ 'microsoft.datamigration/services/projects','Azure Database Migration Project',type =~ 'microsoft.datamigration/sqlmigrationservices','Azure Database Migration Service',type =~ 'microsoft.network/dnszones','DNS zone',type =~ 'microsoft.network/trafficmanagerprofiles','Traffic Manager profile',type =~ 'microsoft.network/dnsforwardingrulesets','Dns Forwarding Ruleset',type =~ 'microsoft.network/dnsresolvers','DNS Private Resolver',(type =~ 'microsoft.documentdb/databaseaccounts') and (kind =~ 'mongodb'),'Azure Cosmos DB API for MongoDB account',type =~ 'microsoft.documentdb/databaseaccounts','Azure Cosmos DB account',type =~ 'microsoft.documentdb/cassandraclusters','Azure Managed Instance for Apache Cassandra',(type =~ 'microsoft.databoxedge/databoxedgedevices') and (kind =~ 'azurestackedge'),'Azure Stack Edge',(type =~ 'microsoft.databoxedge/databoxedgedevices') and (kind =~ 'azurestackhub'),'Azure Stack Edge',(type =~ 'microsoft.databoxedge/databoxedgedevices') and (kind =~ 'azuremodulardatacentre'),'Azure Stack Edge',(type =~ 'microsoft.databoxedge/databoxedgedevices') and (kind =~ 'azuredataboxgateway'),'Azure Data Box Gateway',(type =~ 'microsoft.databoxedge/databoxedgedevices') and (kind =~ 'azurestackedgegroup'),'Azure Stack Edge',type =~ 'microsoft.databoxedge/databoxedgedevices','Azure Stack Edge',type =~ 'microsoft.edgeorder/orderitems','Azure Edge Hardware Center',type =~ 'microsoft.edgeorder/addresses','Azure Edge Hardware Center Address',type =~ 'microsoft.web/connectiongateways','On-premises data gateway',type =~ 'microsoft.web/connections','API Connection',type =~ 'microsoft.web/customapis','Logic apps custom connector',type =~ 'microsoft.logic/integrationaccounts','Integration account',type =~ 'microsoft.logic/integrationserviceenvironments','Integration Service Environment',type =~ 'microsoft.logic/integrationserviceenvironments/managedapis','Managed Connector',type =~ 'microsoft.logic/workflows','Logic app',type =~ 'microsoft.communication/emailservices/domains','Email Communication Services Domain',type =~ 'microsoft.communication/emailservices','Email Communication Service',type =~ 'microsoft.eventgrid/topics','Event Grid Topic',type =~ 'microsoft.eventgrid/domains','Event Grid Domain',type =~ 'microsoft.eventgrid/domains/topics','Event Grid Domain Topic',type =~ 'microsoft.eventgrid/partnertopics','Event Grid Partner Topic',type =~ 'microsoft.eventgrid/partnerdestinations','Event Grid Partner Destination',type =~ 'microsoft.eventgrid/systemtopics','Event Grid System Topic',type =~ 'microsoft.eventgrid/partnernamespaces','Event Grid Partner Namespace',type =~ 'microsoft.eventgrid/partnernamespaces/eventchannels','Event Grid Event Channel',type =~ 'microsoft.eventgrid/partnernamespaces/channels','Event Grid Channel',type =~ 'microsoft.eventgrid/partnerregistrations','Event Grid Partner Registration',type =~ 'microsoft.eventgrid/partnerconfigurations','Event Grid Partner Configuration',type =~ 'microsoft.eventhub/namespaces','Event Hubs Namespace',type =~ 'microsoft.eventhub/namespaces/eventhubs','Event Hubs Instance',type =~ 'microsoft.eventhub/namespaces/schemagroups','Schema Group',type =~ 'microsoft.eventhub/namespaces/disasterrecoveryconfigs','Event Hubs Geo-DR Alias',type =~ 'microsoft.eventhub/clusters','Event Hubs Cluster',type =~ 'microsoft.experimentation/experimentworkspaces','Experiment Workspace',type =~ 'microsoft.databox/jobs','Azure Data Box',type =~ 'microsoft.fidalgo/devcenters','Fidalgo DevCenter',type =~ 'microsoft.fidalgo/projects/environments','Fidalgo Environment',type =~ 'microsoft.fidalgo/networksettings','Network Connection',type =~ 'microsoft.fidalgo/projects','Fidalgo Project',type =~ 'microsoft.edgezones/edgezones','Edge Zone',type =~ 'microsoft.fluidrelay/fluidrelayservers','Fluid Relay',type =~ 'microsoft.network/frontdoors','Front Door and CDN profiles',type =~ 'github.enterprise/accounts','GitHub AE',type =~ 'microsoft.hdinsight/clusters','HDInsight cluster',type =~ 'microsoft.hdinsight/clusterpools/clusters','HDInsight gen2 cluster',type =~ 'microsoft.hdinsight/clusterpools/clusters/sessionclusters','HDInsight session cluster',type =~ 'microsoft.hdinsight/clusterpools','HDInsight cluster pool',type =~ 'microsoft.healthbot/healthbots','Azure Health Bot',type =~ 'microsoft.hpcworkbench/instances/chambers','Chamber (preview)',type =~ 'microsoft.hpcworkbench/instances/chambers/accessprofiles','Chamber Profile (preview)',type =~ 'microsoft.hpcworkbench/instances/chambers/files','Chamber Data Pipeline File (preview)',type =~ 'microsoft.hpcworkbench/instances/chambers/requests','Chamber Data Pipeline Request (preview)',type =~ 'microsoft.hpcworkbench/instances/chambers/licenses','Chamber License (preview)',type =~ 'microsoft.hpcworkbench/instances/chambers/storages','Chamber Storage (preview)',type =~ 'microsoft.hpcworkbench/instances/chambers/workloads','Chamber VM (preview)',type =~ 'microsoft.hpcworkbench/instances/consortiums','Consortium (preview)',type =~ 'microsoft.hpcworkbench/instances','HPC Workbench (preview)',type =~ 'microsoft.hpcworkbench/instances/sharedstorages','Shared Storage (preview)',type =~ 'microsoft.resourceconnector/appliances','Resource bridge',type =~ 'microsoft.hybridcompute/privatelinkscopes','Azure Arc Private Link Scope',type =~ 'microsoft.scvmm/vmmservers','SCVMM management server',type =~ 'microsoft.scvmm/virtualmachines','SCVMM virtual machine - Azure Arc',type =~ 'microsoft.all/arcvirtualmachines','Azure Arc virtual machine',type =~ 'microsoft.arc/all','Azure Arc enabled resources',type =~ 'microsoft.arc/allfairfax','Azure Arc enabled resources',type =~ 'microsoft.azurestackhci/virtualmachines','Azure Stack HCI virtual machine - Azure Arc',type =~ 'microsoft.extendedlocation/customlocations','Custom location',type =~ 'microsoft.hybridcompute/machines','Server - Azure Arc',type =~ 'microsoft.connectedvmwarevsphere/vcenters','VMware vCenter',(type =~ 'microsoft.connectedvmwarevsphere/virtualmachines') and (kind =~ 'avs'),'AVS virtual machine',(type =~ 'microsoft.connectedvmwarevsphere/virtualmachines') and (kind =~ 'vmware'),'VMware virtual machine - Azure Arc',type =~ 'microsoft.connectedvmwarevsphere/virtualmachines','VMware + AVS virtual machine',type =~ 'microsoft.hybriddata/datamanagers','StorSimple Data Manager',type =~ 'microsoft.azurearcdata/datacontrollers','Azure Arc data controller',type =~ 'microsoft.azurearcdata/postgresinstances','Azure Arc-enabled PostgreSQL Hyperscale',type =~ 'microsoft.azurearcdata/sqlmanagedinstances','SQL managed instance - Azure Arc',type =~ 'microsoft.azurearcdata/sqlserverinstances','SQL Server - Azure Arc',type =~ 'microsoft.network/applicationgateways','Application gateway',type =~ 'microsoft.network/bastionhosts','Bastion',type =~ 'microsoft.network/azurefirewalls','Firewall',type =~ 'microsoft.network/connections','Connection',type =~ 'microsoft.network/expressroutecircuits','ExpressRoute circuit',type =~ 'microsoft.network/expressrouteports','ExpressRoute Direct',type =~ 'microsoft.network/firewallpolicies','Firewall Policy',type =~ 'microsoft.network/ipgroups','IP Group',type =~ 'microsoft.network/localnetworkgateways','Local network gateway',type =~ 'microsoft.network/routefilters','Route filter',type =~ 'microsoft.network/virtualnetworkgateways','Virtual network gateway',(type =~ 'microsoft.network/virtualhubs') and (kind =~ 'routeserver'),'Route Server',type =~ 'microsoft.network/virtualhubs','Microsoft.Network/virtualHub',type =~ 'microsoft.network/virtualwans','Virtual WAN',type =~ 'microsoft.importexport/jobs','Import/export job',type =~ 'microsoft.network/networkexperimentprofiles','Internet Analyzer profile',type =~ 'microsoft.iotcentral/iotapps','IoT Central Application',type =~ 'microsoft.devices/provisioningservices','Azure IoT Hub Device Provisioning Service (DPS)',type =~ 'microsoft.devices/iothubs','IoT Hub',type =~ 'microsoft.storagesync/storagesyncservices','Storage Sync Service',type =~ 'microsoft.storagesyncint/storagesyncservices','Storage Sync Service',type =~ 'microsoft.storagesyncdev/storagesyncservices','Storage Sync Service',type =~ 'microsoft.keyvault/vaults','Key vault',type =~ 'microsoft.kusto/clusters','Azure Data Explorer Cluster',type =~ 'microsoft.kusto/clusters/databases','Azure Data Explorer Database',type =~ 'microsoft.synapse/workspaces/kustopools','Data Explorer pool (preview)',type =~ 'microsoft.synapse/workspaces/kustopools/databases','Data Explorer Database',type =~ 'microsoft.maps/accounts','Azure Maps Account',type =~ 'microsoft.maps/accounts/creators','Azure Maps Creator Resource',type =~ 'microsoft.maintenance/maintenanceconfigurations','Maintenance Configuration',type =~ 'microsoft.labservices/labs','Lab',type =~ 'microsoft.labservices/labaccounts','Lab account',type =~ 'microsoft.labservices/labplans','Lab plan',type =~ 'microsoft.labservices/labaccounts/labs','Lab',type =~ 'microsoft.network/networkmanagers','Network Manager',type =~ 'microsoft.network/networkmanagers/connectivityconfigurations','Network Manager',type =~ 'microsoft.network/networkmanagers/networkgroups','Network Manager',type =~ 'microsoft.network/networkmanagers/securityadminconfigurations','Network Manager',type =~ 'microsoft.managedidentity/userassignedidentities','Managed Identity',type =~ 'microsoft.gallery/myareas/galleryitems','Template',type =~ 'microsoft.saas/applications','Software as a Service (classic)',type =~ 'microsoft.saas/saasresources','SaaS (classic)',type =~ 'microsoft.saas/resources','SaaS',type =~ 'microsoft.media/mediaservices/liveevents','Live event',type =~ 'microsoft.media/mediaservices','Media service',type =~ 'microsoft.media/mediaservices/streamingendpoints','Streaming Endpoint',type =~ 'microsoft.media/mediaservices/channels','Channel',type =~ 'microsoft.media/mediaservices/locators','Locator',type =~ 'microsoft.media/mediaservices/assets','Asset',type =~ 'microsoft.media/mediaservices/programs','Program',type =~ 'microsoft.metaverse/metaverses/events','Event',type =~ 'microsoft.metaverse/metaverses','Metaverse',type =~ 'microsoft.metaverse/metaverses/spaces','Space',type =~ 'microsoft.metaverse/metaverses/templates','Template',type =~ 'microsoft.migrate/projects','Migration project',type =~ 'microsoft.machinelearning/commitmentplans','Machine Learning Studio (classic) web service plan',type =~ 'microsoft.machinelearningservices/workspaces/onlineendpoints/deployments','Machine learning online deployment',type =~ 'microsoft.machinelearningservices/workspaces/onlineendpoints','Machine learning online endpoint',type =~ 'microsoft.machinelearningservices/workspaces','Machine learning',type =~ 'microsoft.machinelearning/webservices','Machine Learning Studio (classic) web service',type =~ 'microsoft.machinelearning/workspaces','Machine Learning Studio (classic) workspace',type =~ 'microsoft.eventhub/namespaces/providers/diagnosticsettings','Diagnostic settings',type =~ 'microsoft.insights/diagnosticsettings','Diagnostic settings',type =~ 'microsoft.insights/datacollectionrules','Data collection rule',type =~ 'microsoft.insights/datacollectionendpoints','Data collection endpoint',type =~ 'microsoft.netapp/netappaccounts','NetApp account',type =~ 'microsoft.netapp/netappaccounts/capacitypools','Capacity pool',type =~ 'microsoft.netapp/netappaccounts/capacitypools/volumes/snapshots','Snapshot',type =~ 'microsoft.netapp/netappaccounts/snapshotpolicies','Snapshot policy',type =~ 'microsoft.netapp/netappaccounts/capacitypools/volumes','Volume',type =~ 'microsoft.netapp/netappaccounts/volumegroups','VolumeGroup',type =~ 'microsoft.network/applicationsecuritygroups','Application security group',type =~ 'microsoft.classicnetwork/networksecuritygroups','Network security group (classic)',type =~ 'microsoft.classicnetwork/virtualnetworks','Virtual network (classic)',type =~ 'microsoft.network/customipprefixes','Custom IP Prefix',type =~ 'microsoft.network/ddosprotectionplans','DDoS protection plan',type =~ 'microsoft.compute/virtualmachines/providers/guestconfigurationassignments','Guest Assignment',type =~ 'microsoft.hybridcompute/machines/providers/guestconfigurationassignments','Guest Assignment',type =~ 'microsoft.connectedvmwarevsphere/virtualmachines/providers/guestconfigurationassignments','Guest Assignment',type =~ 'microsoft.network/loadbalancers','Load balancer',type =~ 'microsoft.network/natgateways','NAT gateway',(type =~ 'microsoft.network/networkinterfaces') and (kind =~ 'regular'),'Regular Network Interface',(type =~ 'microsoft.network/networkinterfaces') and (kind =~ 'elastic'),'Elastic Network Interface',(type =~ 'microsoft.network/networkinterfaces') and (kind =~ 'parent'),'Parent Network Interface',type =~ 'microsoft.network/networkinterfaces','Network interface',type =~ 'microsoft.network/networksecuritygroups','Network security group',type =~ 'microsoft.network/networkwatchers','Network Watcher',type =~ 'microsoft.network/networkwatchers/flowlogs','NSG Flow log',type =~ 'microsoft.network/privateendpoints','Private endpoint',type =~ 'microsoft.management/managementgroups/providers/privatelinkassociations','Application Gateway',type =~ 'microsoft.network/privatelinkservices','Private link service',type =~ 'microsoft.network/publicipaddresses','Public IP address',type =~ 'microsoft.network/publicipprefixes','Public IP Prefix',type =~ 'microsoft.classicnetwork/reservedips','Reserved IP address (classic)',type =~ 'microsoft.authorization/resourcemanagementprivatelinks','Resource management private link',type =~ 'microsoft.network/routetables','Route table',(type =~ 'microsoft.network/serviceendpointpolicies') and (kind =~ 'internal'),'Service endpoint policy',type =~ 'microsoft.network/serviceendpointpolicies','Service endpoint policy',type =~ 'microsoft.network/virtualnetworks','Virtual network',type =~ 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies','Application Gateway WAF policy',type =~ 'microsoft.cdn/cdnwebapplicationfirewallpolicies','Content Delivery Network WAF policy',type =~ 'microsoft.network/frontdoorwebapplicationfirewallpolicies','Front Door WAF policy',type =~ 'microsoft.notificationhubs/namespaces','Notification Hub Namespace',type =~ 'microsoft.notificationhubs/namespaces/notificationhubs','Notification Hub',type =~ 'microsoft.openenergyplatform/energyservices','Project Oak Forest',type =~ 'microsoft.openlogisticsplatform/workspaces','Open Supply Chain Platform',type =~ 'microsoft.scom/managedinstances','Aquila Instance',type =~ 'microsoft.orbital/spacecrafts/contacts','Contact',type =~ 'microsoft.orbital/contactprofiles','Contact Profile',type =~ 'microsoft.orbital/edgesites','Edge Site',type =~ 'microsoft.orbital/groundstations','Ground Station',type =~ 'microsoft.orbital/l2connections','L2 Connection',type =~ 'microsoft.orbital/spacecrafts','Spacecraft',type =~ 'microsoft.dbformysql/flexibleservers','Azure Database for MySQL flexible server',type =~ 'microsoft.dbforpostgresql/flexibleservers','Azure Database for PostgreSQL flexible server',type =~ 'microsoft.dbforpostgresql/servergroups','Azure Database for PostgreSQL Hyperscale (Citus)',type =~ 'microsoft.dbforpostgresql/serversv2','Azure Database for PostgreSQL server v2',type =~ 'microsoft.dbforpostgresql/servergroupsv2','Azure Database for PostgreSQL Hyperscale (Citus)',type =~ 'microsoft.peering/peerings','Peering',type =~ 'microsoft.peering/peeringservices','Peering Service',type =~ 'microsoft.peering/peeringservices/prefixes','Peering Service Prefix',type =~ 'microsoft.peering/peerings/registeredasns','Registered ASN',type =~ 'microsoft.peering/peerings/registeredprefixes','Registered prefix',type =~ 'microsoft.azurepercept/accounts','Azure Percept account',type =~ 'microsoft.workloads/phpworkloads','Scalable WordPress on Linux',type =~ 'microsoft.playfab/playeraccountpools','PlayFab player account pool',type =~ 'microsoft.playfab/playfabresources','PlayFab resource',type =~ 'microsoft.playfab/titles','PlayFab title',type =~ 'microsoft.powerbidedicated/capacities','Power BI Embedded',type =~ 'microsoft.network/privatednszones','Private DNS zone',type =~ 'microsoft.purview/accounts','Microsoft Purview account',type =~ 'microsoft.cognitiveservices/browseappliedaihub','Applied AI service',type =~ 'microsoft.cognitiveservices/browseallinone','Cognitive services multi-service account',type =~ 'microsoft.cognitiveservices/browseanomalydetector','Anomaly detector',type =~ 'microsoft.cognitiveservices/browseappliedai','All applied AI services',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ ''),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'anomalydetector'),'Anomaly detector',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'bing.autosuggest'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'bing.autosuggest.v7'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'bing.customsearch'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'bing.customvisualsearch'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'bing.entitysearch'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'bing.search'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'bing.search.v7'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'bing.speech'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'bing.spellcheck'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'bing.spellcheck.v7'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'cognitiveservices'),'Cognitive services multi-service account',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'computervision'),'Computer vision',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'contentmoderator'),'Content moderator',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'customvision.prediction'),'Custom vision',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'customvision.training'),'Custom vision',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'emotion'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'face'),'Face API',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'formrecognizer'),'Form recognizer',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'immersivereader'),'Immersive reader',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'inkrecognizer'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'luis'),'Language understanding',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'luis.authoring'),'Language understanding',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'metricsadvisor'),'Metrics advisor',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'personalizer'),'Personalizer',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'qnamaker'),'QnA maker',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'speakerrecognition'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'speechservices'),'Speech service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'speechtranslation'),'Cognitive Service',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'textanalytics'),'Language',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'texttranslation'),'Translator',(type =~ 'microsoft.cognitiveservices/accounts') and (kind =~ 'videointelligence'),'Cognitive Service',type =~ 'microsoft.cognitiveservices/accounts','Cognitive Service',type =~ 'microsoft.cognitiveservices/browsecomputervision','Computer vision',type =~ 'microsoft.cognitiveservices/browsecontentmoderator','Content moderator',type =~ 'microsoft.cognitiveservices/browsecustomvision','Custom vision',type =~ 'microsoft.cognitiveservices/browseface','Face API',type =~ 'microsoft.cognitiveservices/browseformrecognizer','Form recognizer',type =~ 'microsoft.cognitiveservices/browsehealthdecisionsupport','Health decision support',type =~ 'microsoft.cognitiveservices/browseimmersivereader','Immersive reader',type =~ 'microsoft.cognitiveservices/browseluis','Language understanding',type =~ 'microsoft.cognitiveservices/browsemetricsadvisor','Metrics advisor',type =~ 'microsoft.cognitiveservices/browseopenai','Azure OpenAI',type =~ 'microsoft.cognitiveservices/browsepersonalizer','Personalizer',type =~ 'microsoft.cognitiveservices/browseqnamaker','QnA maker',type =~ 'microsoft.cognitiveservices/browsespeechservices','Speech service',type =~ 'microsoft.cognitiveservices/browsetextanalytics','Language',type =~ 'microsoft.cognitiveservices/browsetexttranslation','Translator',type =~ 'microsoft.quantum/workspaces','Quantum Workspace',type =~ 'microsoft.recommendationsservice/accounts','Intelligent Recommendations Account',type =~ 'microsoft.recommendationsservice/accounts/modeling','Modeling',type =~ 'microsoft.recommendationsservice/accounts/serviceendpoints','Service Endpoint',type =~ 'microsoft.recoveryservices/vaults','Recovery Services vault',type =~ 'microsoft.dataprotection/resourceguards','Resource Guard (Preview)',type =~ 'microsoft.recoveryservicesbvtd2/vaults','Recovery Services BVTD2',type =~ 'microsoft.recoveryservicesbvtd/vaults','Recovery Services BVTD',type =~ 'microsoft.recoveryservicesintd/vaults','Recovery Services INTD',type =~ 'microsoft.recoveryservicesintd2/vaults','Recovery Services INTD2',type =~ 'microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems','Backup Item',type =~ 'microsoft.redhatopenshift/openshiftclusters','Azure Red Hat OpenShift',type =~ 'microsoft.relay/namespaces','Relay',type =~ 'microsoft.relay/namespaces/wcfrelays','WCF Relay',type =~ 'microsoft.relay/namespaces/hybridconnections','Hybrid Connection',type =~ 'microsoft.capacity/reservationorders/reservations','Reservation',type =~ 'microsoft.billing/billingaccounts/savingsplanorders/savingsplans','Savings plan',type =~ 'microsoft.billingbenefits/savingsplanorders/savingsplans','Savings plan',type =~ 'microsoft.capacity/reservationorders','Reservation order',type =~ 'microsoft.billing/billingaccounts/savingsplanorders','Savings plan order',type =~ 'microsoft.billingbenefits/savingsplanorders','Savings plan order',type =~ 'microsoft.deploymentmanager/rollouts','Rollout',type =~ 'microsoft.baremetalinfrastructure/baremetalinstances','BareMetal Instance',type =~ 'microsoft.hanaonazure/hanainstances','SAP HANA on Azure',type =~ 'microsoft.workloads/sapvirtualinstances/applicationinstances','Application server instance for SAP solutions',type =~ 'microsoft.workloads/sapvirtualinstances/centralinstances','Central services instance for SAP solutions',type =~ 'microsoft.workloads/sapvirtualinstances/databaseinstances','Database instance for SAP solutions',type =~ 'microsoft.workloads/sapvirtualinstances','Virtual Instance for SAP solutions',type =~ 'microsoft.search/indexes','Search index',type =~ 'microsoft.search/searchservices','Search service',type =~ 'microsoft.security/locations/alerts','Security Alert',type =~ 'microsoft.securityinsightsarg/sentinel','Microsoft Sentinel',type =~ 'microsoft.servicebus/namespaces/topics/subscriptions','Service Bus Subscription',type =~ 'microsoft.servicebus/namespaces','Service Bus Namespace',type =~ 'microsoft.servicebus/namespaces/queues','Service Bus Queue',type =~ 'microsoft.servicebus/namespaces/topics','Service Bus Topic',type =~ 'microsoft.servicebus/namespaces/disasterrecoveryconfigs','Service Bus Geo-DR Alias',type =~ 'microsoft.servicefabric/clusters','Service Fabric cluster',type =~ 'microsoft.servicefabric/managedclusters','Service Fabric managed cluster',type =~ 'microsoft.signalrservice/signalr','SignalR',type =~ 'microsoft.signalrservice/webpubsub','Web PubSub Service',type =~ 'microsoft.datareplication/replicationvaults','Site Recovery vault',type =~ 'microsoft.storage/storageaccounts','Storage account',type =~ 'microsoft.classicstorage/storageaccounts','Storage account (classic)',type =~ 'microsoft.storagecache/caches','HPC cache',type =~ 'microsoft.storagecache/amlfilesystems','Azure Managed Lustre (Preview)',type =~ 'microsoft.storsimple/managers','StorSimple Device Manager',type =~ 'microsoft.storsimplebvtd2/managers','My resources',type =~ 'microsoft.streamanalytics/clusters','Stream Analytics cluster',type =~ 'microsoft.streamanalytics/streamingjobs','Stream Analytics job',type =~ 'microsoft.support/supporttickets','Support Request',type =~ 'microsoft.synapse/privatelinkhubs','Synapse private link hub',type =~ 'microsoft.synapse/workspaces/scopepools','SCOPE pool',type =~ 'microsoft.synapse/workspaces/bigdatapools','Apache Spark pool',(type =~ 'microsoft.synapse/workspaces/sqlpools') and (kind =~ 'v3'),'Dedicated SQL pool',type =~ 'microsoft.synapse/workspaces/sqlpools','Dedicated SQL pool',type =~ 'microsoft.synapse/workspaces','Synapse workspace',type =~ 'microsoft.resources/templatespecs','Template spec',type =~ 'microsoft.resources/builtintemplatespecs','Built-in template spec',type =~ 'microsoft.management/managementgroups/providers/templatespecs','Template spec',type =~ 'microsoft.resources/deploymentscripts','Deployment Script',type =~ 'microsoft.timeseriesinsights/environments','Time Series Insights environment',type =~ 'microsoft.timeseriesinsights/environments/eventsources','Time Series Insights event source',type =~ 'microsoft.timeseriesinsights/environments/referencedatasets','Time Series Insights reference data set',type =~ 'microsoft.timeseriesinsights/environments/accesspolicies','Time Series Insights access policy',type =~ 'microsoft.testbase/testbaseaccounts/packages','Test Base Package',type =~ 'microsoft.testbase/testbaseaccounts','Test Base Account',type =~ 'microsoft.media/videoanalyzers','Video Analyzer',type =~ 'microsoft.hybridnetwork/devices','Azure Network Function Manager – Device',type =~ 'microsoft.hybridnetwork/vendors','Azure Network Function Manager – vendor',type =~ 'microsoft.hybridnetwork/networkfunctions','Azure Network Function Manager – Network Function',type =~ 'microsoft.mobilenetwork/mobilenetworks/datanetworks','Data Network',type =~ 'microsoft.mobilenetwork/mobilenetworks','Mobile Network',type =~ 'microsoft.mobilenetwork/mobilenetworks/sites','Mobile Network Site',type =~ 'microsoft.mobilenetwork/packetcorecontrolplanes/packetcoredataplanes/attacheddatanetworks','Attached Data Network',type =~ 'microsoft.mobilenetwork/packetcorecontrolplanes','Packet Core Control Plane',type =~ 'microsoft.mobilenetwork/packetcorecontrolplanes/packetcoredataplanes','Packet Core Data Plane',type =~ 'microsoft.mobilenetwork/mobilenetworks/services','Service',type =~ 'microsoft.mobilenetwork/sims','Sim',type =~ 'microsoft.mobilenetwork/mobilenetworks/simpolicies','Sim Policy',type =~ 'microsoft.mobilenetwork/mobilenetworks/slices','Slice',type =~ 'microsoft.workloads/monitors','Azure Monitor for SAP solutions',type =~ 'microsoft.hanaonazure/sapmonitors','Azure Monitor for SAP Solutions (classic)',(type =~ 'microsoft.desktopvirtualization/applicationgroups') and (kind =~ 'desktop'),'Application group',(type =~ 'microsoft.desktopvirtualization/applicationgroups') and (kind =~ 'remoteapp'),'Application group',type =~ 'microsoft.desktopvirtualization/applicationgroups','Application group',type =~ 'microsoft.desktopvirtualization/hostpools','Host pool',type =~ 'microsoft.desktopvirtualization/scalingplans','Scaling plan',type =~ 'microsoft.desktopvirtualization/workspaces','Workspace',(type =~ 'microsoft.bing/accounts') and (kind =~ 'bing.autosuggest.v7'),'Bing Resource',(type =~ 'microsoft.bing/accounts') and (kind =~ 'bing.customsearch'),'Bing Resource',(type =~ 'microsoft.bing/accounts') and (kind =~ 'bing.entitysearch'),'Bing Resource',(type =~ 'microsoft.bing/accounts') and (kind =~ 'bing.search.v7'),'Bing Resource',(type =~ 'microsoft.bing/accounts') and (kind =~ 'bing.spellcheck.v7'),'Bing Resource',type =~ 'microsoft.bing/accounts','Bing Resource',type =~ 'microsoft.mixedreality/objectanchorsaccounts','Object Anchors Account',type =~ 'microsoft.mixedreality/objectunderstandingaccounts','Object Understanding Account',type =~ 'microsoft.mixedreality/remoterenderingaccounts','Remote Rendering Account',type =~ 'microsoft.mixedreality/spatialanchorsaccounts','Spatial Anchors Account',type =~ 'microsoft.connectedcache/cachenodes','Connected Cache',type =~ 'microsoft.connectedcache/enterprisecustomers','Connected Cache',type =~ 'microsoft.healthcareapis/services','Azure API for FHIR',type =~ 'microsoft.healthcareapis/workspaces','Health Data Services workspace',type =~ 'microsoft.healthcareapis/workspaces/dicomservices','DICOM service',type =~ 'microsoft.healthcareapis/workspaces/fhirservices','FHIR service',type =~ 'microsoft.healthcareapis/workspaces/iotconnectors','MedTech service',type =~ 'microsoft.operationalinsights/querypacks','Log Analytics query pack',type =~ 'microsoft.operationalinsights/workspaces','Log Analytics workspace',type =~ 'microsoft.operationsmanagement/solutions','Solution',type =~ 'microsoft.genomics/accounts','Genomics account',type =~ 'microsoft.serviceshub/connectors','Services Hub Connector',type =~ 'microsoft.videoindexer/accounts','Video Indexer',(type =~ 'microsoft.windowsiot/deviceservices') and (kind =~ 'iotcore'),'Windows 10 IoT Core Services',type =~ 'microsoft.windowsiot/deviceservices','Windows 10 IoT Core Services',type =~ 'microsoft.windowsesu/multipleactivationkeys','Windows Multiple Activation Key',type =~ 'microsoft.sql/azuresql','Azure SQL resource',(type =~ 'microsoft.sql/servers/databases') and (kind =~ 'system'),'SQL database',(type =~ 'microsoft.sql/servers/databases') and (kind =~ 'v2.0,system'),'SQL database',(type =~ 'microsoft.sql/servers/databases') and (kind =~ 'v12.0,system'),'SQL database',(type =~ 'microsoft.sql/servers/databases') and (kind =~ 'v2.0,user'),'SQL database',(type =~ 'microsoft.sql/servers/databases') and (kind =~ 'v12.0,user'),'SQL database',(type =~ 'microsoft.sql/servers/databases') and (kind =~ 'v12.0,user,vcore'),'SQL database',(type =~ 'microsoft.sql/servers/databases') and (kind =~ 'v12.0,user,vcore,hyperscale'),'SQL database',(type =~ 'microsoft.sql/servers/databases') and (kind =~ 'v12.0,user,vcore,serverless'),'SQL database',(type =~ 'microsoft.sql/servers/databases') and (kind =~ 'v12.0,user,stretch'),'SQL Server stretch database',(type =~ 'microsoft.sql/servers/databases') and (kind =~ 'v12.0,user,datawarehouse'),'Dedicated SQL pool (formerly SQL DW)',(type =~ 'microsoft.sql/servers/databases') and (kind =~ 'v12.0,user,datawarehouse,gen2'),'Dedicated SQL pool (formerly SQL DW)',(type =~ 'microsoft.sql/servers/databases') and (kind =~ 'v12.0,user,datawarehouse,gen2,analytics'),'SQL database',type =~ 'microsoft.sql/servers/databases','SQL database',type =~ 'microsoft.sql/servers/jobagents','Elastic Job agent',type =~ 'microsoft.sql/servers/elasticpools','SQL elastic pool',type =~ 'microsoft.sql/instancepools','Instance pool',type =~ 'microsoft.sql/managedinstances/databases','Managed database',type =~ 'microsoft.sql/managedinstances','SQL managed instance',type =~ 'microsoft.dbformariadb/servers','Azure Database for MariaDB server',type =~ 'microsoft.dbformysql/servers','Azure Database for MySQL single server',type =~ 'microsoft.dbforpostgresql/servers','Azure Database for PostgreSQL single server',(type =~ 'microsoft.sql/servers') and (kind =~ 'v12.0,analytics'),'SQL server',type =~ 'microsoft.sql/servers','SQL server',type =~ 'microsoft.sqlvirtualmachine/sqlvirtualmachines','SQL virtual machine',type =~ 'microsoft.sql/virtualclusters','Virtual cluster',type =~ 'providers.test/statefulibizaengines','VLCentral Help',type =~ 'microsoft.avs/privateclouds','AVS Private cloud',type =~ 'wandisco.fusion/migrators/exclusiontemplates','Exclusion',type =~ 'wandisco.fusion/migrators/livedatamigrations','Migration',type =~ 'wandisco.fusion/migrators/metadatamigrations','Metadata Migration',type =~ 'wandisco.fusion/migrators/metadatatargets','Metadata Target',type =~ 'wandisco.fusion/migrators','LiveData Migrator',type =~ 'wandisco.fusion/migrators/pathmappings','Path Mapping',type =~ 'wandisco.fusion/migrators/targets','Target',type =~ 'microsoft.web/hostingenvironments','App Service Environment',(type =~ 'microsoft.web/kubeenvironments') and (kind =~ ''),'App Service Kubernetes Environment',(type =~ 'microsoft.web/kubeenvironments') and (kind =~ 'containerenvironment'),'Container Apps Environment',type =~ 'microsoft.web/kubeenvironments','App Service Kubernetes Environment',type =~ 'microsoft.web/staticsites','Static Web App',type =~ 'microsoft.app/containerapps','Container App',type =~ 'microsoft.app/managedenvironments','Container Apps Environment',type =~ 'microsoft.certificateregistration/certificateorders','App Service Certificate',type =~ 'microsoft.domainregistration/domains','App Service Domain',(type =~ 'microsoft.web/sites') and (kind =~ ''),'App Service',(type =~ 'microsoft.web/sites') and (kind =~ 'mobileapp'),'App Service',(type =~ 'microsoft.web/sites') and (kind =~ 'mobileapp,entitlement'),'App Service',(type =~ 'microsoft.web/sites') and (kind =~ 'webjob'),'App Service',(type =~ 'microsoft.web/sites') and (kind =~ 'api'),'App Service',(type =~ 'microsoft.web/sites') and (kind =~ 'api,linux'),'App Service',(type =~ 'microsoft.web/sites') and (kind =~ 'api,linux,container'),'App Service',(type =~ 'microsoft.web/sites') and (kind =~ 'api,linux,container,kubernetes'),'App Service',(type =~ 'microsoft.web/sites') and (kind =~ 'api,linux,kubernetes'),'App Service',(type =~ 'microsoft.web/sites') and (kind =~ 'api,kubernetes'),'App Service',(type =~ 'microsoft.web/sites') and (kind =~ 'apiapp'),'App Service',(type =~ 'microsoft.web/sites') and (kind =~ 'api,entitlement'),'App Service',(type =~ 'microsoft.web/sites') and (kind =~ 'functionapp'),'Function App',(type =~ 'microsoft.web/sites') and (kind =~ 'functionapp,linux'),'Function App',(type =~ 'microsoft.web/sites') and (kind =~ 'functionapp,linux,container'),'Function App',(type =~ 'microsoft.web/sites') and (kind =~ 'functionapp,linux,container,kubernetes'),'Function App',(type =~ 'microsoft.web/sites') and (kind =~ 'functionapp,linux,kubernetes'),'Function App',(type =~ 'microsoft.web/sites') and (kind =~ 'functionapp,kubernetes'),'Function App',(type =~ 'microsoft.web/sites') and (kind =~ 'functionapp,workflowapp'),'Logic App (Standard)',(type =~ 'microsoft.web/sites') and (kind =~ 'functionapp,linux,workflowapp'),'Logic App (Standard)',(type =~ 'microsoft.web/sites') and (kind =~ 'functionapp,linux,container,workflowapp'),'Logic App (Standard)',(type =~ 'microsoft.web/sites') and (kind =~ 'functionapp,linux,container,workflowapp,kubernetes'),'Logic App (Standard)',(type =~ 'microsoft.web/sites') and (kind =~ 'functionapp,linux,workflowapp,kubernetes'),'Logic App (Standard)',(type =~ 'microsoft.web/sites') and (kind =~ 'functionapp,workflowapp,kubernetes'),'Logic App (Standard)',(type =~ 'microsoft.web/sites') and (kind =~ 'functionapp,container,workflowapp,kubernetes'),'Logic App (Standard)',type =~ 'microsoft.web/sites','App Service',(type =~ 'microsoft.web/sites/slots') and (kind =~ 'functionapp'),'App Service (Slot)',type =~ 'microsoft.web/sites/slots','App Service (Slot)',(type =~ 'microsoft.web/serverfarms') and (kind =~ 'app,linux'),'App Service plan',(type =~ 'microsoft.web/serverfarms') and (kind =~ 'app,linux,container'),'App Service plan',(type =~ 'microsoft.web/serverfarms') and (kind =~ 'functionapp,linux'),'App Service plan',(type =~ 'microsoft.web/serverfarms') and (kind =~ 'functionapp,linux,container'),'App Service plan',(type =~ 'microsoft.web/serverfarms') and (kind =~ 'linux'),'App Service plan',(type =~ 'microsoft.web/serverfarms') and (kind =~ 'functionapp'),'App Service plan',(type =~ 'microsoft.web/serverfarms') and (kind =~ 'xenon'),'App Service plan',(type =~ 'microsoft.web/serverfarms') and (kind =~ 'windows'),'App Service plan',(type =~ 'microsoft.web/serverfarms') and (kind =~ 'elastic'),'App Service plan',(type =~ 'microsoft.web/serverfarms') and (kind =~ 'elastic,linux'),'App Service plan',type =~ 'microsoft.web/serverfarms','App Service plan',type)\r\n| extend type = case(type =~ \"microsoft.sql/servers/databases\" or type =~ \"microsoft.sql/managedinstances/databases\",\"microsoft.sql/servers\" , type =~ \"microsoft.web/sites/slots\", \"Microsoft.Web/sites\", type =~ \"microsoft.synapse/workspaces/bigdatapools\", \"Microsoft.Synapse/workspaces\", type =~ \"microsoft.synapse/workspaces/sqlpools\", \"Microsoft.Synapse/workspaces\", type =~ \"microsoft.cdn/profiles/endpoints\", \"microsoft.cdn/profiles\", type)\r\n| extend resourceType = strcat(\"/subscriptions/{parameterSubscription:subscriptionId}/resourceGroups/rg-workbooks/providers/\", type, \"/\", typeDisplayName), Enable = 'Enable'\r\n| summarize by id=tolower(id), resourceType, subscriptionId=subscriptionRId, subscriptionName, resourceGroup, typeDisplayName, Enable\r\n| order by typeDisplayName asc, subscriptionName asc, resourceGroup asc", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{parameterSubscription}" ], "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "id", "comparison": "isEqualTo", "value": "9999" }, "name": "queryResourceInventory" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let storageAccounts = \r\nunion StorageBlobLogs\r\n| extend ResourceId = trim_end(\"/blobservices/default\", _ResourceId)\r\n| summarize by ResourceId, Category\r\n| extend categories = pack(\"Category\", Category)\r\n| summarize Categories=makelist(categories) by ResourceId=tolower(ResourceId);\r\n\r\nlet diagnosticLogs =\r\nAzureDiagnostics\r\n| extend ResourceType = strcat(ResourceProvider, \"/\", ResourceType)\r\n| where ResourceType in~ ({parameterResourceType})\r\n| summarize by ResourceId, Category\r\n| extend categories = pack(\"Category\", Category)\r\n| summarize Categories=makelist(categories) by ResourceId=tolower(ResourceId);\r\n\r\nlet appServiceLogs =\r\nunion AppServiceAppLogs, AppServiceAuditLogs, AppServiceConsoleLogs, AppServiceIPSecAuditLogs, AppServicePlatformLogs, AppServiceHTTPLogs\r\n| summarize by _ResourceId, Category\r\n| extend categories = pack(\"Category\", Category)\r\n| summarize Categories=make_list_if(categories, Category != \"\") by ResourceId = tolower(_ResourceId);\r\n\r\nlet containerRegistryLogs =\r\nunion ContainerRegistryLoginEvents, ContainerRegistryRepositoryEvents\r\n| summarize by _ResourceId, Category\r\n| extend categories = pack(\"Category\", Category)\r\n| summarize Categories=make_list_if(categories, Category != \"\") by ResourceId = tolower(_ResourceId);\r\n\r\nlet bastionLogs =\r\nMicrosoftAzureBastionAuditLogs\r\n| extend Category = \"MicrosoftAzureBastionAuditLogs\"\r\n| extend categories = pack(\"Category\", Category)\r\n| summarize Categories=make_list_if(categories, Category != \"\") by ResourceId = tolower(_ResourceId);\r\n\r\nunion diagnosticLogs, storageAccounts, appServiceLogs, containerRegistryLogs, bastionLogs\r\n", "size": 0, "timeContextFromParameter": "parameterLookback", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{parameterWorkspace}" ], "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "id", "comparison": "isEqualTo", "value": "9999" }, "name": "queryResourceHeartbeats" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"13785d4a-8365-4d10-9e22-ce5d5db4e0b5\",\"mergeType\":\"leftouter\",\"leftTable\":\"queryResourceInventory\",\"rightTable\":\"queryResourceHeartbeats\",\"leftColumn\":\"id\",\"rightColumn\":\"ResourceId\"}],\"projectRename\":[{\"originalName\":\"[queryResourceInventory].subscriptionId\",\"mergedName\":\"subscriptionId\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryResourceInventory].resourceGroup\",\"mergedName\":\"resourceGroup\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryResourceInventory].id\",\"mergedName\":\"Resource\",\"fromId\":\"13785d4a-8365-4d10-9e22-ce5d5db4e0b5\"},{\"originalName\":\"[queryResourceHeartbeats].ResourceId\",\"mergedName\":\"ResourceId\",\"fromId\":\"13785d4a-8365-4d10-9e22-ce5d5db4e0b5\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Reporting to LAW\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"ResourceId\",\"operator\":\"isNotNull\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"🟢Connected\"}},{\"criteriaContext\":{\"leftOperand\":\"ResourceId\",\"operator\":\"is Empty\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"⚪Disconnected\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\"}}]},{\"originalName\":\"[queryResourceInventory].resourceType\",\"mergedName\":\"Resource Type\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryResourceHeartbeats].Categories\",\"mergedName\":\"Categories\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryResourceInventory].subscriptionName\",\"mergedName\":\"subscriptionName\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryResourceInventory].typeDisplayName\",\"mergedName\":\"typeDisplayName\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryResourceHeartbeats].Categories_dynamic\",\"mergedName\":\"Categories_dynamic\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryResourceHeartbeats].Categories_string\",\"mergedName\":\"Categories_string\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryResourceInventory].Enable\",\"mergedName\":\"Enable\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryResourceHeartbeats].ResourceType\"}]}", "size": 3, "title": "Azure PaaS Coverage", "showExportToExcel": true, "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true, "customColumnWidthSetting": "55.2857ch" }, "tooltipFormat": { "tooltip": "If green (\"Connected\"), this means the resource has sent data to at least one of the selected Log Analytics workspaces within the specified lookback period. If gray (\"Disconnected\"), no data was found in any of the selected Log Analytics workspaces within the specified lookback period." } }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "resourceGroup", "formatter": 5 }, { "columnMatch": "Resource", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "linkIsContextBlade": true, "showIcon": true } }, { "columnMatch": "ResourceId", "formatter": 5 }, { "columnMatch": "Reporting to LAW", "formatter": 5 }, { "columnMatch": "Resource Type", "formatter": 5 }, { "columnMatch": "Categories", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "subscriptionName", "formatter": 5 }, { "columnMatch": "typeDisplayName", "formatter": 5 }, { "columnMatch": "Enable", "formatter": 13, "formatOptions": { "linkColumn": "Resource", "linkTarget": "Resource", "subTarget": "Diagnostics", "linkIsContextBlade": true, "showIcon": false } } ], "rowLimit": 10000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Reporting to LAW", "Resource Type", "subscriptionId" ], "expandTopLevel": false, "finalBy": "resourceGroup" }, "labelSettings": [ { "columnId": "subscriptionId", "label": "Subscription" }, { "columnId": "resourceGroup", "label": "Resource Group" } ] } }, "showPin": false, "name": "queryResourceMerge" } ] }, "conditionalVisibility": { "parameterName": "parameterTab", "comparison": "isEqualTo", "value": "paas" }, "name": "groupPaaS" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resourcecontainers\r\n| where type == \"microsoft.resources/subscriptions\"\r\n| project subscriptionId, name\r\n| order by name asc", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{parameterSubscription}" ], "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "id", "comparison": "isEqualTo", "value": "999" }, "name": "querySubscriptions" }, { "type": 1, "content": { "json": "For more information regarding enabling Azure Activity log ingestion into Microsoft Sentinel, please refer to this documentation: https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity", "style": "info" }, "conditionalVisibility": { "parameterName": "Documentation", "comparison": "isEqualTo", "value": "On" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| summarize by SubscriptionId, CategoryValue\r\n| extend categories = pack(\"Category\", CategoryValue)\r\n| summarize Categories=makelist(categories) by SubscriptionId\r\n| project SubscriptionId, Categories, Administrative=case(Categories has \"Administrative\", \"Available\", \"Unavailable\"), Security=case(Categories has \"Security\", \"Available\", \"Unavailable\"), ServiceHealth=case(Categories has \"ServiceHealth\", \"Available\", \"Unavailable\"), ResourceHealth=case(Categories has \"ResourceHealth\", \"Available\", \"Unavailable\"), Policy=case(Categories has \"Policy\", \"Available\", \"Unavailable\")", "size": 0, "timeContextFromParameter": "parameterLookback", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{parameterWorkspace}" ], "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "id", "comparison": "isEqualTo", "value": "999" }, "name": "queryActivity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"6d445024-55dd-46b8-b18e-574d9332f03b\",\"mergeType\":\"leftouter\",\"leftTable\":\"querySubscriptions\",\"rightTable\":\"queryActivity\",\"leftColumn\":\"subscriptionId\",\"rightColumn\":\"SubscriptionId\"}],\"projectRename\":[{\"originalName\":\"[querySubscriptions].subscriptionId\",\"mergedName\":\"Subscription\",\"fromId\":\"6d445024-55dd-46b8-b18e-574d9332f03b\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"LAW Connection Status\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"SubscriptionId\",\"operator\":\"isNotNull\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"🟢Connected\"}},{\"criteriaContext\":{\"leftOperand\":\"SubscriptionId\",\"operator\":\"is Empty\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"⚪Disconnected\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\"}}]},{\"originalName\":\"[queryActivity].SubscriptionId\",\"mergedName\":\"SubscriptionId\",\"fromId\":\"6d445024-55dd-46b8-b18e-574d9332f03b\"},{\"originalName\":\"[queryActivity].Administrative\",\"mergedName\":\"Administrative\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryActivity].Security\",\"mergedName\":\"Security\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryActivity].ServiceHealth\",\"mergedName\":\"ServiceHealth\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryActivity].ResourceHealth\",\"mergedName\":\"ResourceHealth\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryActivity].Policy\",\"mergedName\":\"Policy\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryActivity].Categories\",\"mergedName\":\"Categories\",\"fromId\":\"unknown\"},{\"originalName\":\"[querySubscriptions].name\"}]}", "size": 3, "title": "Activity Log Coverage", "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "tooltipFormat": { "tooltip": "If green (\"Connected\"), this means the resource has sent data to at least one of the selected Log Analytics workspaces within the specified lookback period. If gray (\"Disconnected\"), no data was found in any of the selected Log Analytics workspaces within the specified lookback period." } }, { "columnMatch": "Subscription", "formatter": 5 }, { "columnMatch": "LAW Connection Status", "formatter": 5 }, { "columnMatch": "SubscriptionId", "formatter": 5 }, { "columnMatch": "Administrative", "formatter": 11 }, { "columnMatch": "Security", "formatter": 11 }, { "columnMatch": "ServiceHealth", "formatter": 11 }, { "columnMatch": "ResourceHealth", "formatter": 11 }, { "columnMatch": "Policy", "formatter": 11 }, { "columnMatch": "Categories", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "", "linkIsContextBlade": true } }, { "columnMatch": "subscriptionId", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true } } ], "hierarchySettings": { "treeType": 1, "groupBy": [ "LAW Connection Status" ], "finalBy": "Subscription" } } }, "name": "queryMergeActivity" }, { "type": 1, "content": { "json": "Use the below button to open the Sentinel Azure Activity Connector to conifgure Azure Activity log collection. The button will only work if a single subscription is selected in the \"Subscription\" dropdown parameter at the top of the workbook.", "style": "info" }, "conditionalVisibility": { "parameterName": "Documentation", "comparison": "isEqualTo", "value": "On" }, "name": "text - 5" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "9b233d0b-2ec6-46db-ad8c-6667231ab27b", "linkTarget": "OpenBlade", "linkLabel": "Open Azure Activity Connector", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeJsonParameters": "{\r\n\t\"connectorMethod\": \"undefined\",\r\n \"dataConnectorId\": \"AzureActivity\",\r\n \"initialConnectorTab\": 0,\r\n \"subscriptionId\": \"{parameterSubscription:subscriptionId}\",\r\n \"resourceGroup\": \"{parameterWorkspace:resourceGroup}\",\r\n \"workspaceName\": \"{parameterWorkspace:name}\",\r\n\t\t\"workspaceArmId\": \"/subscriptions/{parameterSubscription:subscriptionId}/resourceGroups/{parameterWorkspace:resourceGroup}/providers/microsoft.operationalinsights/workspaces/{parameterWorkspace:name}\"\r\n}" } } ] }, "name": "links - 9" } ] }, "conditionalVisibility": { "parameterName": "parameterTab", "comparison": "isEqualTo", "value": "activity" }, "name": "groupActivity" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "For more information regarding enabling Microsoft Entra ID log ingestion into Microsoft Sentinel, please refer to this documentation: https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity", "style": "info" }, "conditionalVisibility": { "parameterName": "Documentation", "comparison": "isEqualTo", "value": "On" }, "name": "text - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ReferenceTables = datatable (TableName:string)[\r\n\"AuditLogs\", \"SigninLogs\", \"AADProvisioningLogs\", \"AADNonInteractiveUserSignInLogs\", \"AADServicePrincipalSignInLogs\", \"AADManagedIdentitySignInLogs\"\r\n\"AADProvisioningLogs\", \"ADFSSignInLogs\", \"AADRiskyUsers\", \"AADUserRiskEvents\", \"AADRiskyServicePrincipals\", \"AADServicePrincipalRiskEvents\"\r\n];\r\n\r\nlet AuditLogs = AuditLogs | summarize by TenantId = tostring(split(ResourceId, \"/\")[2]), Source = \"AuditLogs\";\r\nlet SigninLogs = SigninLogs | summarize by TenantId = tostring(split(ResourceId, \"/\")[2]), Source = \"SigninLogs\";\r\nlet AADProvisioningLogs = AADProvisioningLogs | summarize by TenantId = AADTenantId, Source = \"AADProvisioningLogs\";\r\nlet AADTables = union withsource=SourceTable isfuzzy=true AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs, AADManagedIdentitySignInLogs, ADFSSignInLogs, AADRiskyUsers, AADUserRiskEvents, AADRiskyServicePrincipals, AADServicePrincipalRiskEvents | summarize by Source = SourceTable, TenantId = \"\";\r\n\r\nReferenceTables\r\n| join kind=leftouter (\r\nunion AuditLogs, SigninLogs, AADProvisioningLogs, AADTables\r\n) on $left.TableName == $right.Source\r\n| project TableName, LAWConnected=case(Source != \"\", \"🟢Connected\", \"⚪Disconnected\"), TenantId = case(TenantId != \"\", TenantId, \"Undetermined (Tenant ID not logged for all tables.)\")\r\n| order by TenantId asc, LAWConnected desc", "size": 3, "title": "Azure AD Logs", "timeContextFromParameter": "parameterLookback", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{parameterWorkspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "LAWConnected", "formatter": 0, "tooltipFormat": { "tooltip": "If green (\"Connected\"), this means the resource has sent data to at least one of the selected Log Analytics workspaces within the specified lookback period. If gray (\"Disconnected\"), no data was found in any of the selected Log Analytics workspaces within the specified lookback period." } }, { "columnMatch": "TenantId", "formatter": 5 } ], "hierarchySettings": { "treeType": 1, "groupBy": [ "TenantId" ], "expandTopLevel": true }, "labelSettings": [ { "columnId": "TableName", "label": "Data Source" }, { "columnId": "LAWConnected", "label": "LAW Connection Status" }, { "columnId": "TenantId", "label": "Azure AD Tenant ID" } ] } }, "name": "queryAADLogs" }, { "type": 1, "content": { "json": "Use the below button to open the Sentinel Azure AD Connector to enable the Azure AD log collection. The button will only work if a single subscription is selected in the \"Subscription\" dropdown parameter at the top of the workbook.", "style": "info" }, "conditionalVisibility": { "parameterName": "Documentation", "comparison": "isEqualTo", "value": "On" }, "name": "text - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "9b233d0b-2ec6-46db-ad8c-6667231ab27b", "linkTarget": "OpenBlade", "linkLabel": "Open Entra ID Connector", "style": "primary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeJsonParameters": "{\r\n\t\"connectorMethod\": \"undefined\",\r\n \"dataConnectorId\": \"AzureActiveDirectory\",\r\n \"initialConnectorTab\": 0,\r\n \"subscriptionId\": \"{parameterSubscription:subscriptionId}\",\r\n \"resourceGroup\": \"{parameterWorkspace:resourceGroup}\",\r\n \"workspaceName\": \"{parameterWorkspace:name}\",\r\n\t\t\"workspaceArmId\": \"/subscriptions/{parameterSubscription:subscriptionId}/resourceGroups/{parameterWorkspace:resourceGroup}/providers/microsoft.operationalinsights/workspaces/{parameterWorkspace:name}\"\r\n}" } } ] }, "name": "links - 9" } ] }, "conditionalVisibility": { "parameterName": "parameterTab", "comparison": "isEqualTo", "value": "aadlogs" }, "name": "groupAADLogs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type contains \"microsoft.operationalinsights/workspaces\"\r\n| extend resourceGroup=strcat(\"/subscriptions/\", subscriptionId, \"/resourceGroups/\", resourceGroup)\r\n| extend \r\n id = tolower(id),\r\n sku = tostring(properties.sku.name),\r\n dataIngestionStatus = tostring(properties.workspaceCapping.dataIngestionStatus),\r\n dailyQuotaGb = tostring(properties.workspaceCapping.dailyQuotaGb),\r\n retentionInDays = tostring(properties.retentionInDays),\r\n Enable =id\r\n| join kind=leftouter (\r\n resources\r\n | where type == \"microsoft.operationsmanagement/solutions\"\r\n | extend solutionName = tostring(plan.product)\r\n | where solutionName == \"OMSGallery/SecurityInsights\"\r\n | extend wsRId = tolower(tostring(properties.workspaceResourceId))\r\n ) on $left.id == $right.wsRId\r\n| summarize by id=tolower(id), resourceType=tolower(type), subscriptionId, resourceGroup, wsId = tostring(properties.customerId), sentinelEnabled=case(solutionName == \"OMSGallery/SecurityInsights\", \"yes\", \"no\"), sku, dataIngestionStatus, dailyQuotaGb=case(dailyQuotaGb == \"-1.0\", \"No Quota\", dailyQuotaGb), retentionInDays, Enable\r\n| order by subscriptionId asc", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{parameterSubscription}" ], "gridSettings": { "sortBy": [ { "itemKey": "wsId", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "wsId", "sortOrder": 1 } ] }, "conditionalVisibility": { "parameterName": "id", "comparison": "isEqualTo", "value": "999" }, "name": "queryLAWInventory" }, { "type": 1, "content": { "json": "For more information regarding enabling Log Analytics audit log ingestion into Microsoft Sentinel, please refer to this documentation: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/query-audit", "style": "info" }, "conditionalVisibility": { "parameterName": "Documentation", "comparison": "isEqualTo", "value": "On" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "LAQueryLogs\r\n| summarize by TenantId", "size": 0, "timeContextFromParameter": "parameterLookback", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{parameterWorkspace}" ] }, "conditionalVisibility": { "parameterName": "id", "comparison": "isEqualTo", "value": "999" }, "name": "queryLAWLogs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"d223380c-df1d-4601-9c3d-6041f709311a\",\"mergeType\":\"leftouter\",\"leftTable\":\"queryLAWInventory\",\"rightTable\":\"queryLAWLogs\",\"leftColumn\":\"wsId\",\"rightColumn\":\"TenantId\"}],\"projectRename\":[{\"originalName\":\"[queryLAWInventory].subscriptionId\",\"mergedName\":\"subscriptionId\",\"fromId\":\"d223380c-df1d-4601-9c3d-6041f709311a\"},{\"originalName\":\"[queryLAWInventory].resourceGroup\",\"mergedName\":\"resourceGroup\",\"fromId\":\"d223380c-df1d-4601-9c3d-6041f709311a\"},{\"originalName\":\"[queryLAWInventory].id\",\"mergedName\":\"id\",\"fromId\":\"d223380c-df1d-4601-9c3d-6041f709311a\"},{\"originalName\":\"[queryLAWInventory].resourceType\",\"mergedName\":\"resourceType\",\"fromId\":\"d223380c-df1d-4601-9c3d-6041f709311a\"},{\"originalName\":\"[queryLAWInventory].wsId\",\"mergedName\":\"wsId\",\"fromId\":\"d223380c-df1d-4601-9c3d-6041f709311a\"},{\"originalName\":\"[queryLAWLogs].TenantId\",\"mergedName\":\"TenantId\",\"fromId\":\"d223380c-df1d-4601-9c3d-6041f709311a\"},{\"originalName\":\"[queryLAWLogs].Type\",\"mergedName\":\"Type\",\"fromId\":\"d223380c-df1d-4601-9c3d-6041f709311a\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"LAW Connection Status\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"TenantId\",\"operator\":\"isNotNull\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"🟢Connected\"}},{\"criteriaContext\":{\"leftOperand\":\"TenantId\",\"operator\":\"is Empty\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"⚪Disconnected\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\"}}]},{\"originalName\":\"[queryLAWInventory].sentinelEnabled\",\"mergedName\":\"sentinelEnabled\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryLAWInventory].sku\",\"mergedName\":\"sku\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryLAWInventory].dataIngestionStatus\",\"mergedName\":\"dataIngestionStatus\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryLAWInventory].dailyQuotaGb\",\"mergedName\":\"dailyQuotaGb\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryLAWInventory].retentionInDays\",\"mergedName\":\"retentionInDays\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryLAWInventory].Enable\",\"mergedName\":\"Enable\",\"fromId\":\"unknown\"}]}", "size": 3, "title": "Log Analytics Query Audit Logs", "exportFieldName": "id", "exportParameterName": "id", "queryType": 7, "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true }, "tooltipFormat": { "tooltip": "If green (\"Connected\"), this means the resource has sent data to at least one of the selected Log Analytics workspaces within the specified lookback period. If gray (\"Disconnected\"), no data was found in any of the selected Log Analytics workspaces within the specified lookback period." } }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "resourceGroup", "formatter": 14, "formatOptions": { "linkTarget": "Resource", "linkIsContextBlade": true, "showIcon": true } }, { "columnMatch": "id", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "linkIsContextBlade": false, "showIcon": true, "bladeOpenContext": { "bladeParameters": [] } } }, { "columnMatch": "resourceType", "formatter": 5 }, { "columnMatch": "wsId", "formatter": 5 }, { "columnMatch": "TenantId", "formatter": 5 }, { "columnMatch": "sentinelEnabled", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "yes", "representation": "success", "text": "" }, { "operator": "==", "thresholdValue": "no", "representation": "more", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "LAW Connection Status", "formatter": 5 }, { "columnMatch": "Enable", "formatter": 7, "formatOptions": { "linkTarget": "Resource", "subTarget": "Diagnostics", "linkLabel": "Open Audit Log Settings", "linkIsContextBlade": true, "bladeOpenContext": { "bladeName": "DiagnosticsLogsBlade", "extensionName": "Microsoft_Azure_Monitoring", "bladeJsonParameters": "{\r\n \"id\": \"{id}\"\r\n}\r\n" } } } ], "hierarchySettings": { "treeType": 1, "groupBy": [ "LAW Connection Status" ], "finalBy": "subscriptionId" }, "labelSettings": [ { "columnId": "subscriptionId", "label": "Subscription" }, { "columnId": "resourceGroup", "label": "Resource Group" }, { "columnId": "id", "label": "Resource" }, { "columnId": "sentinelEnabled", "label": "Sentinel Enabled" }, { "columnId": "sku", "label": "Sku" }, { "columnId": "dataIngestionStatus", "label": "Data Ingestion Status" }, { "columnId": "dailyQuotaGb", "label": "Daily Quota in GB/day" }, { "columnId": "retentionInDays", "label": "Retention in Days" } ] } }, "name": "queryLAWMerge" } ] }, "conditionalVisibility": { "parameterName": "parameterTab", "comparison": "isEqualTo", "value": "law" }, "name": "groupLAW" } ], "fromTemplateId": "sentinel-AzureLogCoverage", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }