AzureScout

3.0.5

manifests/collectors/Monitor/SubscriptionDiagnosticSettings.psd1

#
# GENERATED by scripts/ConvertTo-ScoutCollectorDefinition.ps1 from Modules/Public/InventoryModules/Monitor/SubscriptionDiagnosticSettings.ps1 (AB#5660).
# Field expressions are copied verbatim from the original collector and evaluate in an
# equivalent scope -- see docs/design/decisions/declarative-collectors.md.
# Review before trusting; regenerate rather than hand-patch if the source collector changes.
#
@{
    ResourceTypes = @(
        'AZSC/Subscription/SecurityPolicySweep'
    )

    ResourceTypeMatching = 'Grouped'

    AdditionalFilter = $null

    FilterPreamble = ''

    RowLoopVariable = '1'

    RowSource = @{
        Expression = @'
foreach ($sweep in @($Resources | Where-Object { $_.TYPE -eq 'AZSC/Subscription/SecurityPolicySweep' })) {
            foreach ($setting in @($sweep.PROPERTIES.SubscriptionDiagnosticSettings)) {
                $setting | Add-Member -NotePropertyName 'SubscriptionId' -NotePropertyValue $sweep.subscriptionId -Force
                $setting | Add-Member -NotePropertyName 'SubscriptionName' -NotePropertyValue $sweep.subscriptionName -Force -PassThru
                $setting | Add-Member -NotePropertyName 'Id' -NotePropertyValue (Get-AZSCSafeProperty -InputObject $setting -Path 'Id') -Force
                $setting | Add-Member -NotePropertyName 'Name' -NotePropertyValue (Get-AZSCSafeProperty -InputObject $setting -Path 'Name') -Force
            }
        }
'@
    }

    Preamble = @'
$ResUCount = 1
                $data = $1
 
                # Parse enabled log categories
                $enabledLogs = @()
                $logs = @(Get-AZSCSafeProperty -InputObject $data -Path 'Logs')
                if ($logs) {
                    foreach ($log in $logs) {
                        if ($log.Enabled -eq $true) {
                            $category = $log.Category
                            $retentionDays = if ($log.RetentionPolicy.Days -gt 0) {
                                "$($log.RetentionPolicy.Days) days"
                            } else { 'Unlimited' }
                            $enabledLogs += "$category (Retention: $retentionDays)"
                        }
                    }
                }
                $enabledLogsStr = if ($enabledLogs.Count -gt 0) { $enabledLogs -join '; ' } else { 'None' }
 
                # Parse destinations
                $destinations = @()
 
                # Log Analytics workspace
                if ($data.WorkspaceId) {
                    $workspaceName = ($data.WorkspaceId -split '/')[-1]
                    $destinations += "Log Analytics: $workspaceName"
                }
 
                # Storage account
                if ($data.StorageAccountId) {
                    $storageName = ($data.StorageAccountId -split '/')[-1]
                    $destinations += "Storage: $storageName"
                }
 
                # Event Hub
                if ($data.EventHubAuthorizationRuleId) {
                    $eventHubName = if ($data.EventHubName) {
                        $data.EventHubName
                    } else {
                        ($data.EventHubAuthorizationRuleId -split '/')[-3]
                    }
                    $destinations += "Event Hub: $eventHubName"
                }
 
                # Partner solution
                if ($data.MarketplacePartnerId) {
                    $partnerName = ($data.MarketplacePartnerId -split '/')[-1]
                    $destinations += "Partner: $partnerName"
                }
 
                $destinationsStr = if ($destinations.Count -gt 0) { $destinations -join '; ' } else { 'None' }
 
                # Count enabled categories
                $enabledCount = @($logs | Where-Object { (Get-AZSCSafeProperty -InputObject $_ -Path 'Enabled') -eq $true }).Count
                $totalCount = @($logs).Count
'@

    AdditionalRowLoops = @()

    TagLoop = $null

    Fields = @(
        @{
            Name = 'ID'
            Expression = '$1.Id'
        }
        @{
            Name = 'Subscription'
            Expression = '$1.SubscriptionName'
        }
        @{
            Name = 'Diagnostic Setting Name'
            Expression = '$data.Name'
        }
        @{
            Name = 'Enabled Log Categories'
            Expression = '$enabledLogsStr'
        }
        @{
            Name = 'Categories Enabled'
            Expression = '"$enabledCount / $totalCount"'
        }
        @{
            Name = 'Destinations'
            Expression = '$destinationsStr'
        }
        @{
            Name = 'Log Analytics Workspace'
            Expression = 'if ($data.WorkspaceId) { ($data.WorkspaceId -split ''/'')[-1] } else { ''N/A'' }'
        }
        @{
            Name = 'Storage Account'
            Expression = 'if ($data.StorageAccountId) { ($data.StorageAccountId -split ''/'')[-1] } else { ''N/A'' }'
        }
        @{
            Name = 'Event Hub'
            Expression = @'
if ($data.EventHubAuthorizationRuleId) {
                        if ($data.EventHubName) { $data.EventHubName } else { ($data.EventHubAuthorizationRuleId -split '/')[-3] }
                    } else { 'N/A' }
'@
        }
        @{
            Name = 'Partner Solution'
            Expression = 'if ($data.MarketplacePartnerId) { ($data.MarketplacePartnerId -split ''/'')[-1] } else { ''N/A'' }'
        }
        @{
            Name = 'Resource U'
            Expression = '$ResUCount'
        }
    )

    Export = @{
        WorksheetName = 'Subscription Diagnostics'
        TableNamePrefix = 'SubDiagnosticsTable_'
        Columns = @(
            'Subscription'
            'Diagnostic Setting Name'
            'Enabled Log Categories'
            'Categories Enabled'
            'Destinations'
            'Log Analytics Workspace'
            'Storage Account'
            'Event Hub'
            'Partner Solution'
            'Resource U'
        )
        TagColumns = @()
        TagColumnsBefore = $null
        NumberFormat = '0'
        ConditionalText = @()
    }

    SourceCollector = 'Modules/Public/InventoryModules/Monitor/SubscriptionDiagnosticSettings.ps1'
}