AzureScout

3.3.0

manifests/collectors/Monitor/ResourceDiagnosticSettings.psd1

                                #

# Originally GENERATED by scripts/ConvertTo-ScoutCollectorDefinition.ps1 from

# Modules/Public/InventoryModules/Monitor/ResourceDiagnosticSettings.ps1 (AB#5660).

# See docs/design/decisions/declarative-collectors.md.

#

# HAND-EDITED for AB#6769, deliberately, and it cannot be regenerated: the source collector no

# longer exists (Modules/ was retired) and the defect was in what it READ, not in how it was

# converted. It declared `microsoft.insights/diagnosticsettings` and consumed the Resource Graph

# `resources` table -- but a diagnostic setting is an ARM EXTENSION resource that Resource Graph

# indexes in no table at all, so this collector returned zero rows in every tenant, on every run,

# at every permission level. The rows now come from the per-parent ARM REST sweep in

# src/collect/Get-ScoutArmChildResource.ps1 ('ResourceDiagnosticSettings' dataset), which also

# documents which parent types are swept and why the list stops where it does.

#

# The parent name/type are read off the envelope's PARENTNAME/PARENTTYPE rather than reverse-

# engineered from the setting's id. The old id-regex was also wrong on real data: it anchored on

# a lowercase '/providers/microsoft.insights/diagnosticsettings/' segment that ARM returns

# cased as 'Microsoft.Insights/diagnosticSettings', so both derived columns fell through to the

# resource group name and 'Unknown' -- which is exactly what the committed golden recorded.

#

@{

    ResourceTypes = @(

        'AZSC/ARMChild/ResourceDiagnosticSettings'

    )

    ResourceTypeMatching = 'Grouped'

    AdditionalFilter = $null

    FilterPreamble = ''

    RowLoopVariable = '1'

    Preamble = @'

$ResUCount = 1

            $sub1 = $SUB | Where-Object { $_.Id -eq $1.subscriptionId }

            $data = $1.PROPERTIES

            # An ARM child envelope carries no `tags` property at all, and reading an absent

            # property throws under StrictMode rather than returning $null. Guard first.

            $Tags = if ($1.PSObject.Properties['tags'] -and ![string]::IsNullOrEmpty($1.tags.psobject.properties)) { $1.tags.psobject.properties } else { '0' }

            # The parent is carried on the envelope by Get-ScoutArmChildResource -- no longer

            # reverse-engineered out of the setting's own id.

            $parentResourceName = if ([string]::IsNullOrEmpty($1.PARENTNAME)) { 'Unknown' } else { [string]$1.PARENTNAME }

            $parentResourceType = if ([string]::IsNullOrEmpty($1.PARENTTYPE)) { 'Unknown' } else { [string]$1.PARENTTYPE }

            # Enabled log categories

            $enabledLogs = @()

            $disabledLogs = @()

            if ($data.logs) {

                foreach ($log in $data.logs) {

                    if ($log.enabled) { $enabledLogs += $log.category } else { $disabledLogs += $log.category }

                }

            }

            # Enabled metric categories

            $enabledMetrics = @()

            if ($data.metrics) {

                foreach ($metric in $data.metrics) {

                    if ($metric.enabled) { $enabledMetrics += $metric.category }

                }

            }

            # Destinations

            $destLAW = if ($data.workspaceId) { ($data.workspaceId -split '/')[-1] } else { 'None' }

            $destStorage = if ($data.storageAccountId) { ($data.storageAccountId -split '/')[-1] } else { 'None' }

            $destEventHub = if ($data.eventHubName) { $data.eventHubName } elseif ($data.eventHubAuthorizationRuleId) { ($data.eventHubAuthorizationRuleId -split '/')[-3] } else { 'None' }

            $destPartner = if ($data.marketplacePartnerId) { $data.marketplacePartnerId } else { 'None' }

'@

    AdditionalRowLoops = @()

    TagLoop = @{

        Variable = 'Tag'

        Source = '$Tags'

        Preamble = ''

    }

    Fields = @(

        @{

            Name = 'ID'

            Expression = '$1.id'

        }

        @{

            Name = 'Subscription'

            Expression = '$sub1.Name'

        }

        @{

            Name = 'Resource Group'

            Expression = '$1.RESOURCEGROUP'

        }

        @{

            Name = 'Diagnostic Setting Name'

            Expression = '$1.NAME'

        }

        @{

            Name = 'Parent Resource Name'

            Expression = '$parentResourceName'

        }

        @{

            Name = 'Parent Resource Type'

            Expression = '$parentResourceType'

        }

        @{

            Name = 'Enabled Log Categories'

            Expression = '$enabledLogs -join '', '''

        }

        @{

            Name = 'Disabled Log Categories'

            Expression = '$disabledLogs -join '', '''

        }

        @{

            Name = 'Enabled Metric Categories'

            Expression = '$enabledMetrics -join '', '''

        }

        @{

            Name = 'Destination: Log Analytics'

            Expression = '$destLAW'

        }

        @{

            Name = 'Destination: Storage'

            Expression = '$destStorage'

        }

        @{

            Name = 'Destination: Event Hub'

            Expression = '$destEventHub'

        }

        @{

            Name = 'Destination: Partner'

            Expression = '$destPartner'

        }

        @{

            Name = 'Resource U'

            Expression = '$ResUCount'

        }

        @{

            Name = 'Tag Name'

            Expression = '[string]$Tag.Name'

        }

        @{

            Name = 'Tag Value'

            Expression = '[string]$Tag.Value'

        }

    )

    Export = @{

        WorksheetName = 'Resource Diagnostic Settings'

        TableNamePrefix = 'ResDiagSettTable_'

        Columns = @(

            'Subscription'

            'Resource Group'

            'Diagnostic Setting Name'

            'Parent Resource Name'

            'Parent Resource Type'

            'Enabled Log Categories'

            'Disabled Log Categories'

            'Enabled Metric Categories'

            'Destination: Log Analytics'

            'Destination: Storage'

            'Destination: Event Hub'

            'Destination: Partner'

            'Resource U'

        )

        TagColumns = @()

        TagColumnsBefore = $null

        NumberFormat = '0'

        ConditionalText = @()

    }

    SourceCollector = 'Modules/Public/InventoryModules/Monitor/ResourceDiagnosticSettings.ps1'

}