application insights query

Author: JohnDuprey

Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecAppInsightsQuery.ps1

@@ -0,0 +1,45 @@
+function Invoke-ExecAppInsightsQuery {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        CIPP.SuperAdmin.Read
+    #>
+    [CmdletBinding()]
+    param (
+        $Request,
+        $TriggerMetadata
+    )
+
+    $Query = $Request.Body.query
+    if (-not $Query) {
+        return [HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::BadRequest
+            Body       = @{
+                Error = 'No query provided in request body.'
+            }
+        }
+    }
+
+    try {
+    $LogData = Get-ApplicationInsightsQuery -Query $Query
+
+    return [HttpResponseContext]@{
+        StatusCode = [HttpStatusCode]::OK
+        Body       = @{
+            Results = @($LogData)
+        }
+        Metadata   = @{
+            Query = $Query
+        }
+    }
+
+    } catch {
+        return [HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::InternalServerError
+            Body       = @{
+                Error = "Failed to execute Application Insights query: $($_.Exception.Message)"
+            }
+        }
+    }
+}

Modules/CIPPCore/Public/Get-ApplicationInsightsQuery.ps1

@@ -0,0 +1,54 @@
+function Get-ApplicationInsightsQuery {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [string]$Query
+    )
+
+    if (!$env:APPLICATIONINSIGHTS_CONNECTION_STRING) {
+        throw 'Application Insights not enabled for this environment.'
+    }
+
+    if ($env:MSI_SECRET) {
+        Connect-AzAccount -Identity
+    }
+
+    $SubscriptionId = $env:WEBSITE_OWNER_NAME -split '\+' | Select-Object -First 1
+    if ($env:WEBSITE_SKU -ne 'FlexConsumption' -and $Owner -match '^(?<SubscriptionId>[^+]+)\+(?<RGName>[^-]+(?:-[^-]+)*?)(?:-[^-]+webspace(?:-Linux)?)?$') {
+        $RGName = $Matches.RGName
+    } else {
+        $RGName = $env:WEBSITE_RESOURCE_GROUP
+    }
+    $AppInsightsName = $env:WEBSITE_SITE_NAME
+
+    $Body = @{
+        'query'            = $Query
+        'options'          = @{'truncationMaxSize' = 67108864 }
+        'maxRows'          = 1001
+        'workspaceFilters' = @{'regions' = @() }
+    } | ConvertTo-Json -Depth 10 -Compress
+
+    $AppInsightsQuery = 'subscriptions/{0}/resourceGroups/{1}/providers/microsoft.insights/components/{2}/query' -f $SubscriptionId, $RGName, $AppInsightsName
+
+    $resource = 'https://api.loganalytics.io'
+    $Token = Get-AzAccessToken -ResourceUrl $resource
+
+    $headerParams = @{'Authorization' = "Bearer $($Token.Token)" }
+    $logAnalyticsBaseURI = 'https://api.loganalytics.io/v1'
+
+    $result = Invoke-RestMethod -Method POST -Uri "$($logAnalyticsBaseURI)/$AppInsightsQuery" -Headers $headerParams -Body $Body -ContentType 'application/json' -ErrorAction Stop
+
+    # Format Result to PSObject
+    $headerRow = $null
+    $headerRow = $result.tables.columns | Select-Object name
+    $columnsCount = $headerRow.Count
+    $logData = foreach ($row in $result.tables.rows) {
+        $data = New-Object PSObject
+        for ($i = 0; $i -lt $columnsCount; $i++) {
+            $data | Add-Member -MemberType NoteProperty -Name $headerRow[$i].name -Value $row[$i]
+        }
+        $data
+    }
+
+    return $logData
+}