DevOps - Azure DevOps Inventory

ExposureGraphNodes | where NodeLabel == @"azuredevopsrepository" | extend Subscription = parse_json(EntityIds)[0]["id"] | extend URL = parse_json(EntityIds)[1]["id"] | parse Subscription with "/subscriptions/" subscription_id "/resourcegroups/" resource_group "/providers/microsoft.security/securityconnectors/" * "/devops/default/azuredevopsorgs/" azure_devops_org "/projects/" project_name "/repos/" repo_name | project NodeName, Subscription, URL,subscription_id, resource_group, azure_devops_org, project_name, repo_name

Explanation

This KQL (Kusto Query Language) query is designed to identify and extract information about Azure DevOps projects and repositories from a dataset called ExposureGraphNodes. Here's a simple breakdown of what the query does:

Filter Nodes: It starts by filtering the data to only include nodes labeled as "azuredevopsrepository".
Extract Information: The query then extracts specific details from a JSON field called EntityIds. It pulls out the subscription ID and URL from this JSON data.
Parse Subscription Details: It further parses the Subscription field to break down the subscription path into more granular components:
- subscription_id: The unique identifier for the Azure subscription.
- resource_group: The resource group within the subscription.
- azure_devops_org: The Azure DevOps organization.
- project_name: The name of the project within the organization.
- repo_name: The name of the repository within the project.
Select and Display: Finally, it selects and displays a set of columns: NodeName, Subscription, URL, subscription_id, resource_group, azure_devops_org, project_name, and repo_name.

In summary, this query is used to list Azure DevOps projects and repositories, along with their associated details like subscription ID, resource group, organization, project name, and repository name.

KQL Search