Forum Discussion
yesoreyeram
Jun 30, 2020Brass Contributor
Azure resource Graph integration
Are there any plans to integrate Azure Resource Graph with Log Analytics? Once the integration is available it will be super easy to setup alerts based on resource meta data and monitor data. Since both using Kusto language, it should be easy to cross workspace kind of query I guess.
shijain13 yea. It is possible. But how do you combine results from both the queries. ( join kusto queries / cross workspace queries / etc ). Currently only we can query Log analytics / application insights.
- SvenAelterman
Microsoft
I know this is an old thread, but this is now possible: https://techcommunity.microsoft.com/t5/azure-observability-blog/query-azure-resource-graph-from-azure-monitor/ba-p/3918298 - OlegAnaniev
Microsoft
yesoreyeram - this is high on our list, but unfortunately, gets pushed away, as more urgent stuff comes in. But we will get there, we understand the need and will address it.
- AlanH100Copper Contributor
OlegAnaniev- I would like to join in a Sentinel workbook an ARG 'resources' query with a Log Analytics 'SecurityAlert' query to produce aggregated output like this:
Resource Group No. of Resources No. of Alerts
------------------ ------------------- --------------
rg_A 50 1,295
rg_B 125 96
Is that possible? I have tried the Merge query, however have not found a way to imclude aggregate columns.
- shijain13
Microsoft
yesoreyeram you can use workbooks which can combine data from ARG and LA and Kusto
- yesoreyeramBrass ContributorThat's really an useful video. But still the original question was about cross querying both the resources. ( like how we query App insights from Log analytics query using cross workspace query )
- pvyverBrass Contributor
It would indeed be useful for :
- Getting information of tags of the resource and combine that in a query.
To make the difference on environment for example. - Look at VM sizing for limits
Disk throttling depending on size. - ...
- yesoreyeramBrass Contributor
- Getting information of tags of the resource and combine that in a query.
- yesoreyeramBrass Contributor
shijain13 yea. It is possible. But how do you combine results from both the queries. ( join kusto queries / cross workspace queries / etc ). Currently only we can query Log analytics / application insights.
- shijain13
Microsoft
yesoreyeram In workbooks we offer merge - in Add Queries you will see this as an option.