Workbook<\/a> does as well, but for a quick check you can load ARG in the Azure Portal.\u00a0 these are some basic query examples, but they could be the basis of more complex queries.<\/p>\n <\/p>\n
<\/p>\n
1. Azure Security Center:\u00a0 free vs. Standard licence<\/p>\n
securityresources\u00a0<\/strong> \n|\u00a0where\u00a0type\u00a0==\u00a0“microsoft.security\/pricings”<\/strong> \n| extend tier = trim(‘ ‘,tostring(properties.pricingTier))<\/strong> \n| summarize\u00a0\u00a0resource = make_set(name), tier = make_set(tier) by\u00a0\u00a0subscriptionId, tenantId<\/strong><\/p>\n <\/p>\n
2. Workspace details<\/p>\n
resources<\/strong> \n|\u00a0where\u00a0type\u00a0==\u00a0“microsoft.operationalinsights\/workspaces”<\/strong> \n|\u00a0extend\u00a0sku\u00a0=\u00a0tostring(properties.sku.name),\u00a0retention\u00a0=\u00a0tostring(properties.retentionInDays),\u00a0created\u00a0=\u00a0tostring(properties.createdDate),\u00a0modified\u00a0=\u00a0tostring(properties.modifiedDate)<\/strong> \n|\u00a0summarize\u00a0by\u00a0subscriptionId,\u00a0name,\u00a0sku,\u00a0retention,\u00a0created,\u00a0modified,\u00a0location<\/strong> \n|\u00a0order\u00a0by\u00a0sku\u00a0asc<\/strong><\/p>\n <\/p>\n
Example output from Query #2:\u00a0 This shows that most of my workspaces are set for 30day<\/strong> retention but one is 90days (in this case that’s the one that supports my Azure Sentinel., so that is correctly set as 90days is part of the free retention for Azure Sentinel).<\/p>\n <\/p>\n
Query 3:\u00a0 Much like Query2 but shows if its free or Standard per Subscription ID and Resource Name<\/p>\n
<\/p>\n
\n
securityresources\u00a0<\/strong><\/div>\n|\u00a0where\u00a0type\u00a0==\u00a0“microsoft.security\/pricings”<\/strong><\/div>\n|\u00a0extend\u00a0tier\u00a0=\u00a0trim(‘\u00a0‘,tostring(properties.pricingTier))<\/strong><\/div>\n|\u00a0summarize\u00a0\u00a0\u00a0tier\u00a0=\u00a0make_set(tier)\u00a0by\u00a0\u00a0subscriptionId,\u00a0name<\/strong><\/div>\n|\u00a0order\u00a0by\u00a0subscriptionId<\/strong><\/div>\n<\/div>\n<\/div>\n
Query 4: For Azure Sentinel workspaces<\/p>\n
resources<\/strong> \n\/\/ Just show Workspaces that have Azure Sentinel enabled<\/strong> \n|\u00a0where\u00a0type\u00a0==\u00a0“microsoft.operationsmanagement\/solutions”<\/strong> \n|\u00a0where\u00a0name\u00a0contains\u00a0“SecurityInsights”<\/strong> \n|\u00a0project\u00a0WorkspaceName=name,\u00a0S_CreatedDate=properties.creationTime,\u00a0S_ModifiedDate=properties.lastModifiedTime\u00a0,\u00a0day\u00a0=\u00a0datetime_diff(‘day’,now(),todatetime(properties.creationTime))<\/strong><\/p>\n <\/p>\n<\/div>\n
<\/div>\n","protected":false},"excerpt":{"rendered":"
A few times this week I’ve had two discussions. How is my Azure Security Center (ASC) licenced and configured? And how many workspaces do I have, and what retention policy is set. You can look in the portal, however to do this at scale, lets use Azure Resource graph: I suggest you use<\/p>\n","protected":false},"author":424,"featured_media":17607,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"categories":[1],"post_tag":[1356,882,424],"content-type":[],"coauthors":[],"class_list":["post-34773","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cross-industry","tag-azure-monitor-logs","tag-azure-sentinel","tag-hybridcloud"],"yoast_head":"\n
Audit at scale. Workspaces and Azure Security Center - Microsoft Industry Blogs - United Kingdom<\/title>\n \n \n \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n\t \n\t \n\t \n