Skip to content

Commit a010a59

Browse files
AnnaMHuffAnnaMHuff
authored
Merge pull request #277784 from davidsmatlak/ds-move-arg-defender-cloud
Moves Defender for cloud include file for ARG sample
2 parents 40928da + 9a11f89 commit a010a59

File tree

2 files changed

+93
-96
lines changed

2 files changed

+93
-96
lines changed

‎includes/resource-graph/samples/bycat/microsoft-defender.md renamed to ‎articles/defender-for-cloud/includes/microsoft-defender.md

Lines changed: 91 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,9 @@
11
---
2-
author: davidsmatlak
3-
ms.service: resource-graph
2+
ms.service: defender-for-cloud
43
ms.topic: include
54
ms.date: 02/14/2023
6-
ms.author: davidsmatlak
7-
ms.custom: generated
5+
author: dcurwin
6+
ms.author: dacurwin
87
---
98
### Display all active Microsoft Defender for Cloud alerts
109

@@ -48,16 +47,16 @@ Returns controls secure score per subscription.
4847
SecurityResources
4948
| where type == 'microsoft.security/securescores/securescorecontrols'
5049
| extend controlName=properties.displayName,
51-
controlId=properties.definition.name,
52-
notApplicableResourceCount=properties.notApplicableResourceCount,
53-
unhealthyResourceCount=properties.unhealthyResourceCount,
54-
healthyResourceCount=properties.healthyResourceCount,
55-
percentageScore=properties.score.percentage,
56-
currentScore=properties.score.current,
57-
maxScore=properties.definition.properties.maxScore,
58-
weight=properties.weight,
59-
controlType=properties.definition.properties.source.sourceType,
60-
controlRecommendationIds=properties.definition.properties.assessmentDefinitions
50+
controlId=properties.definition.name,
51+
notApplicableResourceCount=properties.notApplicableResourceCount,
52+
unhealthyResourceCount=properties.unhealthyResourceCount,
53+
healthyResourceCount=properties.healthyResourceCount,
54+
percentageScore=properties.score.percentage,
55+
currentScore=properties.score.current,
56+
maxScore=properties.definition.properties.maxScore,
57+
weight=properties.weight,
58+
controlType=properties.definition.properties.source.sourceType,
59+
controlRecommendationIds=properties.definition.properties.assessmentDefinitions
6160
| project tenantId, subscriptionId, controlName, controlId, unhealthyResourceCount, healthyResourceCount, notApplicableResourceCount, percentageScore, currentScore, maxScore, weight, controlType, controlRecommendationIds
6261
```
6362

@@ -91,21 +90,21 @@ Returns count of healthy, unhealthy, and not applicable resources per recommenda
9190
SecurityResources
9291
| where type == 'microsoft.security/assessments'
9392
| extend resourceId=id,
94-
recommendationId=name,
95-
resourceType=type,
96-
recommendationName=properties.displayName,
97-
source=properties.resourceDetails.Source,
98-
recommendationState=properties.status.code,
99-
description=properties.metadata.description,
100-
assessmentType=properties.metadata.assessmentType,
101-
remediationDescription=properties.metadata.remediationDescription,
102-
policyDefinitionId=properties.metadata.policyDefinitionId,
103-
implementationEffort=properties.metadata.implementationEffort,
104-
recommendationSeverity=properties.metadata.severity,
105-
category=properties.metadata.categories,
106-
userImpact=properties.metadata.userImpact,
107-
threats=properties.metadata.threats,
108-
portalLink=properties.links.azurePortal
93+
recommendationId=name,
94+
resourceType=type,
95+
recommendationName=properties.displayName,
96+
source=properties.resourceDetails.Source,
97+
recommendationState=properties.status.code,
98+
description=properties.metadata.description,
99+
assessmentType=properties.metadata.assessmentType,
100+
remediationDescription=properties.metadata.remediationDescription,
101+
policyDefinitionId=properties.metadata.policyDefinitionId,
102+
implementationEffort=properties.metadata.implementationEffort,
103+
recommendationSeverity=properties.metadata.severity,
104+
category=properties.metadata.categories,
105+
userImpact=properties.metadata.userImpact,
106+
threats=properties.metadata.threats,
107+
portalLink=properties.links.azurePortal
109108
| summarize numberOfResources=count(resourceId) by tostring(recommendationName), tostring(recommendationState)
110109
```
111110

@@ -228,31 +227,31 @@ Search-AzGraph -Query "SecurityResources | where type =~ 'microsoft.security/iot
228227

229228
### List Container Registry vulnerability assessment results
230229

231-
Returns all the all the vulnerabilities found on container images. Microsoft Defender for Containers has to be enabled in order to view these security findings.
230+
Returns all the vulnerabilities found on container images. Microsoft Defender for Containers has to be enabled in order to view these security findings.
232231

233232
```kusto
234233
SecurityResources
235234
| where type == 'microsoft.security/assessments'
236235
| where properties.displayName contains 'Container registry images should have vulnerability findings resolved'
237236
| summarize by assessmentKey=name //the ID of the assessment
238237
| join kind=inner (
239-
securityresources
240-
| where type == 'microsoft.security/assessments/subassessments'
241-
| extend assessmentKey = extract('.*assessments/(.+?)/.*',1, id)
238+
securityresources
239+
| where type == 'microsoft.security/assessments/subassessments'
240+
| extend assessmentKey = extract('.*assessments/(.+?)/.*',1, id)
242241
) on assessmentKey
243242
| project assessmentKey, subassessmentKey=name, id, parse_json(properties), resourceGroup, subscriptionId, tenantId
244243
| extend description = properties.description,
245-
displayName = properties.displayName,
246-
resourceId = properties.resourceDetails.id,
247-
resourceSource = properties.resourceDetails.source,
248-
category = properties.category,
249-
severity = properties.status.severity,
250-
code = properties.status.code,
251-
timeGenerated = properties.timeGenerated,
252-
remediation = properties.remediation,
253-
impact = properties.impact,
254-
vulnId = properties.id,
255-
additionalData = properties.additionalData
244+
displayName = properties.displayName,
245+
resourceId = properties.resourceDetails.id,
246+
resourceSource = properties.resourceDetails.source,
247+
category = properties.category,
248+
severity = properties.status.severity,
249+
code = properties.status.code,
250+
timeGenerated = properties.timeGenerated,
251+
remediation = properties.remediation,
252+
impact = properties.impact,
253+
vulnId = properties.id,
254+
additionalData = properties.additionalData
256255
```
257256

258257
# [Azure CLI](#tab/azure-cli)
@@ -285,20 +284,20 @@ Returns all Microsoft Defender assessments, organized in tabular manner with fie
285284
SecurityResources
286285
| where type == 'microsoft.security/assessments'
287286
| extend resourceId=id,
288-
recommendationId=name,
289-
recommendationName=properties.displayName,
290-
source=properties.resourceDetails.Source,
291-
recommendationState=properties.status.code,
292-
description=properties.metadata.description,
293-
assessmentType=properties.metadata.assessmentType,
294-
remediationDescription=properties.metadata.remediationDescription,
295-
policyDefinitionId=properties.metadata.policyDefinitionId,
296-
implementationEffort=properties.metadata.implementationEffort,
297-
recommendationSeverity=properties.metadata.severity,
298-
category=properties.metadata.categories,
299-
userImpact=properties.metadata.userImpact,
300-
threats=properties.metadata.threats,
301-
portalLink=properties.links.azurePortal
287+
recommendationId=name,
288+
recommendationName=properties.displayName,
289+
source=properties.resourceDetails.Source,
290+
recommendationState=properties.status.code,
291+
description=properties.metadata.description,
292+
assessmentType=properties.metadata.assessmentType,
293+
remediationDescription=properties.metadata.remediationDescription,
294+
policyDefinitionId=properties.metadata.policyDefinitionId,
295+
implementationEffort=properties.metadata.implementationEffort,
296+
recommendationSeverity=properties.metadata.severity,
297+
category=properties.metadata.categories,
298+
userImpact=properties.metadata.userImpact,
299+
threats=properties.metadata.threats,
300+
portalLink=properties.links.azurePortal
302301
| project tenantId, subscriptionId, resourceId, recommendationName, recommendationId, recommendationState, recommendationSeverity, description, remediationDescription, assessmentType, policyDefinitionId, implementationEffort, userImpact, category, threats, source, portalLink
303302
```
304303

@@ -334,23 +333,23 @@ SecurityResources
334333
| where * contains 'vulnerabilities in your virtual machines'
335334
| summarize by assessmentKey=name //the ID of the assessment
336335
| join kind=inner (
337-
securityresources
338-
| where type == 'microsoft.security/assessments/subassessments'
339-
| extend assessmentKey = extract('.*assessments/(.+?)/.*',1, id)
336+
securityresources
337+
| where type == 'microsoft.security/assessments/subassessments'
338+
| extend assessmentKey = extract('.*assessments/(.+?)/.*',1, id)
340339
) on assessmentKey
341340
| project assessmentKey, subassessmentKey=name, id, parse_json(properties), resourceGroup, subscriptionId, tenantId
342341
| extend description = properties.description,
343-
displayName = properties.displayName,
344-
resourceId = properties.resourceDetails.id,
345-
resourceSource = properties.resourceDetails.source,
346-
category = properties.category,
347-
severity = properties.status.severity,
348-
code = properties.status.code,
349-
timeGenerated = properties.timeGenerated,
350-
remediation = properties.remediation,
351-
impact = properties.impact,
352-
vulnId = properties.id,
353-
additionalData = properties.additionalData
342+
displayName = properties.displayName,
343+
resourceId = properties.resourceDetails.id,
344+
resourceSource = properties.resourceDetails.source,
345+
category = properties.category,
346+
severity = properties.status.severity,
347+
code = properties.status.code,
348+
timeGenerated = properties.timeGenerated,
349+
remediation = properties.remediation,
350+
impact = properties.impact,
351+
vulnId = properties.id,
352+
additionalData = properties.additionalData
354353
```
355354

356355
# [Azure CLI](#tab/azure-cli)
@@ -383,12 +382,12 @@ Returns regulatory compliance assessments state per compliance standard and cont
383382
SecurityResources
384383
| where type == 'microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments'
385384
| extend assessmentName=properties.description,
386-
complianceStandard=extract(@'/regulatoryComplianceStandards/(.+)/regulatoryComplianceControls',1,id),
387-
complianceControl=extract(@'/regulatoryComplianceControls/(.+)/regulatoryComplianceAssessments',1,id),
388-
skippedResources=properties.skippedResources,
389-
passedResources=properties.passedResources,
390-
failedResources=properties.failedResources,
391-
state=properties.state
385+
complianceStandard=extract(@'/regulatoryComplianceStandards/(.+)/regulatoryComplianceControls',1,id),
386+
complianceControl=extract(@'/regulatoryComplianceControls/(.+)/regulatoryComplianceAssessments',1,id),
387+
skippedResources=properties.skippedResources,
388+
passedResources=properties.passedResources,
389+
failedResources=properties.failedResources,
390+
state=properties.state
392391
| project tenantId, subscriptionId, id, complianceStandard, complianceControl, assessmentName, state, skippedResources, passedResources, failedResources
393392
```
394393

@@ -422,11 +421,11 @@ Returns regulatory compliance state per compliance standard per subscription.
422421
SecurityResources
423422
| where type == 'microsoft.security/regulatorycompliancestandards'
424423
| extend complianceStandard=name,
425-
state=properties.state,
426-
passedControls=properties.passedControls,
427-
failedControls=properties.failedControls,
428-
skippedControls=properties.skippedControls,
429-
unsupportedControls=properties.unsupportedControls
424+
state=properties.state,
425+
passedControls=properties.passedControls,
426+
failedControls=properties.failedControls,
427+
skippedControls=properties.skippedControls,
428+
unsupportedControls=properties.unsupportedControls
430429
| project tenantId, subscriptionId, complianceStandard, state, passedControls, failedControls, skippedControls, unsupportedControls
431430
```
432431

@@ -460,13 +459,13 @@ Returns secure score per management group.
460459
SecurityResources
461460
| where type == 'microsoft.security/securescores'
462461
| project subscriptionId,
463-
subscriptionTotal = iff(properties.score.max == 0, 0.00, round(tolong(properties.weight) * todouble(properties.score.current)/tolong(properties.score.max),2)),
464-
weight = tolong(iff(properties.weight == 0, 1, properties.weight))
462+
subscriptionTotal = iff(properties.score.max == 0, 0.00, round(tolong(properties.weight) * todouble(properties.score.current)/tolong(properties.score.max),2)),
463+
weight = tolong(iff(properties.weight == 0, 1, properties.weight))
465464
| join kind=leftouter (
466-
ResourceContainers
467-
| where type == 'microsoft.resources/subscriptions' and properties.state == 'Enabled'
468-
| project subscriptionId, mgChain=properties.managementGroupAncestorsChain )
469-
on subscriptionId
465+
ResourceContainers
466+
| where type == 'microsoft.resources/subscriptions' and properties.state == 'Enabled'
467+
| project subscriptionId, mgChain=properties.managementGroupAncestorsChain )
468+
on subscriptionId
470469
| mv-expand mg=mgChain
471470
| summarize sumSubs = sum(subscriptionTotal), sumWeight = sum(weight), resultsNum = count() by tostring(mg.displayName), mgId = tostring(mg.name)
472471
| extend secureScore = iff(tolong(resultsNum) == 0, 404.00, round(sumSubs/sumWeight*100,2))
@@ -504,9 +503,9 @@ Returns secure score per subscription.
504503
SecurityResources
505504
| where type == 'microsoft.security/securescores'
506505
| extend percentageScore=properties.score.percentage,
507-
currentScore=properties.score.current,
508-
maxScore=properties.score.max,
509-
weight=properties.weight
506+
currentScore=properties.score.current,
507+
maxScore=properties.score.max,
508+
weight=properties.weight
510509
| project tenantId, subscriptionId, percentageScore, currentScore, maxScore, weight
511510
```
512511

‎articles/defender-for-cloud/resource-graph-samples.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,13 @@ ms.custom: subject-resourcegraph-sample, devx-track-azurepowershell, devx-track-
88

99
# Azure Resource Graph sample queries for Microsoft Defender for Cloud
1010

11-
This page is a collection of [Azure Resource Graph](../governance/resource-graph/overview.md) sample queries for Microsoft Defender for Cloud. For a complete list of Azure Resource Graph samples, see [Resource Graph samples by Category](../governance/resource-graph/samples/samples-by-category.md) and [Resource Graph samples by Table](../governance/resource-graph/samples/samples-by-table.md).
11+
This page is a collection of [Azure Resource Graph](../governance/resource-graph/overview.md) sample queries for Microsoft Defender for Cloud.
1212

1313
## Sample queries
1414

15-
[!INCLUDE [azure-resource-graph-samples-cat-securitycenter](../../includes/resource-graph/samples/bycat/microsoft-defender.md)]
15+
[!INCLUDE [azure-resource-graph-samples-cat-securitycenter](./includes/microsoft-defender.md)]
1616

1717
## Next steps
1818

1919
- Learn more about the [query language](../governance/resource-graph/concepts/query-language.md).
2020
- Learn more about how to [explore resources](../governance/resource-graph/concepts/explore-resources.md).
21-
- See samples of [Starter language queries](../governance/resource-graph/samples/starter.md).
22-
- See samples of [Advanced language queries](../governance/resource-graph/samples/advanced.md).

0 commit comments

Comments
 (0)