Forum Discussion
snteran925
Jan 21, 2023Copper Contributor
List all Exemptions with expiration date
I found this query which give some good information but when I try to tweak, it breaks. I'm not great at the ARG so I'm not sure how to pull info from within property tables.
SecurityResources
| where type == 'microsoft.security/assessments' and properties.status.cause == 'Exempt'
| extend assessmentKey = name, resourceId = tolower(trim(' ',tostring(properties.resourceDetails.Id))), healthStatus = properties.status.code, cause = properties.status.cause, reason = properties.status.description, displayName = properties.displayName
| project assessmentKey, id, name, displayName, resourceId, healthStatus, cause, reason
I'd like to have a report similar to the Export you can generate from the Regulatory Compliance section but have the added information of Exemption category and their date of expiration along with any notes.
Thank you,
- Clive_WatsonBronze Contributor
snteran925 The first thing you need to do is Project the Properties Column (#1), then when you run the query (and press "see details") you can see those data points you wish to extend (example #2)