ASC Powered by ARG (Azure Resource Graph)

Published Oct 30 2019 07:26 AM 5,490 Views
Microsoft

Latest integration between ASC and ARG enables new very cool features like:

  • Custom dashboards
  • Saved queries
  • KQL query to explore the data on *any* scope
  • Export to CSV
  • API

 

You can see bellow custom dashboard I created in 5 min

 

Search for “arg” in Azure Portal

 

clipboard_image_0.png

 

 

On the left pane, you can see ASC data in ARG

 

 

clipboard_image_1.png

 

 

Few KQL queries examples on what can be extracted from data, more about KQL & ARG - here

 

Assessments (recommendations)

SecurityResources 

| where type == 'microsoft.security/assessments' 

| extend assessmentKey = name, resourceId = tolower(trim(' ',tostring(properties.resourceDetails.Id))), healthStatus = properties.status.code, displayName = properties.displayName

| summarize count() by tostring(displayName)

| order by count_ 

 

Regulatory Compliance status 

securityresources

 | where type == "microsoft.security/regulatorycompliancestandards"

 | extend passedControls = trim(' ',tostring(properties.passedControls)), failedControls = trim(' ',tostring(properties.failedControls))

 | project name,passedControls,failedControls

 

Pricing tiers

securityresources 

| where type == "microsoft.security/pricings"

| extend tier = trim(' ',tostring(properties.pricingTier))

| project name,tier,subscriptionId

 

 

 

Run the query:

 

clipboard_image_2.png

 

 

To create dashboard, just go to “charts” tab and select chart type

 

clipboard_image_3.png

 

Now, you can pin this custom dashboard to your main Azure landing page

 

clipboard_image_4.png

 

 

 

 

 

 

 

1 Comment
%3CLINGO-SUB%20id%3D%22lingo-sub-965737%22%20slang%3D%22en-US%22%3EASC%20Powered%20by%20ARG%20(Azure%20Resource%20Graph)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-965737%22%20slang%3D%22en-US%22%3E%3CP%3ELatest%20integration%20between%20ASC%20and%20ARG%20enables%20new%20very%20cool%20features%20like%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3ECustom%20dashboards%3C%2FLI%3E%0A%3CLI%3ESaved%20queries%3C%2FLI%3E%0A%3CLI%3EKQL%20query%20to%20explore%20the%20data%20on%20*%3CSTRONG%3Eany%3C%2FSTRONG%3E*%20scope%3C%2FLI%3E%0A%3CLI%3EExport%20to%20CSV%3C%2FLI%3E%0A%3CLI%3EAPI%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20can%20see%20bellow%20custom%20dashboard%20I%20created%20in%205%20min%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESearch%20for%20%E2%80%9Carg%E2%80%9D%20in%20Azure%20Portal%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F151974iA74C15FA2567017A%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOn%20the%20left%20pane%2C%20you%20can%20see%20ASC%20data%20in%20ARG%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F151975iC89D46BC913C7190%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_1.png%22%20title%3D%22clipboard_image_1.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFew%20KQL%20queries%20examples%20on%20what%20can%20be%20extracted%20from%20data%2C%20more%20about%20KQL%20%26amp%3B%20ARG%20-%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fgovernance%2Fresource-graph%2Fsamples%2Fstarter%3Ftabs%3Dazure-cli%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehere%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CU%3EAssessments%20(recommendations)%3C%2FU%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3ESecurityResources%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bwhere%26nbsp%3Btype%26nbsp%3B%3D%3D%26nbsp%3B'microsoft.security%2Fassessments'%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bextend%26nbsp%3BassessmentKey%26nbsp%3B%3D%26nbsp%3Bname%2C%26nbsp%3BresourceId%26nbsp%3B%3D%26nbsp%3Btolower(trim('%26nbsp%3B'%2Ctostring(properties.resourceDetails.Id)))%2C%26nbsp%3BhealthStatus%26nbsp%3B%3D%26nbsp%3Bproperties.status.code%2C%26nbsp%3BdisplayName%26nbsp%3B%3D%26nbsp%3Bproperties.displayName%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bsummarize%26nbsp%3Bcount()%26nbsp%3Bby%26nbsp%3Btostring(displayName)%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Border%26nbsp%3Bby%26nbsp%3Bcount_%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CU%3ERegulatory%20Compliance%20status%26nbsp%3B%20%3C%2FU%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3Esecurityresources%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%7C%26nbsp%3Bwhere%26nbsp%3Btype%26nbsp%3B%3D%3D%26nbsp%3B%22microsoft.security%2Fregulatorycompliancestandards%22%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%7C%26nbsp%3Bextend%26nbsp%3BpassedControls%26nbsp%3B%3D%26nbsp%3Btrim('%26nbsp%3B'%2Ctostring(properties.passedControls))%2C%26nbsp%3BfailedControls%26nbsp%3B%3D%26nbsp%3Btrim('%26nbsp%3B'%2Ctostring(properties.failedControls))%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%7C%26nbsp%3Bproject%26nbsp%3Bname%2CpassedControls%2CfailedControls%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CU%3EPricing%20tiers%3C%2FU%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3Esecurityresources%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bwhere%26nbsp%3Btype%26nbsp%3B%3D%3D%26nbsp%3B%22microsoft.security%2Fpricings%22%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bextend%26nbsp%3Btier%26nbsp%3B%3D%26nbsp%3Btrim('%26nbsp%3B'%2Ctostring(properties.pricingTier))%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bproject%26nbsp%3Bname%2Ctier%2CsubscriptionId%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ERun%20the%20query%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F151976i3EC57016FD88748A%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_2.png%22%20title%3D%22clipboard_image_2.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20create%20dashboard%2C%20just%20go%20to%20%E2%80%9Ccharts%E2%80%9D%20tab%20and%20select%20chart%20type%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F151978i83749E9C059E884D%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_3.png%22%20title%3D%22clipboard_image_3.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENow%2C%20you%20can%20pin%20this%20custom%20dashboard%20to%20your%20main%20Azure%20landing%20page%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F151977i648545F6EBA3810C%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_4.png%22%20title%3D%22clipboard_image_4.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22xxxmsonormal%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22xxxmsonormal%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22xxxmsonormal%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22xxxmsonormal%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22xxxmsonormal%22%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-965737%22%20slang%3D%22en-US%22%3E%3CP%3ELatest%20integration%20between%20ASC%20and%20ARG%20enables%20new%20very%20cool%20features%20like%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3ECustom%20dashboards%3C%2FLI%3E%0A%3CLI%3ESaved%20queries%3C%2FLI%3E%0A%3CLI%3EKQL%20query%20to%20explore%20the%20data%20on%20*%3CSTRONG%3Eany%3C%2FSTRONG%3E*%20scope%3C%2FLI%3E%0A%3CLI%3EExport%20to%20CSV%3C%2FLI%3E%0A%3CLI%3EAPI%3C%2FLI%3E%0A%3C%2FUL%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-965737%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EARG%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EASC%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1223064%22%20slang%3D%22en-US%22%3ERe%3A%20ASC%20Powered%20by%20ARG%20(Azure%20Resource%20Graph)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1223064%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20sharing%20this%20commands%20and%20it%20is%20very%20useful.%20Could%20you%20help%20to%20pull%20report%20specifically%20for%20Azure%20CIS%20controls%20with%20pass%20and%20fail%20controls%20in%20a%20chart%20view.%20Appreciate%20your%20support%3C%2FP%3E%3C%2FLINGO-BODY%3E
Co-Authors
Version history
Last update:
‎Nov 09 2021 08:21 AM
Updated by: