diff --git a/docs/content/services/compute/virtual-machines/_index.md b/docs/content/services/compute/virtual-machines/_index.md index 3e36b1bcf..7673126e0 100644 --- a/docs/content/services/compute/virtual-machines/_index.md +++ b/docs/content/services/compute/virtual-machines/_index.md @@ -495,6 +495,7 @@ VM insights monitors the performance and health of your virtual machines and vir **Resources** - [Overview of VM insights](https://learn.microsoft.com/azure/azure-monitor/vm/vminsights-overview) +- [Did the extension install properly?](https://learn.microsoft.com/en-us/azure/azure-monitor/vm/vminsights-troubleshoot#did-the-extension-install-properly) **Resource Graph Query/Scripts** diff --git a/docs/content/services/compute/virtual-machines/code/vm-19/vm-19.kql b/docs/content/services/compute/virtual-machines/code/vm-19/vm-19.kql index 5e039f9a0..5d52ddc53 100644 --- a/docs/content/services/compute/virtual-machines/code/vm-19/vm-19.kql +++ b/docs/content/services/compute/virtual-machines/code/vm-19/vm-19.kql @@ -1,2 +1,7 @@ // Azure Resource Graph Query -// Under development +// Find all disks that are not encrypted +Resources +| where type == "microsoft.compute/disks" +| project recommendationId="vm-19", diskName=name, id, encryptionType=properties.encryption.type, diskState=properties.diskState +| where encryptionType !in ("EncryptionAtRestWithCustomerKey", "EncryptionAtRestWithPlatformAndCustomerKeys", "EncryptionAtRestWithPlatformKey") +| order by diskName asc diff --git a/docs/content/services/compute/virtual-machines/code/vm-20/vm-20.kql b/docs/content/services/compute/virtual-machines/code/vm-20/vm-20.kql index c6fec4b4d..580a73593 100644 --- a/docs/content/services/compute/virtual-machines/code/vm-20/vm-20.kql +++ b/docs/content/services/compute/virtual-machines/code/vm-20/vm-20.kql @@ -1 +1,18 @@ -under development +// Azure Resource Graph Query +// Find all VMs that do not have the VM Insights extension installed +Resources +| where type == 'microsoft.compute/virtualmachines' +| extend + JoinID = toupper(id), + vmName = name, + OSType = tostring(properties.storageProfile.osDisk.osType) +| join kind=leftouter( + Resources + | where type == 'microsoft.compute/virtualmachines/extensions' + | extend + VMId = toupper(substring(id, 0, indexof(id, '/extensions'))), + ExtensionName = name +) on $left.JoinID == $right.VMId +| where ExtensionName !contains "MicrosoftMonitoringAgent" and ExtensionName !contains "Microsoft.Azure.Monitoring.DependencyAgent" and ExtensionName !contains "OMSAgentForLinux" and ExtensionName !contains "DependencyAgentLinux" +| summarize Extensions = make_list(ExtensionName) by recommendationId="vm-20", vmName, id, OSType +| order by tolower(vmName) asc diff --git a/docs/content/services/networking/load-balancer/code/lb-2/lb-2.kql b/docs/content/services/networking/load-balancer/code/lb-2/lb-2.kql index 540f683a2..cba2115d2 100644 --- a/docs/content/services/networking/load-balancer/code/lb-2/lb-2.kql +++ b/docs/content/services/networking/load-balancer/code/lb-2/lb-2.kql @@ -1,4 +1,16 @@ +// Azure Resource Graph Query +// Find all LoadBalancers which only have 1 backend pool defined Resources | where type =~ 'Microsoft.Network/loadBalancers' -| summarize count() by resourceGroup -| where count_ <= 1 +| extend bep = properties.backendAddressPools +| extend BackEndPools = array_length(bep) +| where BackEndPools == 0 +| project recommendationId = "lb-2", name, id, BackEndPools, BackendAddresses=0 +| union (Resources +| where type =~ 'Microsoft.Network/loadBalancers' +| extend bep = properties.backendAddressPools +| extend BackEndPools = array_length(bep) +| mv-expand bip = properties.backendAddressPools +| extend BackendAddresses = array_length(bip.properties.loadBalancerBackendAddresses) +| where BackendAddresses <= 1 +| project recommendationId = "lb-2", name, id, BackEndPools, BackendAddresses) diff --git a/docs/content/services/storage/storage-Account/_index.md b/docs/content/services/storage/storage-Account/_index.md index a077eb01c..a794ac424 100644 --- a/docs/content/services/storage/storage-Account/_index.md +++ b/docs/content/services/storage/storage-Account/_index.md @@ -23,6 +23,7 @@ The below table shows the list of resiliency recommendations for Storage Account |[ST-5 - Enable soft delete for recovery of data](#st-5---enable-soft-delete-for-recovery-of-data) | Medium | Preview | No | |[ST-6 - Enable version for accidental modification](#st-6---enable-version-for-accidental-modification) | Medium | Preview | No | |[ST-7 - Enable point and time restore for containers for recovery](#st-7---enable-point-and-time-restore-for-containers-for-recovery) | Low | Preview | No | +|[ST-8 - Keep fewer than 1000 versions per blob](#st-8---keep-fewer-than-1000-versions-per-blob) | Low | Preview | No | |[ST-9 - Configure Diagnostic Settings for all Azure Resources](#st-9---configure-diagnostic-settings-for-all-azure-resources) | Low | Preview | No | {{< /table >}} @@ -197,7 +198,7 @@ Point and time restore support general purpose v2 account in standard performanc

- +### ST-8 - Keep fewer than 1000 versions per blob **Impact: Low** diff --git a/docs/content/services/storage/storage-Account/code/st-2/st-2.kql b/docs/content/services/storage/storage-Account/code/st-2/st-2.kql index 803f045d8..692ea31bd 100644 --- a/docs/content/services/storage/storage-Account/code/st-2/st-2.kql +++ b/docs/content/services/storage/storage-Account/code/st-2/st-2.kql @@ -1,3 +1,5 @@ -"resources +// Azure Resource Graph Query +// Find all Azure classic Storage Account +resources | where type =~ 'microsoft.classicstorage/storageaccounts' -| project recommendationId = 'st-2', name, id, type" +| project recommendationId = 'st-2', name, id, type diff --git a/docs/content/services/storage/storage-Account/code/st-3/st-3.kql b/docs/content/services/storage/storage-Account/code/st-3/st-3.kql index 866189472..102063f11 100644 --- a/docs/content/services/storage/storage-Account/code/st-3/st-3.kql +++ b/docs/content/services/storage/storage-Account/code/st-3/st-3.kql @@ -1,3 +1,6 @@ -Resources | where type =~'microsoft.storage/storageaccounts' +// Azure Resource Graph Query +// Find all Azure Storage Accounts, that do not have an access tier set +Resources +| where type =~'microsoft.storage/storageaccounts' | where isnull(properties.accessTier) -| project recommendationId = 'st-3', name, id, accessTier="not defined - GeneralPurpose V1 +| project recommendationId = 'st-3', name, id, accessTier="not defined - GeneralPurpose V1"