README.md

Resource Graph

• resources - tabela przechowująca informacje o obecnych zasobach
• resourcechanges - tabela przechowująca zmiany na zasobach (Get resource changes)

1. Liczebność zasobów według danego typu

Resources
| summarize resource_count=count() by tostring(resource_type=type)
| order by resource_count

Results

2. Największa liczba zmian w ciągu 1 minuty

resourcechanges 
| extend changeTime=format_datetime(todatetime(properties.changeAttributes.timestamp), 'yy-MM-dd HH:mm')
| summarize changes_count=count() by tostring(changeTime)
| order by changes_count

resourcechanges 
| extend changeTime=todatetime(properties.changeAttributes.timestamp)
| summarize event_count = count() by bin(changeTime, 1m)
| order by event_count

Results

3. Ilośc zasobów według lokalizacji

Resources
| summarize resource_count=count() by tostring(location)
| order by resource_count

Results

4. Lista adresów IP używanych przez VM

• Azure Resource Graph query to find all VMs with public IPs
• Print all VM names and private IP from subnet
• List virtual machines with their network interface and public IP

Resources
    | where type =~ 'microsoft.compute/virtualmachines'
    | project vmId = tolower(tostring(id)), vmName = name
    | join (Resources
        | where type =~ 'microsoft.network/networkinterfaces'
        | mv-expand ipconfig=properties.ipConfigurations
        | project vmId = tolower(tostring(properties.virtualMachine.id)), privateIp = ipconfig.properties.privateIPAddress, publicIpId = tostring(ipconfig.properties.publicIPAddress.id)
        | join kind=leftouter (Resources
            | where type =~ 'microsoft.network/publicipaddresses'
            | project publicIpId = id, publicIp = properties.ipAddress
        ) on publicIpId
        | project-away publicIpId, publicIpId1
        | summarize privateIps = make_list(privateIp), publicIps = make_list(publicIp) by vmId
    ) on vmId
    | project-away vmId1
    | sort by vmName asc
| where array_length(publicIps)>0

Results

5. Ilość zmian w ciągu dnia

resourcechanges 
| extend hour = floor(todatetime(properties.changeAttributes.timestamp) % 1d , 1h)
| summarize event_count=count() by hour
| sort by hour asc
//| render timechart
//| render columnchart

Results

6. VM private IP

Resources
| where type =~ 'microsoft.compute/virtualmachines'
| extend nics=array_length(properties.networkProfile.networkInterfaces)
| mv-expand nic=properties.networkProfile.networkInterfaces
| where nics == 1 or nic.properties.primary =~ 'true' or isempty(nic)
| project vmId = id, vmName = name, vmSize=tostring(properties.hardwareProfile.vmSize), nicId = tostring(nic.id)
| join kind=leftouter (
    Resources
    | where type =~ 'microsoft.network/networkinterfaces'
    | extend ipConfigsCount=array_length(properties.ipConfigurations)
    | mv-expand ipconfig=properties.ipConfigurations
    | where ipConfigsCount == 1 or ipconfig.properties.primary =~ 'true'
    | project nicId = id, privateIPAddress = tostring(ipconfig.properties.privateIPAddress))
on nicId