AzureScout

2.11.0

manifests/collectors/Monitor/DataCollectionRules.psd1

#
# GENERATED by scripts/ConvertTo-ScoutCollectorDefinition.ps1 from Modules/Public/InventoryModules/Monitor/DataCollectionRules.ps1 (AB#5660).
# Field expressions are copied verbatim from the original collector and evaluate in an
# equivalent scope -- see docs/design/decisions/declarative-collectors.md.
# Review before trusting; regenerate rather than hand-patch if the source collector changes.
#
@{
    ResourceTypes = @(
        'microsoft.insights/datacollectionrules'
    )

    ResourceTypeMatching = 'Grouped'

    AdditionalFilter = $null

    FilterPreamble = ''

    RowLoopVariable = '1'

    Preamble = @'
$ResUCount = 1
                $sub1 = $SUB | Where-Object { $_.Id -eq $1.subscriptionId }
                $data = $1.PROPERTIES
                $Tags = if(![string]::IsNullOrEmpty($1.tags.psobject.properties)){$1.tags.psobject.properties}else{'0'}
 
                # Parse data sources
                $dataSources = @()
                if ($data.dataSources) {
                    if ($data.dataSources.performanceCounters) {
                        foreach ($pc in $data.dataSources.performanceCounters) {
                            $dataSources += "Performance Counters ($($pc.name))"
                        }
                    }
                    if ($data.dataSources.windowsEventLogs) {
                        foreach ($wel in $data.dataSources.windowsEventLogs) {
                            $dataSources += "Windows Event Logs ($($wel.name))"
                        }
                    }
                    if ($data.dataSources.syslog) {
                        foreach ($syslog in $data.dataSources.syslog) {
                            $dataSources += "Syslog ($($syslog.name))"
                        }
                    }
                    if ($data.dataSources.extensions) {
                        foreach ($ext in $data.dataSources.extensions) {
                            $dataSources += "Extension: $($ext.extensionName)"
                        }
                    }
                }
                $dataSourcesStr = if ($dataSources.Count -gt 0) { $dataSources -join '; ' } else { 'None' }
 
                # Parse destinations
                $destinations = @()
                if ($data.destinations) {
                    if ($data.destinations.logAnalytics) {
                        foreach ($la in $data.destinations.logAnalytics) {
                            $workspaceName = ($la.workspaceResourceId -split '/')[-1]
                            $destinations += "Log Analytics: $workspaceName"
                        }
                    }
                    if ($data.destinations.azureMonitorMetrics) {
                        $destinations += "Azure Monitor Metrics"
                    }
                    if ($data.destinations.eventHub) {
                        foreach ($eh in $data.destinations.eventHub) {
                            $ehName = ($eh.eventHubResourceId -split '/')[-1]
                            $destinations += "Event Hub: $ehName"
                        }
                    }
                    if ($data.destinations.storageAccounts) {
                        foreach ($sa in $data.destinations.storageAccounts) {
                            $saName = ($sa.storageAccountResourceId -split '/')[-1]
                            $destinations += "Storage: $saName"
                        }
                    }
                }
                $destinationsStr = if ($destinations.Count -gt 0) { $destinations -join '; ' } else { 'None' }
 
                # Parse data flows
                $dataFlows = @()
                if ($data.dataFlows) {
                    foreach ($flow in $data.dataFlows) {
                        $streams = if ($flow.streams) { $flow.streams -join ', ' } else { 'N/A' }
                        $dest = if ($flow.destinations) { $flow.destinations -join ', ' } else { 'N/A' }
                        $dataFlows += "Streams: $streams -> Dest: $dest"
                    }
                }
                $dataFlowsStr = if ($dataFlows.Count -gt 0) { $dataFlows -join '; ' } else { 'None' }
 
                # Parse transformations (KQL)
                $transformations = 'None'
                if ($data.dataFlows) {
                    $hasTransform = $false
                    foreach ($flow in $data.dataFlows) {
                        if ($flow.transformKql) {
                            $hasTransform = $true
                            break
                        }
                    }
                    if ($hasTransform) {
                        $transformations = 'Yes (KQL transformations applied)'
                    }
                }
 
                # Get data collection endpoint
                $dce = 'None'
                if ($data.dataCollectionEndpointId) {
                    $dce = ($data.dataCollectionEndpointId -split '/')[-1]
                }
 
                # Get description
                $description = if ($data.description) { $data.description } else { 'N/A' }
'@

    AdditionalRowLoops = @()

    TagLoop = @{
        Variable = 'Tag'
        Source = '$Tags'
        Preamble = ''
    }

    Fields = @(
        @{
            Name = 'ID'
            Expression = '$1.id'
        }
        @{
            Name = 'Subscription'
            Expression = '$sub1.Name'
        }
        @{
            Name = 'Resource Group'
            Expression = '$1.RESOURCEGROUP'
        }
        @{
            Name = 'DCR Name'
            Expression = '$1.NAME'
        }
        @{
            Name = 'Description'
            Expression = '$description'
        }
        @{
            Name = 'Location'
            Expression = '$1.LOCATION'
        }
        @{
            Name = 'Data Sources'
            Expression = '$dataSourcesStr'
        }
        @{
            Name = 'Destinations'
            Expression = '$destinationsStr'
        }
        @{
            Name = 'Data Flows'
            Expression = '$dataFlowsStr'
        }
        @{
            Name = 'Transformations'
            Expression = '$transformations'
        }
        @{
            Name = 'Data Collection Endpoint'
            Expression = '$dce'
        }
        @{
            Name = 'Immutable ID'
            Expression = 'if ($data.immutableId) { $data.immutableId } else { ''N/A'' }'
        }
        @{
            Name = 'Resource U'
            Expression = '$ResUCount'
        }
        @{
            Name = 'Tag Name'
            Expression = '[string]$Tag.Name'
        }
        @{
            Name = 'Tag Value'
            Expression = '[string]$Tag.Value'
        }
    )

    Export = @{
        WorksheetName = 'Data Collection Rules'
        TableNamePrefix = 'DataCollectionRulesTable_'
        Columns = @(
            'Subscription'
            'Resource Group'
            'DCR Name'
            'Description'
            'Location'
            'Data Sources'
            'Destinations'
            'Data Flows'
            'Transformations'
            'Data Collection Endpoint'
            'Immutable ID'
            'Resource U'
        )
        TagColumns = @(
            'Tag Name'
            'Tag Value'
        )
        TagColumnsBefore = 'Resource U'
        NumberFormat = '0'
        ConditionalText = @()
    }

    SourceCollector = 'Modules/Public/InventoryModules/Monitor/DataCollectionRules.ps1'
}