KQL Search

Query Details

Function: AzureTagSearch()

Azure Tag Search

Query

let AzureTagSearch = (SearchTag: string) {
    arg("").Resources
    | extend StringTags = tolower(tostring(tags))
    | extend SearchTagToLower = SearchTag
    | where StringTags has SearchTagToLower
    | project tags, type, name, kind, resourceGroup
};
AzureTagSearch("Test")

About this query

Function: AzureTagSearch()

Query Information

Description

This function returns all resources based on the SearchTag variable that has been used as input. Note that only the resources that your account has access to are returned.

References

Log Analytics (Sentinel)

Explanation

The query is a function called AzureTagSearch that takes a SearchTag as input. It returns all resources that have a tag matching the SearchTag. The function uses the arg("") function to get all resources, then converts the tags to lowercase and compares them to the lowercase SearchTag. The query returns the tags, type, name, kind, and resource group of the matching resources. In this example, the SearchTag used is "Test".

Details

Bert-Jan Pals profile picture

Bert-Jan Pals

Released: September 21, 2023

Tables

arg("").Resources

Keywords

DevicesIntuneUser

Operators

argResourcesextendtolowertostringwherehasproject

Actions

GitHub