KQL Search

// Alternatively use here: https://portal.azure.com/#view/HubsExtension/ArgQueryBlade
arg("").SecurityResources
| where type =~ "microsoft.security/assessments/subassessments"
| where properties has "SqlVirtualMachineVulnerability" or properties has "SqlServerVulnerability"// or id has "f97aa83c-9b63-4f9a-99f6-b22c4398f936" or id has "82e20e14-edc5-4373-bfc4-f13121257c37"
| extend
    resourceId = tostring(properties["resourceDetails"]["id"]),
    displayName = tostring(properties["displayName"]),
    description = tostring(properties["description"]),
    assessedResourceType = tostring(properties["additionalData"]["assessedResourceType"]),
    type =  tostring(properties["additionalData"]["type"]),
    severity = tostring(properties["status"]["severity"]),
    code = tostring(properties["status"]["code"]),
    category = tostring(properties["category"]),
    impact = tostring(properties["impact"]),
    remediation = tostring(properties["remediation"]),
    id = tostring(properties["id"]),
    scanId = tostring(properties["additionalData"]["scanId"])
| where not(code == "Healthy")
| join hint.remote=local kind=leftouter (
    arg("").ResourceContainers
    | where type == "microsoft.resources/subscriptions"
    | project subscriptionId, subscriptionName = name
    ) on subscriptionId
| sort by assessedResourceType asc, code asc, tenantId asc, subscriptionName asc, resourceId asc, category asc, id asc
| project
    subscriptionName,
    resourceGroup,
    resourceId,
    type,
    assessedResourceType,
    code,
    category,
    displayName,
    description,
    severity,
    remediation,
    impact,
    id,
    scanId