Merge branch 'main' into main

Author: tksh164

azure-resources/Network/networkWatchers/kql/1e28bbc1-1eb7-486f-8d7f-93943f40219c.kql

@@ -1 +1,14 @@
-// under-development
+// Azure Resource Graph Query
+// This query will return all regions for which Network Watcher is deployed but Connection Monitor is not deployed
+Resources
+    | where type =~ "microsoft.network/networkwatchers"
+    | summarize by location, subscriptionId, name, id
+| join kind = leftouter (
+resources
+| where type =~ 'microsoft.network/networkwatchers/connectionmonitors'
+| summarize by location, subscriptionId
+    | project nwlocation = location, nwsubscriptionId = subscriptionId
+    )  on $left.location == $right.nwlocation,
+    $left.subscriptionId == $right.nwsubscriptionId
+      | where isnull(nwlocation) or isempty(nwlocation)
+| project recommendationId = "1e28bbc1-1eb7-486f-8d7f-93943f40219c", name, id, tags=''

azure-resources/Network/networkWatchers/kql/4e133bd0-8762-bc40-a95b-b29142427d73.kql

@@ -1 +1,15 @@
-// under-development
+// Azure Resource Graph Query
+// This query will return all regions for which Network Watcher is not deployed
+Resources
+| where location <> 'global'
+| summarize by location, subscriptionId
+| project location, subscriptionId
+| join kind = leftouter (
+    resources
+    | where type =~ "microsoft.network/networkwatchers"
+    | summarize by location, subscriptionId
+    | project nwlocation = location, nwsubscriptionId = subscriptionId
+    )  on $left.location == $right.nwlocation,
+    $left.subscriptionId == $right.nwsubscriptionId
+    | where isnull(nwlocation) or isempty(nwlocation)
+    | project recommendationId = "4e133bd0-8762-bc40-a95b-b29142427d73", name = strcat('NetworkWatcher_',location) , id=subscriptionId, tags='', param1 = strcat("missingLocation: ", location)

azure-resources/Network/privateDnsZones/kql/3538aa48-c40b-455b-a93b-269fe6e65be2.kql

@@ -1,2 +1,4 @@
-// under-development
-
+// Azure Resource Graph Query
+// This query will return Time-To-Live (TTL) for the DNS recordsets. Make sure it is set appropriately to ensure RTOs
+dnsresources
+| project recommendationId = "3538aa48-c40b-455b-a93b-269fe6e65be2", name, id, tags, param1 = strcat("Time-To-Live: ", tostring(properties.ttl))

azure-resources/Storage/storageAccounts/kql/e6c7e1cc-2f47-264d-aa50-1da421314472.kql

@@ -2,7 +2,6 @@
 // This query will return all storage accounts that are not using Zone or Region replication
 Resources
 | where type =~ "Microsoft.Storage/storageAccounts"
-| where location in~ ("australiaeast", "brazilsouth", "canadacentral", "centralindia", "centralus", "eastasia", "eastus", "eastus2", "francecentral", "germanywestcentral", "israelcentral", "italynorth", "japaneast", "japanwest", "koreacentral", "mexicocentral", "newzealandnorth", "northeurope", "norwayeast", "polandcentral", "qatarcentral", "southafricanorth", "southcentralus", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", "uaenorth", "uksouth", "westeurope", "westus2", "westus3", "usgovvirginia", "chinanorth3")
 | where sku.name in~ ("Standard_LRS", "Premium_LRS")
 | project recommendationId = "e6c7e1cc-2f47-264d-aa50-1da421314472", name, id, tags, param1 = strcat("sku: ", sku.name)