Azure Resource Graph
Query
arg("").servicehealthresources
| extend EventSource = tostring(properties.EventSource)
| extend Status = tostring(parse_json(tostring(parse_json(tostring(properties.Impact))[0].ImpactedRegions))[0].Status)
| extend Title = tostring(properties.Title)
| extend TrackingId = tostring(properties.TrackingId)
| extend ImpactStartTime_ = todatetime(tostring(properties.ImpactStartTime))
| extend LastUpdateTime = todatetime(tostring(properties.LastUpdateTime))
| where Status == "Active"About this query
Explanation
This KQL (Kusto Query Language) script is designed to query various types of resources in Azure using the Azure Resource Graph. Here's a simple breakdown of what each section of the script does:
-
List All Resource Types: This query retrieves a distinct list of all resource types available in the Azure environment.
-
List Sentinel Workbooks: This query filters and lists all workbooks related to Microsoft Sentinel, displaying their names and associated resource groups.
-
List Virtual Machines: This query lists all virtual machines, showing details such as name, computer name, location, resource group, and VM size.
-
List Log Analytics Workspace Information: This query retrieves information about Log Analytics workspaces, including their name, location, resource group, retention period, SKU name, daily quota, and the next quota reset time.
-
List User Assigned Identities: This query lists user-assigned identities, displaying their name, resource group, client ID, and principal ID.
-
List Logic App (Playbook) Resources: This query lists Logic App resources, showing details like name, state, location, resource group, identity type, creation time, and last changed time.
-
List API Connections: This query lists API connections, providing information such as name, type, resource group, connection state, display name, authenticated user, and client ID.
-
List Query Packs: This query lists query packs, showing their name and resource group.
-
List All Azure Policy Types: This query retrieves a distinct list of all Azure Policy resource types.
-
List All Azure Security Resource Types: This query retrieves a distinct list of all Azure Security resource types.
-
List Active Resource Health Alerts: This query lists active resource health alerts, displaying details like event source, status, title, tracking ID, impact start time, and last update time.
-
List IOT Security Resource Types: This query retrieves a distinct list of all IoT Security resource types.
-
List IoT Devices: This query lists IoT devices, showing details such as device category, data source, name, and subtype.
-
List Roles: This query lists role definitions, displaying their description, role name, and type.
-
List Management Groups and Subscriptions: This query lists management groups and subscriptions, specifically targeting resources of type "microsoft.resources/subscriptions".
Each section of the script is designed to extract specific information from Azure resources, helping users manage and analyze their Azure environment effectively.
Details
Alex Verboon
Released: April 16, 2026
Tables
Keywords
Operators