{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a36f0b3d-8826-4bec-95a9-70ec6cb77713", "version": "KqlParameterItem/1.0", "name": "Subscriptions", "type": 6, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "value": ["value::all"], "typeSettings": { "additionalResourceOptions": ["value::1", "value::all"], "includeAll": true } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 8" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "f321b3dd-4d96-4aa7-ac57-5ad8ce236a48", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "overview", "style": "link" }, { "id": "e79a9ba1-8aca-4e4a-9df7-83123cae1627", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Compute", "subTarget": "compute", "preText": "IaaS", "style": "link" }, { "id": "ed3b708b-7054-424d-b32b-49451e04d36b", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "PaaS", "subTarget": "paas", "style": "link" }, { "id": "9bd4447c-8cac-4e8a-9f9b-bbcc99209b13", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Networking", "subTarget": "network", "style": "link" }, { "id": "8192cd42-be72-4d18-b234-9e9fef4418dd", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Monitoring & Security", "subTarget": "monitor", "style": "link" }, { "id": "1c2b6655-5c72-47bf-b4c6-9ea2665c07ef", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Tagged Resources", "subTarget": "tags", "style": "link" }, { "id": "284d9e1f-d3f9-477e-8fac-0fad54c0b392", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Untagged Resources", "subTarget": "notag", "style": "link" }, { "id": "2e1e79f6-b401-45eb-bcb7-cca355e738a0", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "Cost", "subTarget": "cost", "style": "link" } ] }, "name": "links - 6", "styleSettings": { "padding": "0 0 20px 0" } }, { "type": 1, "content": { "json": "## NoShow - Begin Overview" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow Overview" }, { "type": 1, "content": { "json": "# Overview Azure Resources" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "overview" }, "name": "text - Title" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources | summarize count(type)", "size": 4, "title": "Count of All Resources", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "tiles", "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "count_type", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": true, "sortOrderField": 2, "size": "auto" }, "textSettings": { "style": "bignumber" } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "overview" }, "name": "query - Overview Count" }, { "type": 1, "content": { "json": "## Subscriptions and Resource Groups" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "overview" }, "name": "text - Subscriptions text" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resourcecontainers \r\n| where type has \"microsoft.resources/subscriptions/resourcegroups\"\r\n| summarize Count=count(type) by type, subscriptionId | extend type = replace(@\"microsoft.resources/subscriptions/resourcegroups\", @\"Resource Groups\", type)", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "type", "formatter": 16, "formatOptions": { "showIcon": true } }, { "columnMatch": "subscriptionId", "formatter": 5 } ], "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true } }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "overview" }, "name": "query - Subscription Overview" }, { "type": 1, "content": { "json": "## Resource Counts" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "overview" }, "name": "text - Overview Resource text" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources \r\n| where type != 'microsoft.compute/disks' \r\n| where type != 'microsoft.compute/virtualmachines/extensions'\r\n| where type !has 'microsoft.insights'\r\n| where type != 'microsoft.operationsmanagement/solutions'\r\n| where type != 'microsoft.compute/images'\r\n| where type != 'microsoft.netapp/netappaccounts/capacitypools/volumes'\r\n| extend type = case(\r\ntype =~ 'microsoft.automation/automationaccounts', 'Automation Accounts',\r\ntype =~ 'microsoft.operationalinsights/workspaces', 'Log Analytics Workspaces',\r\ntype =~ 'microsoft.netapp/netappaccounts', 'NetApp Accounts',\r\ntype == 'microsoft.web/serverfarms', \"App Service Plans\",\r\ntype == 'microsoft.web/sites', \"App Services\",\r\ntype =~ \"microsoft.compute/virtualmachines\", \"Azure Compute\",\r\ntype =~ \"microsoft.logic/workflows\", \"LogicApps\",\r\ntype =~ 'microsoft.keyvault/vaults', \"Key Vaults\",\r\ntype =~ 'microsoft.storage/storageaccounts', \"Storage Accounts\",\r\ntype =~ 'microsoft.compute/availabilitysets', 'Availability Sets',\r\ntype =~ 'microsoft.insights/components','Application Insights',\r\ntype =~ 'microsoft.desktopvirtualization/applicationgroups', 'WVD Application Groups',\r\ntype =~ 'microsoft.desktopvirtualization/workspaces', 'WVD Workspaces',\r\ntype =~ 'microsoft.desktopvirtualization/hostpools', 'WVD Hostpools',\r\ntype =~ 'microsoft.recoveryservices/vaults', 'Backup Vaults',\r\ntype =~ 'microsoft.insights/webtests', 'URL Web Tests',\r\ntype =~ 'microsoft.web/connections', 'LogicApp Connectors',\r\ntype =~ 'microsoft.web/customapis','LogicApp API Connectors',\r\ntype =~ 'microsoft.managedidentity/userassignedidentities','User Managed Identities',\r\ntype =~ 'microsoft.storagesync/storagesyncservices', 'Azure File Sync',\r\ntype =~ 'microsoft.hybridcompute/machines', 'ARC Machines',\r\ntype =~ 'microsoft.eventhub/namespaces', 'Event Hub Namespaces',\r\ntype =~ 'microsoft.serviceBus/namespaces', 'Service Bus Namespaces',\r\ntype =~ 'microsoft.apimanagement/service', 'API Management',\r\ntype =~ 'microsoft.documentdb/databaseaccounts', 'Cosmos DB',\r\ntype =~ 'Microsoft.Network/publicIPAddresses', 'Public IPs',\r\ntype =~ 'Microsoft.Network/loadBalancers', 'Load Balancers',\r\ntype =~ 'Microsoft.ContainerService/ManagedClusters', 'AKS',\r\ntype =~ 'Microsoft.Sql/servers/databases', 'SQL Databases',\r\ntype =~ 'Microsoft.Sql/servers', 'SQL Servers',\r\ntype =~ 'Microsoft.DBforPostgreSQL/servers', 'PostgreSQL Servers',\r\ntype =~ 'microsoft.dbforpostgresql/flexibleservers', 'PostgreSQL Flexi Servers',\r\ntype =~ 'Microsoft.Network/dnszones', 'Azure DNS Zones',\r\ntype =~ 'Microsoft.Network/applicationGateways', 'Application Gateways',\r\ntype =~ 'Microsoft.Network/privateDnsZones', 'Private DNS Zones',\r\ntype =~ 'Microsoft.Cache/Redis', 'Azure Cache for Redis',\r\ntype =~ 'Microsoft.DBforMariaDB/servers', 'MariaDB Servers',\r\ntype =~ 'Microsoft.DBforMySQL/servers', 'MySQL Servers',\r\ntype =~ 'microsoft.network/virtualnetworkgateways', 'Virtual Network Gateways',\r\ntype =~ 'microsoft.network/expressroutecircuits', 'Express Routes',\r\ntype =~ 'microsoft.maps/accounts', 'Azure Maps',\r\ntype =~ 'microsoft.network/virtualnetworks', 'Virtual Networks',\r\ntype has 'microsoft.network', 'Network Resources',\r\nstrcat(\"Not Translated: \", type))\r\n| summarize count() by type\r\n| where type !has \"Not Translated\"", "size": 2, "title": "Resource Count by Type", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true, "sortCriteriaField": "count_", "sortOrderField": 2 } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "overview" }, "name": "query - Overview Resource Counts by type" }, { "type": 1, "content": { "json": "## NoShow - End Overview\r\n\r\n\r\n## NoShow - Begin Compute" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow Begin Compute" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "a5b84469-ab4c-4b30-9983-22c454d61468", "cellValue": "compute", "linkTarget": "parameter", "linkLabel": "Azure Compute", "subTarget": "azure", "style": "link" }, { "id": "d44b3ab8-d86b-4c5c-939f-273554437a4e", "cellValue": "compute", "linkTarget": "parameter", "linkLabel": "Hybrid Compute", "subTarget": "arc", "style": "link" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "compute" }, "name": "tabs - Compute" }, { "type": 1, "content": { "json": "## Current VM Status" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "compute" }, { "parameterName": "compute", "comparison": "isEqualTo", "value": "azure" } ], "name": "text - Azure Compute" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources | where type == \"microsoft.compute/virtualmachines\"\r\n| extend vmState = tostring(properties.extended.instanceView.powerState.displayStatus)\r\n| extend vmState = iif(isempty(vmState), \"VM State Unknown\", (vmState))\r\n| summarize count() by vmState", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "vmState", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "vmSize", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "compute" }, { "parameterName": "compute", "comparison": "isEqualTo", "value": "azure" } ], "name": "query - Azure Compute Summary - Copy" }, { "type": 1, "content": { "json": "## Count of VMs by VM Size." }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "compute" }, { "parameterName": "compute", "comparison": "isEqualTo", "value": "azure" } ], "name": "text - Azure Compute - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources | where type == \"microsoft.compute/virtualmachines\"\r\n| summarize Count=count(properties.hardwareProfile.vmSize) by vmSize=tostring(properties.hardwareProfile.vmSize)", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "vmSize", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "vmSize", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "compute" }, { "parameterName": "compute", "comparison": "isEqualTo", "value": "azure" } ], "name": "query - Azure Compute Summary" }, { "type": 1, "content": { "json": "## VMs by Storage and Networking\r\n\r\nšŸ’” Select tab to see corresponding breakdown" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "compute" }, { "parameterName": "compute", "comparison": "isEqualTo", "value": "azure" } ], "name": "text - Azure Compute - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "ac392a07-01a6-4727-b82b-117c529867c7", "cellValue": "hardware", "linkTarget": "parameter", "linkLabel": "Networking", "subTarget": "network", "style": "link" }, { "id": "9ba284c0-ba39-460c-9f74-b9ae8845245c", "cellValue": "hardware", "linkTarget": "parameter", "linkLabel": "Storage", "subTarget": "storage", "style": "link" }, { "id": "74bab549-0028-4018-8bf3-065b6c6fa28e", "cellValue": "hardware", "linkTarget": "parameter", "linkLabel": "Orphaned Disks", "subTarget": "orphaneddisks", "style": "link" }, { "id": "a45a3005-c5b6-46a7-8873-ac1e471c51b4", "cellValue": "hardware", "linkTarget": "parameter", "linkLabel": "Orphaned NICs", "subTarget": "orphanednics", "style": "link" } ] }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "compute" }, { "parameterName": "compute", "comparison": "isEqualTo", "value": "azure" } ], "name": "links - Azure Compute Storage Networking Breakdown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources\r\n| where type =~ 'microsoft.compute/virtualmachines'\r\n| extend nics=array_length(properties.networkProfile.networkInterfaces)\r\n| mv-expand nic=properties.networkProfile.networkInterfaces\r\n| where nics == 1 or nic.properties.primary =~ 'true' or isempty(nic)\r\n| project vmId = id, vmName = name, vmSize=tostring(properties.hardwareProfile.vmSize), nicId = tostring(nic.id)\r\n\t| join kind=leftouter (\r\n \t\tResources\r\n \t\t| where type =~ 'microsoft.network/networkinterfaces'\r\n \t\t| extend ipConfigsCount=array_length(properties.ipConfigurations)\r\n \t\t| mv-expand ipconfig=properties.ipConfigurations\r\n \t\t| where ipConfigsCount == 1 or ipconfig.properties.primary =~ 'true'\r\n \t\t| project nicId = id, privateIP= tostring(ipconfig.properties.privateIPAddress), publicIpId = tostring(ipconfig.properties.publicIPAddress.id), subscriptionId) on nicId\r\n| project-away nicId1\r\n| summarize by vmId, vmSize, nicId, privateIP, publicIpId, subscriptionId\r\n\t| join kind=leftouter (\r\n \t\tResources\r\n \t\t| where type =~ 'microsoft.network/publicipaddresses'\r\n \t\t| project publicIpId = id, publicIpAddress = tostring(properties.ipAddress)) on publicIpId\r\n| project-away publicIpId1\r\n| sort by publicIpAddress desc", "size": 2, "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "vmId", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "vmId" } }, "tileSettings": { "titleContent": { "columnMatch": "vmSize", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "vmSize", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "compute" }, { "parameterName": "compute", "comparison": "isEqualTo", "value": "azure" }, { "parameterName": "hardware", "comparison": "isEqualTo", "value": "network" } ], "name": "query - Azure Compute Networking", "styleSettings": { "padding": "0 0 200px 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources | where type == \"microsoft.compute/virtualmachines\"\r\n| extend osDiskId= tostring(properties.storageProfile.osDisk.managedDisk.id)\r\n | join kind=leftouter(resources\r\n | where type =~ 'microsoft.compute/disks'\r\n | where properties !has 'Unattached'\r\n | where properties has 'osType'\r\n | project OS = tostring(properties.osType), osSku = tostring(sku.name), osDiskSizeGB = toint(properties.diskSizeGB), osDiskId=tostring(id)) on osDiskId\r\n | join kind=leftouter(Resources\r\n | where type =~ 'microsoft.compute/disks'\r\n | where properties !has \"osType\"\r\n | where properties !has 'Unattached'\r\n | project sku = tostring(sku.name), diskSizeGB = toint(properties.diskSizeGB), id = managedBy\r\n | summarize sum(diskSizeGB), count(sku) by id, sku) on id\r\n| project vmId=id, OS, location, resourceGroup, subscriptionId, osDiskId, osSku, osDiskSizeGB, DataDisksGB=sum_diskSizeGB, diskSkuCount=count_sku\r\n| sort by diskSkuCount desc", "size": 2, "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "vmId", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "vmId" } }, "tileSettings": { "titleContent": { "columnMatch": "vmSize", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "vmSize", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "compute" }, { "parameterName": "compute", "comparison": "isEqualTo", "value": "azure" }, { "parameterName": "hardware", "comparison": "isEqualTo", "value": "storage" } ], "name": "query - Azure Compute Disks", "styleSettings": { "padding": "0 0 200px 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources \r\n| where type contains \"microsoft.compute/disks\" \r\n| extend diskState = tostring(properties.diskState)\r\n| where managedBy == \"\"\r\n or diskState == 'Unattached'\r\n| project id, diskState, resourceGroup, location, subscriptionId", "size": 2, "noDataMessage": "No oprhaned disks found", "noDataMessageStyle": 3, "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "id", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "id" } }, "tileSettings": { "titleContent": { "columnMatch": "vmSize", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "vmSize", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "compute" }, { "parameterName": "compute", "comparison": "isEqualTo", "value": "azure" }, { "parameterName": "hardware", "comparison": "isEqualTo", "value": "orphaneddisks" } ], "name": "query - Azure Compute - Orphaned Disks", "styleSettings": { "padding": "0 0 200px 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type contains \"microsoft.network/networkinterfaces\"\r\n| where properties !has 'virtualmachine'\r\n| project id, resourceGroup, location, subscriptionId", "size": 2, "noDataMessage": "No orphaned nics found", "noDataMessageStyle": 3, "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "id", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "id" } }, "tileSettings": { "titleContent": { "columnMatch": "vmSize", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "vmSize", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "compute" }, { "parameterName": "compute", "comparison": "isEqualTo", "value": "azure" }, { "parameterName": "hardware", "comparison": "isEqualTo", "value": "orphanednics" } ], "name": "query - Azure Compute Orphaned NICs", "styleSettings": { "padding": "0 0 200px 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "where type == \"microsoft.hybridcompute/machines\"\r\n| project id, status = properties.status, \r\n\t\t\t LastSeen = properties.lastStatusChange, \r\n\t\t\t FQDN = properties.machineFqdn, \r\n\t\t\t OS = properties.osName, \r\n\t\t\t ServerVersion = properties.osVersion\r\n| extend ServerVersion = iif(OS has \"windows\", ServerVersion = case(\r\n ServerVersion has '10.0.17763', 'Server 2019',\r\n ServerVersion has '10.0.16299', 'Server 2016',\r\n ServerVersion has '10.0.14393', 'Server 2016',\r\n ServerVersion has '6.3.9600', 'Server 2012 R2',\r\n strcat(\"Version not found\", ServerVersion)), 'OS Not Windows')", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "table", "tileSettings": { "titleContent": { "columnMatch": "vmSize", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "vmSize", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "compute" }, { "parameterName": "compute", "comparison": "isEqualTo", "value": "arc" } ], "name": "query - ARC Machines Inventory" }, { "type": 1, "content": { "json": "## NoShow - End Compute\r\n\r\n## NoShow - Begin PaaS" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow Beging Networking" }, { "type": 1, "content": { "json": "## PaaS Resources\r\n\r\nšŸ’” Select tab to view releated resources for PaaS Services\r\n\r\n\r\n" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, "name": "text - PaaS Text", "styleSettings": { "padding": "0 0 15px 0" } }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "a4ee3213-3bfc-4333-b798-934e866c48de", "cellValue": "paas", "linkTarget": "parameter", "linkLabel": "Automation", "subTarget": "automation", "style": "link" }, { "id": "c5ba791c-2cc3-4c32-8b5c-eab75cc0354c", "cellValue": "paas", "linkTarget": "parameter", "linkLabel": "App Services", "subTarget": "apps", "style": "link" }, { "id": "8d82d272-3094-4750-a058-9122b11ae50b", "cellValue": "paas", "linkTarget": "parameter", "linkLabel": "Events", "subTarget": "events", "style": "link" }, { "id": "ed78617d-664d-4727-87c6-91ac79010e2d", "cellValue": "paas", "linkTarget": "parameter", "linkLabel": "Data", "subTarget": "data", "style": "link" }, { "id": "a4e4ea2e-4c32-4143-92bd-27473db8bc81", "cellValue": "paas", "linkTarget": "parameter", "linkLabel": "Storage and Backup", "subTarget": "storage", "style": "link" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, "name": "links - PaaS Tabs", "styleSettings": { "padding": "0 0 15px 0" } }, { "type": 1, "content": { "json": "### Count of all Resource Types\r\n\r\n\r\n\r\n" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, "name": "text - PaaS Text - Overview", "styleSettings": { "padding": "0 0 10px 0" } }, { "type": 1, "content": { "json": "### NoShow - Begin PaaS - Automation" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow Begin Automation" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type has 'microsoft.automation'\r\n\tor type has 'microsoft.logic'\r\n\tor type has 'microsoft.web/customapis'\r\n| extend type = case(\r\n\ttype =~ 'microsoft.automation/automationaccounts', 'Automation Accounts',\r\n\ttype == 'microsoft.web/serverfarms', \"App Service Plans\",\r\n\tkind == 'functionapp', \"Azure Functions\", \r\n\tkind == \"api\", \"API Apps\", \r\n\ttype == 'microsoft.web/sites', \"App Services\",\r\n\ttype =~ 'microsoft.web/connections', 'LogicApp Connectors',\r\n\ttype =~ 'microsoft.web/customapis','LogicApp API Connectors',\r\n\ttype =~ 'microsoft.logic/workflows','LogicApps',\r\n\ttype =~ 'microsoft.automation/automationaccounts/runbooks', 'Automation Runbooks',\r\n type =~ 'microsoft.automation/automationaccounts/configurations', 'Automation Configurations',\r\nstrcat(\"Not Translated: \", type))\r\n| summarize count() by type\r\n| where type !has \"Not Translated\"", "size": 1, "noDataMessage": "No resources found", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true, "sortCriteriaField": "type", "sortOrderField": 1 } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "automation" } ], "name": "query - PaaS - Automation Overview" }, { "type": 1, "content": { "json": "### Detailed View\r\n\r\nšŸ’” select 'View Details' to see full return from Azure Resource Graph" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "automation" } ], "name": "text - PaaS Text - Automation - Details " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type has 'microsoft.automation'\r\n\t or type has 'microsoft.logic'\r\n\t or type has 'microsoft.web/customapis'\r\n| extend type = case(\r\n\ttype =~ 'microsoft.automation/automationaccounts', 'Automation Accounts',\r\n\ttype =~ 'microsoft.web/connections', 'LogicApp Connectors',\r\n\ttype =~ 'microsoft.web/customapis','LogicApp API Connectors',\r\n\ttype =~ 'microsoft.logic/workflows','LogicApps',\r\n\ttype =~ 'microsoft.automation/automationaccounts/runbooks', 'Automation Runbooks',\r\n\ttype =~ 'microsoft.automation/automationaccounts/configurations', 'Automation Configurations',\r\n\tstrcat(\"Not Translated: \", type))\r\n| extend RunbookType = tostring(properties.runbookType)\r\n| extend LogicAppTrigger = properties.definition.triggers\r\n| extend LogicAppTrigger = iif(type =~ 'LogicApps', case(\r\n\tLogicAppTrigger has 'manual', tostring(LogicAppTrigger.manual.type),\r\n\tLogicAppTrigger has 'Recurrence', tostring(LogicAppTrigger.Recurrence.type),\r\n\tstrcat(\"Unknown Trigger type\", LogicAppTrigger)), LogicAppTrigger)\r\n| extend State = case(\r\n\ttype =~ 'Automation Runbooks', properties.state, \r\n\ttype =~ 'LogicApps', properties.state,\r\n\ttype =~ 'Automation Accounts', properties.state,\r\n\ttype =~ 'Automation Configurations', properties.state,\r\n\t' ')\r\n| extend CreatedDate = case(\r\n\ttype =~ 'Automation Runbooks', properties.creationTime, \r\n\ttype =~ 'LogicApps', properties.createdTime,\r\n\ttype =~ 'Automation Accounts', properties.creationTime,\r\n\ttype =~ 'Automation Configurations', properties.creationTime,\r\n\t' ')\r\n| extend LastModified = case(\r\n\ttype =~ 'Automation Runbooks', properties.lastModifiedTime, \r\n\ttype =~ 'LogicApps', properties.changedTime,\r\n\ttype =~ 'Automation Accounts', properties.lastModifiedTime,\r\n\ttype =~ 'Automation Configurations', properties.lastModifiedTime,\r\n\t' ')\r\n| extend Details = pack_all()\r\n| project Resource=id, subscriptionId, type, resourceGroup, RunbookType, LogicAppTrigger, State, Details", "size": 2, "noDataMessage": "No resources found", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "Resource", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "šŸ” View Details", "linkIsContextBlade": true } } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Resource" } }, "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true, "sortCriteriaField": "type", "sortOrderField": 1 } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "automation" } ], "name": "query - PaaS - Automation Detailed", "styleSettings": { "padding": "0 0 200px 0" } }, { "type": 1, "content": { "json": "### NoShow - End PaaS - Automation" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow End - PaaS - Automation" }, { "type": 1, "content": { "json": "### NoShow - Begin PaaS - Apps" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow Begin Automation" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type has 'microsoft.web'\r\n\t or type =~ 'microsoft.apimanagement/service'\r\n\t or type =~ 'microsoft.network/frontdoors'\r\n\t or type =~ 'microsoft.network/applicationgateways'\r\n\t or type =~ 'microsoft.appconfiguration/configurationstores'\r\n| extend type = case(\r\n\ttype == 'microsoft.web/serverfarms', \"App Service Plans\",\r\n\tkind == 'functionapp', \"Azure Functions\", \r\n\tkind == \"api\", \"API Apps\", \r\n\ttype == 'microsoft.web/sites', \"App Services\",\r\n\ttype =~ 'microsoft.network/applicationgateways', 'App Gateways',\r\n\ttype =~ 'microsoft.network/frontdoors', 'Front Door',\r\n\ttype =~ 'microsoft.apimanagement/service', 'API Management',\r\n\ttype =~ 'microsoft.web/certificates', 'App Certificates',\r\n\ttype =~ 'microsoft.appconfiguration/configurationstores', 'App Config Stores',\r\n\tstrcat(\"Not Translated: \", type))\r\n| where type !has \"Not Translated\"\r\n| summarize count() by type", "size": 1, "noDataMessage": "No resources found", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "Resource", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 } ], "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Resource" } }, "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true, "sortCriteriaField": "type", "sortOrderField": 1 } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "apps" } ], "name": "query - PaaS - Apps Overview" }, { "type": 1, "content": { "json": "### Detailed View\r\n\r\nšŸ’” select 'View Details' to see full return from Azure Resource Graph" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "apps" } ], "name": "text - PaaS Text - App Services Details" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type has 'microsoft.web'\r\n\t or type =~ 'microsoft.apimanagement/service'\r\n\t or type =~ 'microsoft.network/frontdoors'\r\n\t or type =~ 'microsoft.network/applicationgateways'\r\n\t or type =~ 'microsoft.appconfiguration/configurationstores'\r\n| extend type = case(\r\n\ttype == 'microsoft.web/serverfarms', \"App Service Plans\",\r\n\tkind == 'functionapp', \"Azure Functions\", \r\n\tkind == \"api\", \"API Apps\", \r\n\ttype == 'microsoft.web/sites', \"App Services\",\r\n\ttype =~ 'microsoft.network/applicationgateways', 'App Gateways',\r\n\ttype =~ 'microsoft.network/frontdoors', 'Front Door',\r\n\ttype =~ 'microsoft.apimanagement/service', 'API Management',\r\n\ttype =~ 'microsoft.web/certificates', 'App Certificates',\r\n\ttype =~ 'microsoft.appconfiguration/configurationstores', 'App Config Stores',\r\n\tstrcat(\"Not Translated: \", type))\r\n| where type !has \"Not Translated\"\r\n| extend Sku = case(\r\n\ttype =~ 'App Gateways', properties.sku.name, \r\n\ttype =~ 'Azure Functions', properties.sku,\r\n\ttype =~ 'API Management', sku.name,\r\n\ttype =~ 'App Service Plans', sku.name,\r\n\ttype =~ 'App Services', properties.sku,\r\n\ttype =~ 'App Config Stores', sku.name,\r\n\t' ')\r\n| extend State = case(\r\n\ttype =~ 'App Config Stores', properties.provisioningState,\r\n\ttype =~ 'App Service Plans', properties.status,\r\n\ttype =~ 'Azure Functions', properties.state,\r\n\ttype =~ 'App Services', properties.state,\r\n\ttype =~ 'API Management', properties.provisioningState,\r\n\ttype =~ 'App Gateways', properties.provisioningState,\r\n\ttype =~ 'Front Door', properties.provisioningState,\r\n\t' ')\r\n| mv-expand publicIpId = properties.frontendIPConfigurations\r\n| mv-expand publicIpId = publicIpId.properties.publicIPAddress.id\r\n| extend publicIpId = tostring(publicIpId)\r\n\t| join kind=leftouter(\r\n\t \tResources\r\n \t\t| where type =~ 'microsoft.network/publicipaddresses'\r\n \t\t| project publicIpId = id, publicIpAddress = tostring(properties.ipAddress)) on publicIpId\r\n| extend PublicIP = case(\r\n\ttype =~ 'API Management', properties.publicIPAddresses,\r\n\ttype =~ 'App Gateways', publicIpAddress,\r\n type =~ 'App Services', properties.inboundIpAddress,\r\n type =~ 'Azure Functions', properties.inboundIpAddress,\r\n\t' ')\r\n| extend Instances = case(\r\n\ttype =~ 'API Management', sku.capacity,\r\n type =~ 'App Services', properties.siteConfig.numberOfWorkers,\r\n type =~ 'Azure Functions', properties.siteConfig.numberOfWorkers,\r\n type =~ 'App Service Plans', properties.currentNumberOfWorkers,\r\n\t' ')\r\n| extend ServicePlan = case(\r\n type =~ 'App Services', properties.serverFarmId,\r\n type =~ 'Azure Functions', properties.serverFarmId,\r\n\t' ')\r\n| extend Details = pack_all()\r\n| project Resource=id, type, subscriptionId, Sku, State, PublicIP, Instances, ServicePlan, Details", "size": 2, "noDataMessage": "No resources found", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "Resource", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "šŸ” View Details", "linkIsContextBlade": true } } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Resource" } }, "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true, "sortCriteriaField": "type", "sortOrderField": 1 } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "apps" } ], "name": "query - PaaS - Apps Detailed", "styleSettings": { "padding": "0 0 200px 0" } }, { "type": 1, "content": { "json": "### NoShow - End PaaS - Apps" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow End PaaS - Apps" }, { "type": 1, "content": { "json": "### NoShow - Begin PaaS - Events" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow Begin PaaS - Events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type has 'microsoft.servicebus'\r\n\tor type has 'microsoft.eventhub'\r\n\tor type has 'microsoft.eventgrid'\r\n\tor type has 'microsoft.relay'\r\n| extend type = case(\r\n\ttype == 'microsoft.eventgrid/systemtopics', \"EventGrid System Topics\",\r\n\ttype =~ \"microsoft.eventgrid/topics\", \"EventGrid Topics\",\r\n\ttype =~ 'microsoft.eventhub/namespaces', \"EventHub Namespaces\",\r\n\ttype =~ 'microsoft.servicebus/namespaces', 'ServiceBus Namespaces',\r\n\ttype =~ 'microsoft.relay/namespaces', 'Relays',\r\n\tstrcat(\"Not Translated: \", type))\r\n| where type !has \"Not Translated\"\r\n| summarize count() by type", "size": 1, "noDataMessage": "No resources found", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "Resource", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 } ], "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Resource" } }, "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true, "sortCriteriaField": "type", "sortOrderField": 1 } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "events" } ], "name": "query - PaaS - Events Overview" }, { "type": 1, "content": { "json": "### Detailed View\r\n\r\nšŸ’” select 'View Details' to see full return from Azure Resource Graph" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "events" } ], "name": "text - PaaS Text - Events - Details" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type has 'microsoft.servicebus'\r\n\tor type has 'microsoft.eventhub'\r\n\tor type has 'microsoft.eventgrid'\r\n\tor type has 'microsoft.relay'\r\n| extend type = case(\r\n\ttype == 'microsoft.eventgrid/systemtopics', \"EventGrid System Topics\",\r\n\ttype =~ \"microsoft.eventgrid/topics\", \"EventGrid Topics\",\r\n\ttype =~ 'microsoft.eventhub/namespaces', \"EventHub Namespaces\",\r\n\ttype =~ 'microsoft.servicebus/namespaces', 'ServiceBus Namespaces',\r\n\ttype =~ 'microsoft.relay/namespaces', 'Relays',\r\n\tstrcat(\"Not Translated: \", type))\r\n| extend Sku = case(\r\n\ttype =~ 'Relays', sku.name, \r\n\ttype =~ 'EventGrid System Topics', properties.sku,\r\n\ttype =~ 'EventGrid Topics', sku.name,\r\n\ttype =~ 'EventHub Namespaces', sku.name,\r\n\ttype =~ 'ServiceBus Namespaces', sku.name,\r\n\t' ')\r\n| extend Endpoint = case(\r\n\ttype =~ 'Relays', properties.serviceBusEndpoint,\r\n\ttype =~ 'EventGrid Topics', properties.endpoint,\r\n\ttype =~ 'EventHub Namespaces', properties.serviceBusEndpoint,\r\n\ttype =~ 'ServiceBus Namespaces', properties.serviceBusEndpoint,\r\n\t' ')\r\n| extend Status = case(\r\n\ttype =~ 'Relays', properties.provisioningState,\r\n\ttype =~ 'EventGrid System Topics', properties.provisioningState,\r\n\ttype =~ 'EventGrid Topics', properties.publicNetworkAccess,\r\n\ttype =~ 'EventHub Namespaces', properties.status,\r\n\ttype =~ 'ServiceBus Namespaces', properties.status,\r\n\t' ')\r\n| extend Details = pack_all()\r\n| project Resource=id, subscriptionId, location, resourceGroup, type, Sku, Status, Endpoint, Details", "size": 2, "noDataMessage": "No resources found", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "Resource", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "šŸ” View Details", "linkIsContextBlade": true } } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Resource" } }, "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true, "sortCriteriaField": "type", "sortOrderField": 1 } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "events" } ], "name": "query - PaaS - Events Detailed", "styleSettings": { "padding": "0 0 200px 0" } }, { "type": 1, "content": { "json": "### NoShow - End PaaS - Events" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow End PaaS - Events" }, { "type": 1, "content": { "json": "### NoShow - Begin PaaS - Data" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow Begin PaaS - Data" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources \r\n| where type =~ 'microsoft.documentdb/databaseaccounts'\r\n\tor type =~ 'microsoft.sql/servers/databases'\r\n\tor type =~ 'microsoft.dbformysql/servers'\r\n\tor type =~ 'microsoft.sql/servers'\r\n or type =~ 'Microsoft.DBforPostgreSQL/servers'\r\n or type =~ 'Microsoft.DBforMariaDB/servers'\r\n or type =~ 'microsoft.dbforpostgresql/flexibleservers'\r\n| extend type = case(\r\n\ttype =~ 'microsoft.documentdb/databaseaccounts', 'CosmosDB',\r\n\ttype =~ 'microsoft.sql/servers/databases', 'SQL DBs',\r\n\ttype =~ 'microsoft.dbformysql/servers', 'MySQL Servers',\r\n\ttype =~ 'microsoft.sql/servers', 'SQL Servers',\r\n type =~ 'Microsoft.DBforPostgreSQL/servers', 'PostgreSQL Servers',\r\n type =~ 'microsoft.dbforpostgresql/flexibleservers', 'PostgreSQL Flexi Servers',\r\n type =~ 'Microsoft.DBforMariaDB/servers', 'MariaDB Servers',\r\n\tstrcat(\"Not Translated: \", type))\r\n| where type !has \"Not Translated\"\r\n| summarize count() by type", "size": 1, "noDataMessage": "No resources found", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "Resource", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 } ], "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Resource" } }, "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true, "sortCriteriaField": "type", "sortOrderField": 1 } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "data" } ], "name": "query - PaaS - Data Overview" }, { "type": 1, "content": { "json": "### Detailed View\r\n\r\nšŸ’” select 'View Details' to see full return from Azure Resource Graph" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "data" } ], "name": "text - PaaS Text - Data - Details" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// data\r\n// Click the \"Run query\" command above to execute the query and see results.\r\nresources \r\n| where type =~ 'microsoft.documentdb/databaseaccounts'\r\n\tor type =~ 'microsoft.sql/servers/databases'\r\n\tor type =~ 'microsoft.dbformysql/servers'\r\n\tor type =~ 'microsoft.sql/servers'\r\n or type =~ 'Microsoft.DBforPostgreSQL/servers'\r\n or type =~ 'Microsoft.DBforMariaDB/servers'\r\n or type =~ 'microsoft.dbforpostgresql/flexibleservers'\r\n| extend type = case(\r\n\ttype =~ 'microsoft.documentdb/databaseaccounts', 'CosmosDB',\r\n\ttype =~ 'microsoft.sql/servers/databases', 'SQL DBs',\r\n\ttype =~ 'microsoft.dbformysql/servers', 'MySQL Servers',\r\n\ttype =~ 'microsoft.sql/servers', 'SQL Servers',\r\n type =~ 'Microsoft.DBforPostgreSQL/servers', 'PostgreSQL Servers',\r\n type =~ 'microsoft.dbforpostgresql/flexibleservers', 'PostgreSQL Flexi Servers',\r\n type =~ 'Microsoft.DBforMariaDB/servers', 'MariaDB Servers',\r\n\tstrcat(\"Not Translated: \", type))\r\n| extend Sku = case(\r\n\ttype =~ 'CosmosDB', properties.databaseAccountOfferType,\r\n\ttype =~ 'SQL DBs', sku.name,\r\n\ttype =~ 'MySQL Servers', sku.name,\r\n type =~ 'PostgreSQL Servers', sku.name,\r\n type =~ 'PostgreSQL Flexi Servers', sku.name,\r\n type =~ 'MariaDB Servers', sku.name,\r\n\t' ')\r\n| extend Status = case(\r\n\ttype =~ 'CosmosDB', properties.provisioningState,\r\n\ttype =~ 'SQL DBs', properties.status,\r\n type =~ 'SQL Servers', properties.state,\r\n\ttype =~ 'MySQL Servers', properties.userVisibleState,\r\n type =~ 'PostgreSQL Servers', properties.state,\r\n type =~ 'PostgreSQL Flexi Servers', properties.state,\r\n type =~ 'MariaDB Servers', properties.userVisibleState,\r\n\t' ')\r\n| extend Endpoint = case(\r\n\ttype =~ 'MySQL Servers', properties.fullyQualifiedDomainName,\r\n\ttype =~ 'SQL Servers', properties.fullyQualifiedDomainName,\r\n\ttype =~ 'CosmosDB', properties.documentEndpoint,\r\n type =~ 'PostgreSQL Servers', properties.fullyQualifiedDomainName,\r\n type =~ 'PostgreSQL Flexi Servers', properties.fullyQualifiedDomainName,\r\n type =~ 'MariaDB Servers', properties.fullyQualifiedDomainName,\r\n\t' ')\r\n| extend PublicNetworkAccess = case(\r\n\ttype =~ 'MySQL Servers', properties.publicNetworkAccess,\r\n\ttype =~ 'SQL Servers', properties.publicNetworkAccess,\r\n type =~ 'PostgreSQL Servers', properties.publicNetworkAccess,\r\n type =~ 'PostgreSQL Flexi Servers', properties.publicNetworkAccess,\r\n type =~ 'MariaDB Servers', properties.publicNetworkAccess,\r\n\t' ')\r\n| extend Version = case(\r\n\ttype =~ 'MySQL Servers', properties.version,\r\n\ttype =~ 'SQL Servers', properties.version,\r\n type =~ 'PostgreSQL Servers', properties.version,\r\n type =~ 'PostgreSQL Flexi Servers', properties.version,\r\n type =~ 'MariaDB Servers', properties.version,\r\n\t' ')\r\n| extend maxSizeGB = todouble(case(\r\n\ttype =~ 'SQL DBs', properties.maxSizeBytes,\r\n\ttype =~ 'MySQL Servers', properties.storageProfile.storageMB,\r\n type =~ 'PostgreSQL Servers', properties.storageProfile.storageMB,\r\n type =~ 'PostgreSQL Flexi Servers', properties.storageProfile.storageMB,\r\n type =~ 'MariaDB Servers', properties.storageProfile.storageMB,\r\n\t' '))\r\n| extend maxSizeGB = iif(type has 'SQL DBs', maxSizeGB /1000 /1000, maxSizeGB)\r\n| extend Details = pack_all()\r\n| project Resource=id, resourceGroup, subscriptionId, type, Sku, Status, Endpoint, Version, PublicNetworkAccess, maxSizeGB, Details\r\n\r\n", "size": 2, "noDataMessage": "No resources found", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "Resource", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "maxSizeGB", "formatter": 0, "numberFormat": { "unit": 4, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "šŸ” View Details", "linkIsContextBlade": true } } ], "rowLimit": 1000, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Resource" } }, "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true, "sortCriteriaField": "type", "sortOrderField": 1 } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "data" } ], "name": "query - PaaS - Data Detailed", "styleSettings": { "padding": "0 0 200px 0" } }, { "type": 1, "content": { "json": "### NoShow - End PaaS - Data" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow End PaaS - Data" }, { "type": 1, "content": { "json": "### NoShow - Begin PaaS - Storage" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow Begin PaaS - Storage" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources \r\n| where type =~ 'microsoft.storagesync/storagesyncservices'\r\n\tor type =~ 'microsoft.recoveryservices/vaults'\r\n\tor type =~ 'microsoft.storage/storageaccounts'\r\n\tor type =~ 'microsoft.keyvault/vaults'\r\n| extend type = case(\r\n\ttype =~ 'microsoft.storagesync/storagesyncservices', 'Azure File Sync',\r\n\ttype =~ 'microsoft.recoveryservices/vaults', 'Azure Backup',\r\n\ttype =~ 'microsoft.storage/storageaccounts', 'Storage Accounts',\r\n\ttype =~ 'microsoft.keyvault/vaults', 'Key Vaults',\r\n\tstrcat(\"Not Translated: \", type))\r\n| where type !has \"Not Translated\"\r\n| summarize count() by type", "size": 1, "noDataMessage": "No resources found", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "Resource", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 } ], "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Resource" } }, "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true, "sortCriteriaField": "type", "sortOrderField": 1 } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "storage" } ], "name": "query - PaaS - Data Overview " }, { "type": 1, "content": { "json": "### Detailed View\r\n\r\nšŸ’” select 'View Details' to see full return from Azure Resource Graph" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "storage" } ], "name": "text - PaaS Text - Storage - Details" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources \r\n| where type =~ 'microsoft.storagesync/storagesyncservices'\r\n\tor type =~ 'microsoft.recoveryservices/vaults'\r\n\tor type =~ 'microsoft.storage/storageaccounts'\r\n\tor type =~ 'microsoft.keyvault/vaults'\r\n| extend type = case(\r\n\ttype =~ 'microsoft.storagesync/storagesyncservices', 'Azure File Sync',\r\n\ttype =~ 'microsoft.recoveryservices/vaults', 'Azure Backup',\r\n\ttype =~ 'microsoft.storage/storageaccounts', 'Storage Accounts',\r\n\ttype =~ 'microsoft.keyvault/vaults', 'Key Vaults',\r\n\tstrcat(\"Not Translated: \", type))\r\n| extend Sku = case(\r\n\ttype !has 'Key Vaults', sku.name,\r\n\ttype =~ 'Key Vaults', properties.sku.name,\r\n\t' ')\r\n| extend Details = pack_all()\r\n| project Resource=id, type, kind, subscriptionId, resourceGroup, Sku, Details", "size": 2, "noDataMessage": "No resources found", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "Resource", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "šŸ” View Details", "linkIsContextBlade": true } } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Resource" } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "paas" }, { "parameterName": "paas", "comparison": "isEqualTo", "value": "storage" } ], "name": "query - PaaS - Data Detailed", "styleSettings": { "padding": "0 0 200px 0" } }, { "type": 1, "content": { "json": "### NoShow - End PaaS - Storage" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow End PaaS - Storage - Copy" }, { "type": 1, "content": { "json": "## End PaaS\r\n\r\n\r\n## Begin Networking" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow Monitoring Security" }, { "type": 1, "content": { "json": "## Networking Overview" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "network" }, "name": "text - Networking Overview" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "where type has \"microsoft.network\"\r\n| extend type = case(\r\n\ttype == 'microsoft.network/networkinterfaces', \"NICs\",\r\n\ttype == 'microsoft.network/networksecuritygroups', \"NSGs\", \r\n\ttype == \"microsoft.network/publicipaddresses\", \"Public IPs\", \r\n\ttype == 'microsoft.network/virtualnetworks', \"vNets\",\r\n\ttype == 'microsoft.network/networkwatchers/connectionmonitors', \"Connection Monitors\",\r\n\ttype == 'microsoft.network/privatednszones', \"Private DNS\",\r\n\ttype == 'microsoft.network/virtualnetworkgateways', @\"vNet Gateways\",\r\n\ttype == 'microsoft.network/connections', \"Connections\",\r\n\ttype == 'microsoft.network/networkwatchers', \"Network Watchers\",\r\n\ttype == 'microsoft.network/privateendpoints', \"Private Endpoints\",\r\n\ttype == 'microsoft.network/localnetworkgateways', \"Local Network Gateways\",\r\n\ttype == 'microsoft.network/privatednszones/virtualnetworklinks', \"vNet Links\",\r\n\ttype == 'microsoft.network/dnszones', 'DNS Zones',\r\n\ttype == 'microsoft.network/networkwatchers/flowlogs', 'Flow Logs',\r\n\ttype == 'microsoft.network/routetables', 'Route Tables',\r\n\ttype == 'microsoft.network/loadbalancers', 'Load Balancers',\r\n type =~ 'Microsoft.Network/applicationGateways', 'Application Gateways',\r\n\tstrcat(\"Not Translated: \", type))\r\n| summarize count() by type\r\n| where type !has \"Not Translated\"", "size": 2, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true, "sortCriteriaField": "count_", "sortOrderField": 2 } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "network" }, "name": "query - Networking Summary" }, { "type": 1, "content": { "json": "## Networking Details\r\n\r\nšŸ’” select tab to view NSG Details\r\n\r\nšŸ’” select 'View Details' to see full return from Azure Resource Graph" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "network" }, "name": "text - Neworking Details" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "11426c5c-1edb-41a5-bb7f-fbfb8bbc4bba", "cellValue": "network", "linkTarget": "parameter", "linkLabel": "Unassociated NSGs", "subTarget": "blanknsgs", "style": "link" }, { "id": "5c167305-3eff-4612-a28a-8be527307914", "cellValue": "network", "linkTarget": "parameter", "linkLabel": "NSG Rules", "subTarget": "nsgrules", "style": "link" }, { "id": "d36b1b09-17de-4dd4-838d-7f3973a7efbf", "cellValue": "network", "linkTarget": "parameter", "linkLabel": "Unused PiPs", "subTarget": "blankpip", "style": "link" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "network" }, "name": "links - Networking Details - Tabs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources\r\n| where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets)\r\n| project Resource=id, resourceGroup, subscriptionId, location", "size": 0, "noDataMessage": "No Unassociated NSGs Found", "noDataMessageStyle": 3, "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "Resource", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "id", "formatter": 5 }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "šŸ” View Details", "linkIsContextBlade": true } } ], "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Resource" } }, "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true, "sortCriteriaField": "count_", "sortOrderField": 2 } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "network" }, { "parameterName": "network", "comparison": "isEqualTo", "value": "blanknsgs" } ], "name": "query - Networking Details - Unassociated NSGs", "styleSettings": { "padding": "0 0 100px 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources\r\n | where type =~ 'microsoft.network/networksecuritygroups'\r\n | project id, nsgRules = parse_json(parse_json(properties).securityRules), networksecurityGroupName = name, subscriptionId, resourceGroup , location\r\n | mvexpand nsgRule = nsgRules\r\n | project id, location, access=nsgRule.properties.access,protocol=nsgRule.properties.protocol ,direction=nsgRule.properties.direction,provisioningState= nsgRule.properties.provisioningState ,priority=nsgRule.properties.priority, \r\n sourceAddressPrefix = nsgRule.properties.sourceAddressPrefix, \r\n sourceAddressPrefixes = nsgRule.properties.sourceAddressPrefixes,\r\n destinationAddressPrefix = nsgRule.properties.destinationAddressPrefix, \r\n destinationAddressPrefixes = nsgRule.properties.destinationAddressPrefixes, \r\n networksecurityGroupName, networksecurityRuleName = tostring(nsgRule.name), \r\n subscriptionId, resourceGroup,\r\n destinationPortRanges = nsgRule.properties.destinationPortRanges,\r\n destinationPortRange = nsgRule.properties.destinationPortRange,\r\n sourcePortRanges = nsgRule.properties.sourcePortRanges,\r\n sourcePortRange = nsgRule.properties.sourcePortRange\r\n| extend Details = pack_all()\r\n| project id, location, access, direction, subscriptionId, resourceGroup, Details", "size": 2, "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "id", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "resourceGroup", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "24.1429ch" } }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "šŸ” View Details", "linkIsContextBlade": true } } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "id" } }, "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true, "sortCriteriaField": "count_", "sortOrderField": 2 } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "network" }, { "parameterName": "network", "comparison": "isEqualTo", "value": "nsgrules" } ], "name": "query - Networking Details - NSG Rules", "styleSettings": { "padding": "0 0 200px 0" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources\r\n| where type =~ 'Microsoft.Network/publicIPAddresses' and isnull(properties.ipAddress)\r\n| extend ipAddress = properties.ipAddress\r\n| extend sku = sku.name\r\n| extend Details = pack_all()\r\n| project Resource=id, subscriptionId, resourceGroup, name, location,sku,Details", "size": 0, "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "linkIsContextBlade": true, "showIcon": true } }, { "columnMatch": "Resource", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "šŸ” View Details", "linkIsContextBlade": true } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Resource" } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "network" }, { "parameterName": "network", "comparison": "isEqualTo", "value": "blankpip" } ], "name": "query - Networking Details - Unused PiPs" }, { "type": 1, "content": { "json": "## End Networking\r\n\r\n\r\n## Begin Monitoring & Security" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - End Networking" }, { "type": 1, "content": { "json": "## Monitor & Security \r\n \r\n \r\n \r\n### Workspaces Overview" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, "name": "text - Monitor & Security" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources \r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\nor type =~ 'microsoft.insights/components'\r\n| summarize count() by type\r\n| extend type = case(\r\ntype == 'microsoft.insights/components', \"Application Insights\",\r\ntype == 'microsoft.operationalinsights/workspaces', \"Log Analytics workspaces\",\r\nstrcat(type, type))", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Solutions", "formatter": 5 }, { "columnMatch": "AzureSecurityCenter", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureSecurityCenterFree", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureSentinel", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureMonitorVMs", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "ServiceDesk", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureAutomation", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "ChangeTracking", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "UpdateManagement", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "UpdateCompliance", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureMonitorContainers", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "KeyVaultAnalytics", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "SQLHealthCheck", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, "name": "query - Monitoring Security Overview - Copy - Copy" }, { "type": 1, "content": { "json": "### Azure Monitor Workbooks & Alerting Resources" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, "name": "text - Monitor & Security - Azure Monitor Alerts" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type has 'microsoft.insights/'\r\n or type has 'microsoft.alertsmanagement/smartdetectoralertrules'\r\n or type has 'microsoft.portal/dashboards'\r\n| where type != 'microsoft.insights/components'\r\n| extend type = case(\r\n \ttype == 'microsoft.insights/workbooks', \"Workbooks\",\r\n\ttype == 'microsoft.insights/activitylogalerts', \"Activity Log Alerts\",\r\n\ttype == 'microsoft.insights/scheduledqueryrules', \"Log Search Alerts\",\r\n\ttype == 'microsoft.insights/actiongroups', \"Action Groups\",\r\n\ttype == 'microsoft.insights/metricalerts', \"Metric Alerts\",\r\n\ttype =~ 'microsoft.alertsmanagement/smartdetectoralertrules','Smart Detection Rules',\r\n type =~ 'microsoft.insights/webtests', 'URL Web Tests',\r\n type =~ 'microsoft.portal/dashboards', 'Portal Dashboards',\r\nstrcat(\"Not Translated: \", type))\r\n| summarize count() by type", "size": 1, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Solutions", "formatter": 5 }, { "columnMatch": "AzureSecurityCenter", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureSecurityCenterFree", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureSentinel", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureMonitorVMs", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "ServiceDesk", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureAutomation", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "ChangeTracking", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "UpdateManagement", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "UpdateCompliance", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureMonitorContainers", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "KeyVaultAnalytics", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "SQLHealthCheck", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true, "sortCriteriaField": "count_", "sortOrderField": 2 } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, "name": "query - Monitoring Security Overview - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "ed3b3650-dd46-4a66-9acd-cbda10b14c04", "cellValue": "monitor", "linkTarget": "parameter", "linkLabel": "Active Alerts", "subTarget": "alerts", "preText": "Active Alerts", "style": "link" }, { "id": "9224d88a-9c0d-49de-8b24-38b3f8c380d3", "cellValue": "monitor", "linkTarget": "parameter", "linkLabel": "Workbooks & Alerting Resources", "subTarget": "alertresources", "preText": "Monitor Resources", "style": "link" }, { "id": "b90eaf7d-647e-4b37-ae0a-6fc6a49ce07c", "cellValue": "monitor", "linkTarget": "parameter", "linkLabel": "App Monitoring", "subTarget": "apm", "preText": "App Monitoring", "style": "link" }, { "id": "1b181560-7b87-4f30-886c-2054a3648401", "cellValue": "monitor", "linkTarget": "parameter", "linkLabel": "Log Analytics", "subTarget": "loganalytics", "preText": "Log Analytics", "style": "link" }, { "id": "d19b8a04-9a79-40ca-90a6-7ebc1be7fe75", "cellValue": "monitor", "linkTarget": "parameter", "linkLabel": "Security Score", "subTarget": "security", "preText": "Security Score", "style": "link" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, "name": "links - Monitor & Security - Tabs" }, { "type": 1, "content": { "json": "### NoShow - Begin - Monitor & Security - Active Alerts" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow - Begin Active Alerts" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AlertsManagementResources\r\n| extend AlertStatus = properties.essentials.monitorCondition\r\n| extend AlertState = properties.essentials.alertState\r\n| extend AlertTime = properties.essentials.startDateTime\r\n| extend AlertSuppressed = properties.essentials.actionStatus.isSuppressed\r\n| extend Severity = properties.essentials.severity\r\n| where AlertStatus == 'Fired'\r\n| extend Details = pack_all()\r\n| project id, name, subscriptionId, resourceGroup, AlertStatus, AlertState, AlertTime, AlertSuppressed, Severity, Details", "size": 2, "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "id", "formatter": 5 }, { "columnMatch": "name", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "šŸ” View Details", "linkIsContextBlade": true } } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "name" } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, { "parameterName": "monitor", "comparison": "isEqualTo", "value": "alerts" } ], "name": "query - Monitor & Security - Active Alerts" }, { "type": 1, "content": { "json": "### NoShow - End - Monitor & Security - Active Alerts" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow - End Active Alerts" }, { "type": 1, "content": { "json": "### NoShow - Begin Monitor & Security - Alerting Resources" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow - Begin Alerting Resources" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type has 'microsoft.insights/'\r\n or type has 'microsoft.alertsmanagement/smartdetectoralertrules'\r\n or type has 'microsoft.portal/dashboards'\r\n| where type != 'microsoft.insights/components'\r\n| extend type = case(\r\n \ttype == 'microsoft.insights/workbooks', \"Workbooks\",\r\n\ttype == 'microsoft.insights/activitylogalerts', \"Activity Log Alerts\",\r\n\ttype == 'microsoft.insights/scheduledqueryrules', \"Log Search Alerts\",\r\n\ttype == 'microsoft.insights/actiongroups', \"Action Groups\",\r\n\ttype == 'microsoft.insights/metricalerts', \"Metric Alerts\",\r\n\ttype =~ 'microsoft.alertsmanagement/smartdetectoralertrules','Smart Detection Rules',\r\n type =~ 'microsoft.portal/dashboards', 'Portal Dashboards',\r\n\tstrcat(\"Not Translated: \", type))\r\n| extend Enabled = case(\r\n\ttype =~ 'Smart Detection Rules', properties.state,\r\n\ttype != 'Smart Detection Rules', properties.enabled,\r\n\tstrcat(\"Not Translated: \", type))\r\n| extend WorkbookType = iif(type =~ 'Workbooks', properties.category, ' ')\r\n| extend Details = pack_all()\r\n| project name, type, subscriptionId, location, resourceGroup, Enabled, WorkbookType, Details", "size": 2, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "name", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "šŸ” View Details", "linkIsContextBlade": true } }, { "columnMatch": "id", "formatter": 5 } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "name" } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, { "parameterName": "monitor", "comparison": "isEqualTo", "value": "alertresources" } ], "name": "query - Monitor & Security - Alerting Resources" }, { "type": 1, "content": { "json": "### NoShow - End - Monitor & Security - Alerting Resources" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow - End Alerting Resources" }, { "type": 1, "content": { "json": "### NoShow - Begin - Monitor & Security - App Monitoring" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow - Begin App Monitoring" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "where type =~ 'microsoft.insights/components'\r\n| extend RetentionInDays = properties.RetentionInDays\r\n| extend IngestionMode = properties.IngestionMode\r\n| extend Details = pack_all()\r\n| project Resource=id, location, resourceGroup, subscriptionId, IngestionMode, RetentionInDays, Details", "size": 2, "exportedParameters": [ { "fieldName": "Resource", "parameterName": "appinsight", "parameterType": 5 } ], "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "Resource", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "šŸ” View Details", "linkIsContextBlade": true } }, { "columnMatch": "id", "formatter": 5 }, { "columnMatch": "name", "formatter": 5 } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Resource" } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, { "parameterName": "monitor", "comparison": "isEqualTo", "value": "apm" } ], "name": "query - Monitor & Security - App Monitoring" }, { "type": 1, "content": { "json": "### NoShow - End - Monitor & Security - App Monitoring" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow - End App Monitoring" }, { "type": 1, "content": { "json": "### NoShow - Begin - Monitor & Security - Log Analytics" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow - Begin - App Monitoring" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| extend Sku = properties.sku.name\r\n| extend RetentionInDays = properties.retentionInDays\r\n| extend Details = pack_all()\r\n| project Workspace=id, resourceGroup, location, subscriptionId, Sku, RetentionInDays, Details", "size": 0, "exportedParameters": [ { "fieldName": "workspace", "parameterName": "workspace", "parameterType": 5 } ], "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "Workspace", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "šŸ” View Details", "linkIsContextBlade": true } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Workspace" } }, "sortBy": [] }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, { "parameterName": "monitor", "comparison": "isEqualTo", "value": "loganalytics" } ], "name": "query - Monitoring Security Overview - Copy" }, { "type": 1, "content": { "json": "### Log Analytics workspaces with enabled Solutions\r\n\r\nšŸ’” Select workspace to see data tables and resources logging to that workspace\r\n" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, { "parameterName": "monitor", "comparison": "isEqualTo", "value": "loganalytics" } ], "name": "text - Monitor & Security - workspace details" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type == \"microsoft.operationsmanagement/solutions\"\r\n| project Solution=plan.name, Workspace=tolower(tostring(properties.workspaceResourceId)), subscriptionId\r\n\t| join kind=leftouter(\r\n\t\tresources\r\n\t\t| where type =~ 'microsoft.operationalinsights/workspaces'\r\n\t\t| project Workspace=tolower(tostring(id)),subscriptionId) on Workspace\r\n| summarize Solutions = strcat_array(make_list(Solution), \",\") by Workspace, subscriptionId\r\n| extend AzureSecurityCenter = iif(Solutions has 'Security','Enabled','Not Enabled')\r\n| extend AzureSecurityCenterFree = iif(Solutions has 'SecurityCenterFree','Enabled','Not Enabled')\r\n| extend AzureSentinel = iif(Solutions has \"SecurityInsights\",'Enabled','Not Enabled')\r\n| extend AzureMonitorVMs = iif(Solutions has \"VMInsights\",'Enabled','Not Enabled')\r\n| extend ServiceDesk = iif(Solutions has \"ITSM Connector\",'Enabled','Not Enabled')\r\n| extend AzureAutomation = iif(Solutions has \"AzureAutomation\",'Enabled','Not Enabled')\r\n| extend ChangeTracking = iif(Solutions has 'ChangeTracking','Enabled','Not Enabled')\r\n| extend UpdateManagement = iif(Solutions has 'Updates','Enabled','Not Enabled')\r\n| extend UpdateCompliance = iif(Solutions has 'WaaSUpdateInsights','Enabled','Not Enabled')\r\n| extend AzureMonitorContainers = iif(Solutions has 'ContainerInsights','Enabled','Not Enabled')\r\n| extend KeyVaultAnalytics = iif(Solutions has 'KeyVaultAnalytics','Enabled','Not Enabled')\r\n| extend SQLHealthCheck = iif(Solutions has 'SQLAssessment','Enabled','Not Enabled')", "size": 0, "exportedParameters": [ { "fieldName": "Workspace", "parameterName": "workspace", "parameterType": 5 } ], "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "Workspace", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "Solutions", "formatter": 5 }, { "columnMatch": "AzureSecurityCenter", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureSecurityCenterFree", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureSentinel", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureMonitorVMs", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "ServiceDesk", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureAutomation", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "ChangeTracking", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "UpdateManagement", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "UpdateCompliance", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "AzureMonitorContainers", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "KeyVaultAnalytics", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } }, { "columnMatch": "SQLHealthCheck", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Not Enabled", "representation": "disabled", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Available", "text": "{0}{1}" } ] } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Workspace" } }, "sortBy": [] }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, { "parameterName": "monitor", "comparison": "isEqualTo", "value": "loganalytics" } ], "name": "query - Monitoring Security Overview" }, { "type": 1, "content": { "json": "\r\n\r\nšŸ’” Workspace table usage for selected workspace on the left, resources reported to selected workspace on the right." }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, { "parameterName": "monitor", "comparison": "isEqualTo", "value": "loganalytics" } ], "name": "text - Monitor & Security - workspace table usage" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| summarize Size = sum(Quantity) by ['Table Name'] = DataType\r\n| sort by Size desc", "size": 2, "noDataMessageStyle": 5, "timeContext": { "durationMs": 86400000 }, "exportedParameters": [ { "fieldName": "workspace", "parameterName": "workspace", "parameterType": 5 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": ["{workspace}"], "gridSettings": { "formatters": [ { "columnMatch": "Size", "formatter": 3, "formatOptions": { "palette": "orange", "customColumnWidthSetting": "341px" }, "numberFormat": { "unit": 38, "options": { "style": "decimal" } } } ], "rowLimit": 500, "filter": true }, "sortBy": [] }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, { "parameterName": "monitor", "comparison": "isEqualTo", "value": "loganalytics" } ], "customWidth": "50", "name": "query - Monitoring Security - Workspace Usage - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "search * | distinct _ResourceId, SubscriptionId", "size": 2, "noDataMessageStyle": 5, "timeContext": { "durationMs": 86400000 }, "exportedParameters": [ { "fieldName": "workspace", "parameterName": "workspace", "parameterType": 5 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": ["{workspace}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "_ResourceId", "formatter": 5 }, { "columnMatch": "SubscriptionId", "formatter": 5 } ], "rowLimit": 500, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["SubscriptionId"], "expandTopLevel": true, "finalBy": "_ResourceId" } }, "sortBy": [] }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, { "parameterName": "monitor", "comparison": "isEqualTo", "value": "loganalytics" } ], "customWidth": "50", "name": "query - Monitoring Security - Workspace Usage" }, { "type": 1, "content": { "json": "### NoShow - End - Monitor & Security - Log Analytics" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow - End - App Monitoring" }, { "type": 1, "content": { "json": "### NoShow - Begin - Monitor & Security - Security" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow - Begin - App Monitoring - Security" }, { "type": 1, "content": { "json": "### Azure Security Center Secure Store by Subscription" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, { "parameterName": "monitor", "comparison": "isEqualTo", "value": "security" } ], "name": "text - Monitor & Security - Secure Score Text" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "securityresources\r\n| where type == \"microsoft.security/securescores\"\r\n| extend subscriptionSecureScore = round(100 * bin((todouble(properties.score.current))/ todouble(properties.score.max), 0.001))\r\n| where subscriptionSecureScore > 0\r\n| project subscriptionSecureScore, subscriptionId\r\n| order by subscriptionSecureScore asc", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "subscriptionSecureScore", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "redGreen" }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": false } } } ], "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "subscriptionSecureScore" } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, { "parameterName": "monitor", "comparison": "isEqualTo", "value": "security" } ], "name": "query - Monitor & Security - Security Scores" }, { "type": 1, "content": { "json": "### Azure Security Center Secure Controls Score by Controls\r\n\r\nlists all security controls, the amount of unhealthy resources, their current score and their max score" }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, { "parameterName": "monitor", "comparison": "isEqualTo", "value": "security" } ], "name": "text - Monitor & Security - Secure Score Text - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityResources \r\n| where type == 'microsoft.security/securescores/securescorecontrols' \r\n| extend SecureControl = properties.displayName, unhealthy = properties.unhealthyResourceCount, currentscore = properties.score.current, maxscore = properties.score.max, subscriptionId\r\n| project SecureControl , unhealthy, currentscore, maxscore, subscriptionId", "size": 3, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true, "customColumnWidthSetting": "45ch" } }, { "columnMatch": "SecureControl", "formatter": 5 }, { "columnMatch": "unhealthy", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" } }, { "columnMatch": "currentscore", "formatter": 8, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "maxscore", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "subscriptionSecureScore", "formatter": 8, "formatOptions": { "min": 0, "max": 100, "palette": "redGreen" }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": false } } } ], "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "SecureControl" } } }, "conditionalVisibilities": [ { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "monitor" }, { "parameterName": "monitor", "comparison": "isEqualTo", "value": "security" } ], "name": "query - Monitor & Security - Security Scores - Copy" }, { "type": 1, "content": { "json": "### NoShow - End - Monitor & Security - Security" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow - End - App Monitoring - Security - Copy" }, { "type": 1, "content": { "json": "## End Monitoring & Security\r\n\r\n## Begin Tagged Resoruces" }, "conditionalVisibility": { "parameterName": "noshow", "comparison": "isEqualTo", "value": "noshow" }, "name": "text - NoShow End Monitoring" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": ["{Subscriptions}"], "parameters": [ { "id": "f89867f4-907a-49cd-add8-bded49c43bed", "version": "KqlParameterItem/1.0", "name": "Environment", "type": 5, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resources \r\n| where tags.Environment != '' \r\n| distinct tostring(tags.Environment)", "crossComponentResources": ["{Subscriptions}"], "value": ["value::1"], "typeSettings": { "additionalResourceOptions": ["value::1", "value::all"], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "ef32b148-7ea7-4af4-aaf7-b6a87f2d00d7", "version": "KqlParameterItem/1.0", "name": "Application", "type": 5, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resources \r\n| where tags.Environment in~ ({Environment}) or '*' in~ ({Environment})\r\n| where tags.Application != '' \r\n| distinct tostring(tags.Application) ", "crossComponentResources": ["{Subscriptions}"], "value": [], "typeSettings": { "additionalResourceOptions": ["value::1", "value::all"], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "tags" }, "name": "parameters - Tagged Resources" }, { "type": 1, "content": { "json": "## Showing Resources for {Environment} and Application(s) {Application}\r\n> For this to work there must be a Environment and Application tag with value on resources" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "tags" }, "name": "text - Show Text for Tagged Selections" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type != 'microsoft.network/networkinterfaces'\r\n| where type != 'microsoft.compute/disks'\r\n| where tags.Environment in~ ({Environment}) or '*' in~ ({Environment})\r\n| where tags.Application in~ ({Application}) or '*' in~ ({Application})\r\n| extend type = case(\r\ntype =~ 'microsoft.network/networksecuritygroups', \"NSGs\", \r\ntype =~ \"microsoft.network/publicipaddresses\", \"Public IPs\", \r\ntype =~ 'microsoft.network/virtualnetworks', \"vNets\",\r\ntype =~ 'microsoft.network/networkwatchers/connectionmonitors', \"Connection Monitors\",\r\ntype =~ 'microsoft.network/privatednszones', \"Private DNS\",\r\ntype =~ 'microsoft.network/virtualnetworkgateways', \"vNet Gateways\",\r\ntype =~ 'microsoft.network/connections', \"Connections\",\r\ntype =~ 'microsoft.network/networkwatchers', \"Network Watchers\",\r\ntype =~ 'microsoft.network/privateendpoints', \"Private Endpoints\",\r\ntype =~ 'microsoft.network/localnetworkgateways', \"Local Network Gateways\",\r\ntype =~ 'microsoft.network/privatednszones/virtualnetworklinks', \"vNet Links\",\r\ntype =~ 'microsoft.web/serverfarms', \"App Service Plans\",\r\nkind == 'functionapp', \"Azure Functions\", \r\nkind == \"api\", \"API Apps\", \r\ntype =~ 'microsoft.web/sites', \"App Services\",\r\ntype =~ \"microsoft.compute/virtualmachines\", \"Azure Compute\",\r\ntype =~ \"microsoft.logic/workflows\", \"LogicApps\",\r\ntype =~ 'microsoft.keyvault/vaults', \"Key Vaults\",\r\ntype =~ 'microsoft.keyvault/vaults', \"Hybrid Compute\",\r\ntype =~ 'microsoft.storage/storageaccounts', \"Storage Accounts\",\r\ntype =~ 'microsoft.compute/availabilitysets', 'Availability Sets',\r\ntype =~ 'microsoft.insights/components','Application Insights',\r\ntype =~ 'microsoft.desktopvirtualization/applicationgroups', 'WVD Application Groups',\r\ntype =~ 'microsoft.desktopvirtualization/workspaces', 'WVD Workspaces',\r\ntype =~ 'microsoft.desktopvirtualization/hostpools', 'WVD Hostpools',\r\nstrcat(\"Not Translated: \", type))\r\n| summarize count() by type\r\n\r\n\r\n", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "tags" }, "name": "query - Tagged Resources" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type != 'microsoft.network/networkinterfaces'\r\n| where type != 'microsoft.compute/disks'\r\n| where tags.Environment in~ ({Environment}) or '*' in~ ({Environment})\r\n| where tags.Application in~ ({Application}) or '*' in~ ({Application})\r\n| extend type = case(\r\ntype =~ 'microsoft.network/networksecuritygroups', \"NSGs\", \r\ntype =~ \"microsoft.network/publicipaddresses\", \"Public IPs\", \r\ntype =~ 'microsoft.network/virtualnetworks', \"vNets\",\r\ntype =~ 'microsoft.network/networkwatchers/connectionmonitors', \"Connection Monitors\",\r\ntype =~ 'microsoft.network/privatednszones', \"Private DNS\",\r\ntype =~ 'microsoft.network/virtualnetworkgateways', \"vNet Gateways\",\r\ntype =~ 'microsoft.network/connections', \"Connections\",\r\ntype =~ 'microsoft.network/networkwatchers', \"Network Watchers\",\r\ntype =~ 'microsoft.network/privateendpoints', \"Private Endpoints\",\r\ntype =~ 'microsoft.network/localnetworkgateways', \"Local Network Gateways\",\r\ntype =~ 'microsoft.network/privatednszones/virtualnetworklinks', \"vNet Links\",\r\ntype =~ 'microsoft.web/serverfarms', \"App Service Plans\",\r\nkind == 'functionapp', \"Azure Functions\", \r\nkind == \"api\", \"API Apps\", \r\ntype =~ 'microsoft.web/sites', \"App Services\",\r\ntype =~ \"microsoft.compute/virtualmachines\", \"Azure Compute\",\r\ntype =~ \"microsoft.logic/workflows\", \"LogicApps\",\r\ntype =~ 'microsoft.keyvault/vaults', \"Key Vaults\",\r\ntype =~ 'microsoft.keyvault/vaults', \"Hybrid Compute\",\r\ntype =~ 'microsoft.storage/storageaccounts', \"Storage Accounts\",\r\ntype =~ 'microsoft.compute/availabilitysets', 'Availability Sets',\r\ntype =~ 'microsoft.insights/components','Application Insights',\r\ntype =~ 'microsoft.desktopvirtualization/applicationgroups', 'WVD Application Groups',\r\ntype =~ 'microsoft.desktopvirtualization/workspaces', 'WVD Workspaces',\r\ntype =~ 'microsoft.desktopvirtualization/hostpools', 'WVD Hostpools',\r\nstrcat(\"Not Translated: \", type))\r\n| extend Details = pack_all()\r\n| project id, subscriptionId, type, location, resourceGroup, Details\r\n\r\n\r\n", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "linkIsContextBlade": false, "showIcon": true } }, { "columnMatch": "id", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkLabel": "šŸ” View Details", "linkIsContextBlade": true } }, { "columnMatch": "tenantId", "formatter": 5 } ], "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "id" } }, "tileSettings": { "titleContent": { "columnMatch": "type", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "tags" }, "name": "query - Tagged Resources - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Resources\r\n| where tags.Environment in~ ({Environment}) or '*' in~ ({Environment})\r\n| where tags.Application in~ ({Application}) or '*' in~ ({Application})\r\n| summarize count() by type", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "tabs" }, "name": "query - Tagged Resources Summary" }, { "type": 1, "content": { "json": "## NoShow - End Tagged Resources\r\n\r\n\r\n## NoShow - Begin Untagged Resources" }, "conditionalVisibility": { "parameterName": "noShow", "comparison": "isEqualTo", "value": "noShow" }, "name": "text - NoShow Begin Untagged Resources" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": ["{Subscriptions}"], "parameters": [ { "id": "2ca6744f-0d53-48a0-ad15-95f6dbe5aa9d", "version": "KqlParameterItem/1.0", "name": "ResourceType", "type": 7, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resources | where tags == ''\r\n| distinct type", "crossComponentResources": ["{Subscriptions}"], "value": ["value::all"], "typeSettings": { "additionalResourceOptions": ["value::1", "value::all"], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "notag" }, "name": "parameters - Untagged Resource Type" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources | where tags == ''\r\n| where type in~ ({ResourceType}) or '*' in~ ({ResourceType})\r\n| project Name=id, subscriptionId\r\n", "size": 3, "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": ["{Subscriptions}"], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "Name", "formatter": 5 }, { "columnMatch": "subscriptionId", "formatter": 5 } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": ["subscriptionId"], "expandTopLevel": true, "finalBy": "Name" } } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "notag" }, "name": "query - Untagged Resources" }, { "type": 1, "content": { "json": "## NoShow - End Untagged Resources\r\n\r\n\r\n## NoShow - Begin Cost" }, "conditionalVisibility": { "parameterName": "noShow", "comparison": "isEqualTo", "value": "noShow" }, "name": "text - NoShow Begin Cost" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ec175d28-6b26-43b8-b609-442d4a060709", "version": "KqlParameterItem/1.0", "name": "BillingAccount", "label": "Azure Billing Account", "type": 2, "isRequired": true, "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/providers/Microsoft.Billing/billingAccounts?\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2020-05-01\"}],\"batchDisabled\":true,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"$.id\",\"columnid\":\"id\"},{\"path\":\"$.properties.displayName\",\"columnid\":\"name\"}]}}]}", "value": "/providers/Microsoft.Billing/billingAccounts/adcf806d-f9b4-4357-8f5b-6ad8640bb001:a09a4496-a6fa-47c4-85f6-b9ebe6357f85_2019-05-31", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 12 }, { "id": "8756cae2-db95-442f-937d-e6d1c86e63ab", "version": "KqlParameterItem/1.0", "name": "Aggregation", "type": 2, "isRequired": true, "value": "ResourceType", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\": \"ResourceGroup\", \"label\": \"Resource Group\"},\r\n { \"value\": \"SubscriptionName\", \"label\": \"Subscription\", \"selected\":true },\r\n { \"value\": \"ResourceType\", \"label\": \"Resource Type\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "de00734d-a605-43bf-aa5a-707fd5f23a06", "version": "KqlParameterItem/1.0", "name": "TimeFrame", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\": \"BillingMonthToDate\", \"label\": \"Billing Month To Date\"},\r\n { \"value\": \"MonthToDate\", \"label\": \"Month To Date\", \"selected\":true },\r\n { \"value\": \"TheLastBillingMonth\", \"label\": \"Last Billing Month\"},\r\n { \"value\": \"TheLastMonth\", \"label\": \"Last Month\"},\r\n { \"value\": \"WeekToDate\", \"label\": \"Week To Date\"}\r\n]", "timeContext": { "durationMs": 86400000 } } ], "style": "formHorizontal", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "cost" }, "name": "Cost Parameters" }, { "type": 1, "content": { "json": "Note: \r\n>User viewing this workbook needs to have reader access on the billing account selected above to get data back. \r\n>Go to Cost Management + Billing and choose Access control (IAM) and add user account as reader.", "style": "info" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "cost" }, "name": "RoleInfo" }, { "type": 1, "content": { "json": "# Cost Overview" }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "cost" }, "name": "Cost" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":\" {\\r\\n \\\"type\\\": \\\"Usage\\\",\\r\\n \\\"timeframe\\\": \\\"{TimeFrame}\\\",\\r\\n \\\"dataset\\\": {\\r\\n \\\"granularity\\\": \\\"None\\\",\\r\\n \\\"aggregation\\\": {\\r\\n \\\"totalCost\\\": {\\r\\n \\\"name\\\": \\\"PreTaxCost\\\",\\r\\n \\\"function\\\": \\\"Sum\\\"\\r\\n }\\r\\n },\\r\\n \\\"grouping\\\": [\\r\\n {\\r\\n \\\"type\\\": \\\"Dimension\\\",\\r\\n \\\"name\\\": \\\"{Aggregation}\\\"\\r\\n }\\r\\n ]\\r\\n }\\r\\n }\",\"headers\":[],\"method\":\"POST\",\"path\":\"{BillingAccount}/providers/Microsoft.CostManagement/query?\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2019-11-01\"}],\"batchDisabled\":true,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties\",\"columns\":[]}}]}", "size": 3, "noDataMessage": "No data", "noDataMessageStyle": 4, "queryType": 12, "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "PreTaxCost", "formatter": 3, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "35%" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 0 }, "emptyValCustomText": "empty" } } ], "sortBy": [ { "itemKey": "$gen_bar_PreTaxCost_0", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_PreTaxCost_0", "sortOrder": 2 } ], "tileSettings": { "showBorder": false }, "mapSettings": { "locInfo": "LatLong" } }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "cost" }, "name": "BillingAccountQuery" } ], "fallbackResourceIds": ["Azure Monitor"], "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }