Forum Discussion
SergioT1228
Dec 21, 2023Brass Contributor
KQL - Storage Accounts
Hello,
I have a query that is working but I'm trying to extract exactly what i'm looking for to help clear up the report.
resources
| where type =~ "microsoft.storage/storageaccounts"
| extend properties = parse_json(properties)
| extend PrivateEndpoint = properties.privateEndpointConnections
| extend properties = parse_json(properties)
| extend publicEnabled = iif(properties.networkAcls.defaultAction == "Allow", "Enabled from all networks", "Not enabled from all networks")
| project name, properties.creationTime, subscriptionId, location, resourceGroup, https=properties.supportsHttpsTrafficOnly, properties.allowBlobPublicAccess, properties.minimumTlsVersion, publicEnabled, PrivateEndpoint
My issue is with the "PrivateEndpoint" results. At the end of the day, I just need:
stpepest.3de0646c-014c-4b45-9025-5d609fab0b13
So I tried to do something like this but it is not working:
| extend id = properties.privateEndpointConnections.id
| extend p_name = split(id,'/')
| extend pep_name = p_name[-1]
When I do a Project, I get null.
any help would be greatly appreciated.
Serge
- Clive_WatsonBronze ContributorRather than filtering all of properties, I tend to parse for these, add this as a last line:
| parse PrivateEndpoint with *'"name":"' pep_name '","type'*