Skip to content

Commit d14120a

Browse files
awslesawsles
committed
Update Kusto Graph Explorer Queries.md
1 parent a6e92d9 commit d14120a

File tree

1 file changed

+131
-0
lines changed

1 file changed

+131
-0
lines changed

‎AZURE/Kusto Graph Explorer Queries.md

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# Kusto Graph Explorer Queries
2+
The Resource Graph queries can be done through PowerShell or via the Azure Portal under "Resource Graph Explorer".
23

34

45
### LIST ALL SUBSCRIPTIONS ###
@@ -17,6 +18,124 @@ Resources
1718
| limit 25
1819
```
1920

21+
### LIST ALL NICs with Public and Private IP addresses along with their associated VM and subscription
22+
```
23+
Resources
24+
| where type =~ "microsoft.network/networkinterfaces"
25+
and properties.ipConfigurations[0[.properties.privateIPAddress =~ "10.71.2.2"
26+
| extend privateIPType = tostring(properties.ipCOnfigurations[0].properties["privateIPAllocationMethod2])
27+
| extend privateIP = tostring(properties.ipConfigurations[0].properties["privateIPAddress"])
28+
| extend publicIP = tostring(properties.ipConfigurations[0].properties["publicIPAddress"])
29+
| extend subnet = tostring(properties.ipConfigurations[0].properties.subnet["id"])
30+
```
31+
32+
### List all devices with 2 or more IP addresses
33+
```
34+
Resources
35+
| where type startswith 'microsoft.network' and isnotempty(properties.ipConfigurations[1])
36+
| extend ipCount = array_length(properties.ipConfigurations)
37+
| extend privateIPType = tostring(properties.ipConfigurations[0].properties["privateIPAllocationMethod"])
38+
| extend privateIP = tostring(properties.ipConfigurations[0].properties["privateIPAddress"])
39+
| extend privateIPType2 = tostring(properties.ipConfigurations[1].properties["privateIPAllocationMethod"])
40+
| extend privateIP2 = tostring(properties.ipConfigurations[1].properties["privateIPAddress"])
41+
| extend privateIPType3 = tostring(properties.ipConfigurations[2].properties["privateIPAllocationMethod"])
42+
| extend privateIP3 = tostring(properties.ipConfigurations[2].properties["privateIPAddress"])
43+
```
44+
45+
46+
### List Network Interfaces
47+
```
48+
Resources
49+
| where type =~ "microsoft.network/networkinterfaces"
50+
| extend ipCount = array_length(properties.ipConfigurations)
51+
| extend privateIPType = tostring(properties.ipConfigurations[0].properties["privateIPAllocationMethod"])
52+
| extend privateIP = tostring(properties.ipConfigurations[0].properties["privateIPAddress"])
53+
| extend publicIP = tostring(properties.ipConfigurations[0].properties["publicIPAddress"])
54+
| extend subnet = tostring(properties.ipConfigurations[0].properties.subnet["id"])
55+
```
56+
57+
### List FQDNs
58+
This is usually just database servers.
59+
```
60+
Resources
61+
| where isnotempty(properties.fullyQualifiedDomainName)
62+
| extend FQDN = tostring(properties.fullyQualifiedDomainName)
63+
```
64+
65+
### List Public IP Addresses
66+
```
67+
Resources
68+
| where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress)
69+
| extend publicIP = tostring(properties.ipAddress)
70+
```
71+
72+
73+
74+
### Splits IP configurations into a single row per entry
75+
```
76+
Resources
77+
| where type =~ "microsoft.network/networkinterfaces" and isnotempty(properties.ipConfigurations[1])
78+
| mv-expand x = properties.ipConfigurations
79+
```
80+
81+
82+
83+
### Find by IP address
84+
```
85+
Resources
86+
| where type =~ "microsoft.network/networkinterfaces" and isnotempty(properties.ipConfigurations)
87+
| mv-expand ipConfiguration = properties.ipConfigurations
88+
| where ipConfiguration.properties.privateIPAddress =~ "10.64.193.86"
89+
| extend privateIPType = tostring(ipConfiguration.properties.privateIPAllocationMethod)
90+
| extend privateIP = tostring(ipConfiguration.properties.privateIPAddress)
91+
| extend publicIPid = tostring(ipConfiguration.properties.publicIPAddress.id)
92+
| join kind=leftouter (Resources | where type =~ "microsoft.network/publicipaddresses"
93+
| extend publicIPaddr = tostring(properties.ipAddress)
94+
| project publicIPid=id, publicIPaddr) on publicIPid
95+
```
96+
97+
98+
99+
### List Azure Bastion Hosts with IP Addresses
100+
```
101+
Resources
102+
| where type =~ "microsoft.network/networkinterfaces" and isnotempty(properties.ipConfigurations)
103+
| mv-expand ipConfiguration = properties.ipConfigurations
104+
| where ipConfiguration.properties.privateIPAddress startswith "10.68.193."
105+
| extend privateIPType = tostring(ipConfiguration.properties.privateIPAllocationMethod)
106+
| extend privateIP = tostring(ipConfiguration.properties.privateIPAddress)
107+
| extend publicIPid = tostring(ipConfiguration.properties.publicIPAddress.id)
108+
| join kind=leftouter (ResourceContainers | where type =~ 'microsoft.resources/subscriptions'
109+
| project SubscriptionName=name, subscriptionId) on subscriptionId
110+
| join kind=leftouter (Resources | where type =~ "microsoft.network/publicipaddresses"
111+
| extend publicIPaddr = tostring(properties.ipAddress)
112+
| project publicIPid=id, publicIPaddr) on publicIPid
113+
| project privateIP, privateIPType,publicIPaddr,name,type,location,resourceGroup,tags,id,publicIPid
114+
| sort by privateIP asc
115+
```
116+
117+
118+
### List Virtuan Networks (VNets) with IP addresses
119+
This is crude as I need to way to count and join all instances
120+
```
121+
Resources
122+
| where type =~ "microsoft.network/virtualnetworks"
123+
| extend subnets = tostring(properties["subnets"])
124+
| extend prefixCount = array_length(properties.subnets)
125+
| extend ip1 = tostring(properties.subnets[0].properties.addressPrefix)
126+
| extend ip2 = tostring(properties.subnets[1].properties.addressPrefix)
127+
| extend ip3 = tostring(properties.subnets[2].properties.addressPrefix)
128+
| extend ip4 = tostring(properties.subnets[3].properties.addressPrefix)
129+
| extend ip5 = tostring(properties.subnets[4].properties.addressPrefix)
130+
```
131+
132+
### List all resources by Public IP Address
133+
A shame there isn't a private IP address equivalent...
134+
```
135+
Resources
136+
| where type =~ "microsoft.network/publicipaddresses"
137+
| extend ipAddress = tostring(properties.ipAddress)
138+
```
20139

21140
### LIST ALL VMs (joined with subscription name) ###
22141
```
@@ -329,6 +448,18 @@ Resources
329448
| project subscriptionId, SubName, name, resourceGroup, location, tags, type
330449
```
331450

451+
## mv-expand
452+
453+
https://stackoverflow.com/questions/56159424/how-do-i-iterate-through-array-in-kusto
454+
455+
https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/mvexpandoperator
456+
457+
```
458+
where type =~ "microsoft.network/networksecuritygroups"
459+
| mv-expand rules = properties.defaultSecurityRules
460+
| where rules.properties.destinationAddressPrefix =~ "*"
461+
```
462+
332463

333464
---
334465
## Using PowerShell

0 commit comments

Comments
 (0)