This repository has been archived by the owner on May 7, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 133
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
US 32392 Fix Queries for AFD 1 AFD 10 and AFD 11 (#319)
Co-authored-by: Robert Lightner <[email protected]> Co-authored-by: Zach Trocinski <[email protected]>
- Loading branch information
3 people
authored
Apr 4, 2024
1 parent
9433d87
commit 7dbd12b
Showing
6 changed files
with
93 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
31 changes: 30 additions & 1 deletion
31
docs/content/services/networking/front-door/code/afd-1/afd-1.kql
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1,30 @@ | ||
| // under-development | ||
| // Azure Resource Graph Query | ||
| // Avoid combining Traffic Manager and Front Door | ||
| resources | ||
| | where type == "microsoft.network/trafficmanagerprofiles" | ||
| | mvexpand(properties.endpoints) | ||
| | extend endpoint=tostring(properties_endpoints.properties.target) | ||
| | project name, trafficmanager=id, matchname=endpoint, tags | ||
| | join ( | ||
| resources | ||
| | where type =~ "microsoft.cdn/profiles/afdendpoints" | ||
| | extend matchname= tostring(properties.hostName) | ||
| | extend splitid=split(id, "/") | ||
| | extend frontdoorid=tolower(strcat_array(array_slice(splitid, 0, 8), "/")) | ||
| | project name, id, matchname, frontdoorid, type | ||
| | union | ||
| (cdnresources | ||
| | where type =~ "Microsoft.Cdn/Profiles/CustomDomains" | ||
| | extend matchname= tostring(properties.hostName) | ||
| | extend splitid=split(id, "/") | ||
| | extend frontdoorid=tolower(strcat_array(array_slice(splitid, 0, 8), "/")) | ||
| | project name, id, matchname, frontdoorid, type) | ||
| ) | ||
| on matchname | ||
| | project | ||
| recommendationId = "afd-1", | ||
| name=split(trafficmanager, "/")[-1], | ||
| id=trafficmanager, | ||
| tags, | ||
| param1=strcat("hostname:", matchname), | ||
| param2=strcat("frontdoorid:", frontdoorid) |
3 changes: 0 additions & 3 deletions
3
docs/content/services/networking/front-door/code/afd-1/afd-1.kql.fix
This file was deleted.
Oops, something went wrong.
39 changes: 39 additions & 0 deletions
39
docs/content/services/networking/front-door/code/afd-10/afd-10.kql
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1,40 @@ | ||
| // under-development | ||
| // Azure Resource Graph Query | ||
| // AFD-10 - Enable the WAF | ||
|
|
||
| resources | ||
| | where type =~ "microsoft.cdn/profiles" and sku has "AzureFrontDoor" | ||
| | project name, cdnprofileid=tolower(id), tostring(tags), resourceGroup, subscriptionId,skuname=tostring(sku.name) | ||
| | join kind= fullouter ( | ||
| cdnresources | ||
| | where type == "microsoft.cdn/profiles/securitypolicies" | ||
| | extend wafpolicyid=tostring(properties['parameters']['wafPolicy']['id']) | ||
| | extend splitid=split(id, "/") | ||
| | extend cdnprofileid=tolower(strcat_array(array_slice(splitid, 0, 8), "/")) | ||
| | project secpolname=name, cdnprofileid, wafpolicyid | ||
| ) | ||
| on cdnprofileid | ||
| | project name, cdnprofileid, secpolname, wafpolicyid,skuname | ||
| | join kind = fullouter ( | ||
| resources | ||
| | where type == "microsoft.network/frontdoorwebapplicationfirewallpolicies" | ||
| | extend | ||
| managedrulesenabled=iff(tostring(properties.managedRules.managedRuleSets) != "[]", true, false), | ||
| enabledState = tostring(properties.policySettings.enabledState) | ||
| | project afdwafname=name, managedrulesenabled, wafpolicyid=id, enabledState, tostring(tags) | ||
| ) | ||
| on wafpolicyid | ||
| | where name != "" | ||
| | summarize | ||
| associatedsecuritypolicies=countif(secpolname != ""), | ||
| wafswithmanagedrules=countif(managedrulesenabled == 1) | ||
| by name, id=cdnprofileid, tags,skuname | ||
| | where associatedsecuritypolicies == 0 or wafswithmanagedrules == 0 | ||
| | project | ||
| recommendationId = "afd-10", | ||
| name, | ||
| id, | ||
| todynamic(tags), | ||
| param1 = strcat("associatedsecuritypolicies:", associatedsecuritypolicies), | ||
| param2 = strcat("wafswithmanagedrules:", wafswithmanagedrules), | ||
| param3 = strcat("skuname:",skuname) |
4 changes: 0 additions & 4 deletions
4
docs/content/services/networking/front-door/code/afd-10/afd-10.kql.fix
This file was deleted.
Oops, something went wrong.
22 changes: 21 additions & 1 deletion
22
docs/content/services/networking/front-door/code/afd-11/afd-11.kql
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1,21 @@ | ||
| // under-development | ||
| // Azure Resource Graph Query | ||
| // AFD-11 - Disable health probes when there is only one origin in an origin group | ||
| cdnresources | ||
| | where type =~ "microsoft.cdn/profiles/origingroups" | ||
| | extend healthprobe=tostring(properties.healthProbeSettings) | ||
| | project origingroupname=name, id, tags, resourceGroup, subscriptionId, healthprobe | ||
| | join ( | ||
| cdnresources | ||
| | where type =~ "microsoft.cdn/profiles/origingroups/Origins" | ||
| | extend origingroupname = tostring(properties.originGroupName) | ||
| ) | ||
| on origingroupname | ||
| | summarize origincount=count(), enabledhealthprobecount=countif(healthprobe != "") by origingroupname, id, tostring(tags), resourceGroup, subscriptionId | ||
| | where origincount == 1 and enabledhealthprobecount != 0 | ||
| | project | ||
| recommendationId = "afd-11", | ||
| name=origingroupname, | ||
| id, | ||
| todynamic(tags), | ||
| param1 = strcat("origincount:", origincount), | ||
| param2 = strcat("enabledhealthprobecount:", enabledhealthprobecount) |