Blog Post

Microsoft Defender for Cloud Blog
1 MIN READ

ASC Powered by ARG (Azure Resource Graph)

Eli_Koreh's avatar
Eli_Koreh
Icon for Microsoft rankMicrosoft
Oct 30, 2019

Latest integration between ASC and ARG enables new very cool features like:

  • Custom dashboards
  • Saved queries
  • KQL query to explore the data on *any* scope
  • Export to CSV
  • API

 

You can see bellow custom dashboard I created in 5 min

 

Search for “arg” in Azure Portal

 

 

 

On the left pane, you can see ASC data in ARG

 

 

 

 

Few KQL queries examples on what can be extracted from data, more about KQL & ARG - here

 

Assessments (recommendations)

SecurityResources 

| where type == 'microsoft.security/assessments' 

| extend assessmentKey = name, resourceId = tolower(trim(' ',tostring(properties.resourceDetails.Id))), healthStatus = properties.status.code, displayName = properties.displayName

| summarize count() by tostring(displayName)

| order by count_ 

 

Regulatory Compliance status 

securityresources

 | where type == "microsoft.security/regulatorycompliancestandards"

 | extend passedControls = trim(' ',tostring(properties.passedControls)), failedControls = trim(' ',tostring(properties.failedControls))

 | project name,passedControls,failedControls

 

Pricing tiers

securityresources 

| where type == "microsoft.security/pricings"

| extend tier = trim(' ',tostring(properties.pricingTier))

| project name,tier,subscriptionId

 

 

 

Run the query:

 

 

 

To create dashboard, just go to “charts” tab and select chart type

 

 

Now, you can pin this custom dashboard to your main Azure landing page

 

 

 

 

 

 

 

 

Updated Feb 01, 2022
Version 5.0
  • Jagadt's avatar
    Jagadt
    Copper Contributor

    Thanks for sharing this commands and it is very useful. Could you help to pull report specifically for Azure CIS controls with pass and fail controls in a chart view. Appreciate your support