AzureScout

2.11.0

manifests/collectors/Monitor/ScheduledQueryRules.psd1

#
# GENERATED by scripts/ConvertTo-ScoutCollectorDefinition.ps1 from Modules/Public/InventoryModules/Monitor/ScheduledQueryRules.ps1 (AB#5660).
# Field expressions are copied verbatim from the original collector and evaluate in an
# equivalent scope -- see docs/design/decisions/declarative-collectors.md.
# Review before trusting; regenerate rather than hand-patch if the source collector changes.
#
@{
    ResourceTypes = @(
        'microsoft.insights/scheduledqueryrules'
    )

    ResourceTypeMatching = 'Grouped'

    AdditionalFilter = $null

    FilterPreamble = ''

    RowLoopVariable = '1'

    Preamble = @'
$ResUCount = 1
                $sub1 = $SUB | Where-Object { $_.Id -eq $1.subscriptionId }
                $data = $1.PROPERTIES
                $Tags = if(![string]::IsNullOrEmpty($1.tags.psobject.properties)){$1.tags.psobject.properties}else{'0'}
 
                # Parse query and data sources
                $query = if ($data.criteria.allOf[0].query) {
                    $data.criteria.allOf[0].query
                } else { 'N/A' }
 
                $dataSources = @()
                if ($data.scopes) {
                    foreach ($scope in $data.scopes) {
                        $resourceName = ($scope -split '/')[-1]
                        $dataSources += $resourceName
                    }
                }
                $dataSourcesStr = if ($dataSources.Count -gt 0) { $dataSources -join ', ' } else { 'N/A' }
 
                # Parse conditions/criteria
                $conditions = @()
                if ($data.criteria.allOf) {
                    foreach ($condition in $data.criteria.allOf) {
                        $metricMeasureColumn = if ($condition.metricMeasureColumn) { $condition.metricMeasureColumn } else { 'N/A' }
                        $operator = $condition. operator
                        $threshold = $condition.threshold
                        $timeAggregation = if ($condition.timeAggregation) { $condition.timeAggregation } else { 'Count' }
                        $conditions += "$timeAggregation($metricMeasureColumn) $operator $threshold"
                    }
                }
                $conditionsStr = if ($conditions.Count -gt 0) { $conditions -join '; ' } else { 'N/A' }
 
                # Parse action groups
                $actionGroups = @()
                if ($data.actions.actionGroups) {
                    foreach ($ag in $data.actions.actionGroups) {
                        $agName = ($ag -split '/')[-1]
                        $actionGroups += $agName
                    }
                }
                $actionGroupStr = if ($actionGroups.Count -gt 0) { $actionGroups -join ', ' } else { 'None' }
 
                # Get severity
                $severity = switch ($data.severity) {
                    0 { 'Critical' }
                    1 { 'Error' }
                    2 { 'Warning' }
                    3 { 'Informational' }
                    4 { 'Verbose' }
                    default { $data.severity }
                }
 
                # Parse evaluation frequency and window
                $evaluationFrequency = if ($data.evaluationFrequency) {
                    $data.evaluationFrequency
                } else { 'PT5M' }
                $windowSize = if ($data.windowSize) {
                    $data.windowSize
                } else { 'PT5M' }
 
                # Get enabled status
                $enabled = if ($data.enabled -eq $true) { 'Enabled' } else { 'Disabled' }
                $autoMitigate = if ($data.autoMitigate -eq $true) { 'Yes' } else { 'No' }
 
                # Check if it's a legacy alert rule
                $isLegacy = if ($data.kind -eq 'LogAlert') { 'No' } else { 'Yes (migrate to new API)' }
'@

    AdditionalRowLoops = @()

    TagLoop = @{
        Variable = 'Tag'
        Source = '$Tags'
        Preamble = ''
    }

    Fields = @(
        @{
            Name = 'ID'
            Expression = '$1.id'
        }
        @{
            Name = 'Subscription'
            Expression = '$sub1.Name'
        }
        @{
            Name = 'Resource Group'
            Expression = '$1.RESOURCEGROUP'
        }
        @{
            Name = 'Query Rule Name'
            Expression = '$1.NAME'
        }
        @{
            Name = 'Description'
            Expression = 'if ($data.description) { $data.description } else { ''N/A'' }'
        }
        @{
            Name = 'Location'
            Expression = '$1.LOCATION'
        }
        @{
            Name = 'Status'
            Expression = '$enabled'
        }
        @{
            Name = 'Severity'
            Expression = '$severity'
        }
        @{
            Name = 'Query'
            Expression = '$query'
        }
        @{
            Name = 'Data Sources'
            Expression = '$dataSourcesStr'
        }
        @{
            Name = 'Conditions'
            Expression = '$conditionsStr'
        }
        @{
            Name = 'Evaluation Frequency'
            Expression = '$evaluationFrequency'
        }
        @{
            Name = 'Window Size'
            Expression = '$windowSize'
        }
        @{
            Name = 'Auto Mitigate'
            Expression = '$autoMitigate'
        }
        @{
            Name = 'Action Groups'
            Expression = '$actionGroupStr'
        }
        @{
            Name = 'Legacy Alert'
            Expression = '$isLegacy'
        }
        @{
            Name = 'Resource U'
            Expression = '$ResUCount'
        }
        @{
            Name = 'Tag Name'
            Expression = '[string]$Tag.Name'
        }
        @{
            Name = 'Tag Value'
            Expression = '[string]$Tag.Value'
        }
    )

    Export = @{
        WorksheetName = 'Scheduled Queries'
        TableNamePrefix = 'ScheduledQueryTable_'
        Columns = @(
            'Subscription'
            'Resource Group'
            'Query Rule Name'
            'Description'
            'Location'
            'Status'
            'Severity'
            'Query'
            'Data Sources'
            'Conditions'
            'Evaluation Frequency'
            'Window Size'
            'Auto Mitigate'
            'Action Groups'
            'Legacy Alert'
            'Resource U'
        )
        TagColumns = @(
            'Tag Name'
            'Tag Value'
        )
        TagColumnsBefore = 'Resource U'
        NumberFormat = '0'
        ConditionalText = @()
    }

    SourceCollector = 'Modules/Public/InventoryModules/Monitor/ScheduledQueryRules.ps1'
}