AzureScout

2.9.0

manifests/collectors/Monitor/ActivityLogAlertRules.psd1

#
# GENERATED by scripts/ConvertTo-ScoutCollectorDefinition.ps1 from Modules/Public/InventoryModules/Monitor/ActivityLogAlertRules.ps1 (AB#5660).
# Field expressions are copied verbatim from the original collector and evaluate in an
# equivalent scope -- see docs/design/decisions/declarative-collectors.md.
# Review before trusting; regenerate rather than hand-patch if the source collector changes.
#
@{
    ResourceTypes = @(
        'microsoft.insights/activitylogalerts'
    )

    ResourceTypeMatching = 'Grouped'

    AdditionalFilter = $null

    FilterPreamble = ''

    RowLoopVariable = '1'

    Preamble = @'
$ResUCount = 1
            $sub1 = $SUB | Where-Object { $_.Id -eq $1.subscriptionId }
            $data = $1.PROPERTIES
            $Tags = if (![string]::IsNullOrEmpty($1.tags.psobject.properties)) { $1.tags.psobject.properties } else { '0' }
 
            # Scopes
            $scopes = if ($data.scopes) { $data.scopes -join '; ' } else { 'N/A' }
 
            # Condition — extract key filters
            $condCategory = ''
            $condOperationName = ''
            $condLevel = ''
            $condStatus = ''
            $condResourceType = ''
            if ($data.condition -and $data.condition.allOf) {
                foreach ($filter in $data.condition.allOf) {
                    switch ($filter.field) {
                        'category' { $condCategory = $filter.equals }
                        'operationName' { $condOperationName = $filter.equals }
                        'level' { $condLevel = $filter.equals }
                        'status' { $condStatus = $filter.equals }
                        'resourceType' { $condResourceType = $filter.equals }
                    }
                }
            }
 
            # Action groups
            $actionGroupIds = @()
            if ($data.actions -and $data.actions.actionGroups) {
                $actionGroupIds = @($data.actions.actionGroups | ForEach-Object {
                    ($_.actionGroupId -split '/')[-1]
                })
            }
            $actionGroupStr = if (@($actionGroupIds).Count -gt 0) { $actionGroupIds -join '; ' } else { 'None' }
'@

    AdditionalRowLoops = @()

    TagLoop = @{
        Variable = 'Tag'
        Source = '$Tags'
        Preamble = ''
    }

    Fields = @(
        @{
            Name = 'ID'
            Expression = '$1.id'
        }
        @{
            Name = 'Subscription'
            Expression = '$sub1.Name'
        }
        @{
            Name = 'Resource Group'
            Expression = '$1.RESOURCEGROUP'
        }
        @{
            Name = 'Alert Name'
            Expression = '$1.NAME'
        }
        @{
            Name = 'Location'
            Expression = '$1.LOCATION'
        }
        @{
            Name = 'Enabled'
            Expression = 'if ($data.enabled) { ''Yes'' } else { ''No'' }'
        }
        @{
            Name = 'Description'
            Expression = 'if ($data.description) { $data.description } else { '''' }'
        }
        @{
            Name = 'Scopes'
            Expression = '$scopes'
        }
        @{
            Name = 'Category'
            Expression = '$condCategory'
        }
        @{
            Name = 'Operation Name'
            Expression = '$condOperationName'
        }
        @{
            Name = 'Level'
            Expression = '$condLevel'
        }
        @{
            Name = 'Status'
            Expression = '$condStatus'
        }
        @{
            Name = 'Resource Type Filter'
            Expression = '$condResourceType'
        }
        @{
            Name = 'Action Groups'
            Expression = '$actionGroupStr'
        }
        @{
            Name = 'Resource U'
            Expression = '$ResUCount'
        }
        @{
            Name = 'Tag Name'
            Expression = '[string]$Tag.Name'
        }
        @{
            Name = 'Tag Value'
            Expression = '[string]$Tag.Value'
        }
    )

    Export = @{
        WorksheetName = 'Activity Log Alerts'
        TableNamePrefix = 'ActLogAlertTable_'
        Columns = @(
            'Subscription'
            'Resource Group'
            'Alert Name'
            'Location'
            'Enabled'
            'Description'
            'Scopes'
            'Category'
            'Operation Name'
            'Level'
            'Status'
            'Resource Type Filter'
            'Action Groups'
            'Resource U'
        )
        TagColumns = @()
        TagColumnsBefore = $null
        NumberFormat = '0'
        ConditionalText = @()
    }

    SourceCollector = 'Modules/Public/InventoryModules/Monitor/ActivityLogAlertRules.ps1'
}