List all Exemptions with expiration date

New Contributor

I found this query which give some good information but when I try to tweak, it breaks.  I'm not great at the ARG so I'm not sure how to pull info from within property tables.

 

SecurityResources 
| where type == 'microsoft.security/assessments' and properties.status.cause == 'Exempt'
| extend assessmentKey = name, resourceId = tolower(trim(' ',tostring(properties.resourceDetails.Id))), healthStatus = properties.status.code, cause = properties.status.cause, reason = properties.status.description, displayName = properties.displayName
| project assessmentKey, id, name, displayName, resourceId, healthStatus, cause, reason

 

I'd like to have a report similar to the Export you can generate from the Regulatory Compliance section but have the added information of Exemption category and their date of expiration along with any notes. 

 

Thank you,

1 Reply

@snteran925 The first thing you need to do is Project the Properties Column (#1), then when you run the query (and press "see details") you can see those data points you wish to extend (example #2)



Clive_Watson_0-1674475026561.png

 

Clive_Watson_1-1674475188230.png