KQL Search

This KQL (Kusto Query Language) script is designed to query various types of resources in Azure using the Azure Resource Graph. Here's a simple breakdown of what each section of the script does:

1. List All Resource Types: This query retrieves a distinct list of all resource types available in the Azure environment.

2. List Sentinel Workbooks: This query filters and lists all workbooks related to Microsoft Sentinel, displaying their names and associated resource groups.

3. List Virtual Machines: This query lists all virtual machines, showing details such as name, computer name, location, resource group, and VM size.

4. List Log Analytics Workspace Information: This query retrieves information about Log Analytics workspaces, including their name, location, resource group, retention period, SKU name, daily quota, and the next quota reset time.

5. List User Assigned Identities: This query lists user-assigned identities, displaying their name, resource group, client ID, and principal ID.

6. List Logic App (Playbook) Resources: This query lists Logic App resources, showing details like name, state, location, resource group, identity type, creation time, and last changed time.

7. List API Connections: This query lists API connections, providing information such as name, type, resource group, connection state, display name, authenticated user, and client ID.

8. List Query Packs: This query lists query packs, showing their name and resource group.

9. List All Azure Policy Types: This query retrieves a distinct list of all Azure Policy resource types.

10. List All Azure Security Resource Types: This query retrieves a distinct list of all Azure Security resource types.

11. List Active Resource Health Alerts: This query lists active resource health alerts, displaying details like event source, status, title, tracking ID, impact start time, and last update time.

12. List IOT Security Resource Types: This query retrieves a distinct list of all IoT Security resource types.

13. List IoT Devices: This query lists IoT devices, showing details such as device category, data source, name, and subtype.

14. List Roles: This query lists role definitions, displaying their description, role name, and type.

15. List Management Groups and Subscriptions: This query lists management groups and subscriptions, specifically targeting resources of type "microsoft.resources/subscriptions".

Each section of the script is designed to extract specific information from Azure resources, helping users manage and analyze their Azure environment effectively.