Microsoft Tech Community is in Read Only mode.  Please enjoy browsing our content while we complete our platform upgrade.

Forum Discussion

Deleted's avatar
Deleted
Sep 18, 2023

Analytic Rule Auditing with KQL

I'm looking to audit enabled analytic rules and perform transformations on the data using KQL and I'm wondering if this is possible?

 

I know that the API can be used to list the enabled analytic rules in the Log Analytics Workspace:

 

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules?api-version=2023-02-01

 

Then when using a Workbook we can use an Azure Resource Manager query to use this same GET request to ingest the data into a Workbook parameter. From the ingested parameter can be used within the workbook to perform filtering on the data using KQL and is then presented within the workbook.

 

I'm wondering if there's a way to do something like this outside of the workbooks functionality? Is there a way to pull the information using the API, but then still use KQL to do what I want with the data? A use case example for this would be if I wanted to take the data, transform it, then export the output to another external application.

 

Thanks

  • You can but you'd need to ingest the data from the api, into a custom table - then you can use KQL on it. You can probably also use a Playbook to read the api, transform the data and export to your app in a single operation as well.
    Note: If you do ingest it, you probably only need to to this once a day (or maybe less), so it's very low volume/cost.

    I also showed the Workbook method in "Workspace Usage" --> Regular Checks --> Weekly --> Rules
  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    You can but you'd need to ingest the data from the api, into a custom table - then you can use KQL on it. You can probably also use a Playbook to read the api, transform the data and export to your app in a single operation as well.
    Note: If you do ingest it, you probably only need to to this once a day (or maybe less), so it's very low volume/cost.

    I also showed the Workbook method in "Workspace Usage" --> Regular Checks --> Weekly --> Rules

Resources