added graph query to D01.03 DDOS Protection '143b16c3-1d7a-4a9b-9470-4489a8042d88'#924
added graph query to D01.03 DDOS Protection '143b16c3-1d7a-4a9b-9470-4489a8042d88'#924jodyford-msft wants to merge 2 commits intoAzure:mainfrom
Conversation
jodyford-msft
requested review from
a team,
erjosito and
sdolgin
as code owners
|
@jodyford-msft There is no description of the change - the title says that it is creating queries for DDoS Protection, but it looks like it is creating Key Vault queries and added to the DDoS protection recommendations. I think there may be a mix up for this PR. |
|
corrected. sorry. clipped the wrong query |
|
@jodyford-msft Doing a quick test of the query, and it looks like it doesn't resolve for me: I changed the query to: (by adding a | before the last project), and it showed, but it didn't correctly evaluate as I expected. I would expect it to show me non-compliant resources at least. I took out So, I think we either need to change that to |
| "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", | ||
| "id": "D01.03", | ||
| "severity": "High", | ||
| "graph": "resources | where type =~ 'microsoft.network/publicIPAddresses' | extend properties = parse_json(properties) | project id, name, location, ddosProtectionPlan = properties.ddosSettings.protectionPlan | extend compliant = iff(isnotempty(ddosProtectionPlan), 1, 0) | where compliant == 1 project id, compliant", |
There was a problem hiding this comment.
- I believe that there is a
|missing aftercompliant == 1right? - But more importantly, could you please remove the
where compliant == 1altogether? Otherwise the non-compliant resources don't show up.
| "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", | ||
| "service": "VNet", | ||
| "severity": "High", | ||
| "graph": "resources | where type =~ 'microsoft.network/publicIPAddresses' | extend properties = parse_json(properties) | project id, name, location, ddosProtectionPlan = properties.ddosSettings.protectionPlan | extend compliant = iff(isnotempty(ddosProtectionPlan), 1, 0) | where compliant == 1 project id, compliant", |
There was a problem hiding this comment.
- I believe that there is a
|missing aftercompliant == 1right? - But more importantly, could you please remove the
where compliant == 1altogether? Otherwise the non-compliant resources don't show up.
3 participants
Description
Please provide a detailed description of your changes.
Related Issue
Link to any related issues or discussions here. This helps reviewers understand the context and the need for your changes.
Checklist
Additional Information
Is there any additional context, screenshots, or considerations that might help in the review process? Please include them here.
Reviewer Notes
Is there a specific area you’d like feedback on? Please highlight it here. We're here to help and learn together! 💡
Footnotes
Details on how to add Azure Resource Graph queries to recommendations can be found here. ↩