Azure / Azure-Proactive-Resiliency-Library-v2

Azure Proactive Resiliency Library v2 (APRL) - Source for Azure WAF reliability guidance and associated ARG queries
https://azure.github.io/Azure-Proactive-Resiliency-Library-v2/
MIT License
39 stars 59 forks source link

πŸ’‘ Feature Request - Custom Filtering Scenario #225

Closed terrymandin closed 11 hours ago

terrymandin commented 2 weeks ago

Describe the solution you'd like

Below is a complex query I needed to do for my WARA. Please consider adding this functionality to an upcoming release.

(     In a resource group with a name containing "PRD" or "PROD"       OR       A resource name containing "PRD" or "PROD" ) OR (     A virtual machine name that starts with β€œAZ-[W,L][D,T,P]”. The W or L is Windows or Linux, and the DRP is Dev/Test/Prod. )

Describe alternatives you've considered

I imported the ImpactedResources into MS Access and did the complex querying there. e.g.:

SELECT ImpactedResources.resourceType, ImpactedResources.name, ImpactedResources.id
FROM ImpactedResources
WHERE (((((([ImpactedResources].[id]) Like "*PRD*" Or ([ImpactedResources].[id]) Like "*PROD*")) Or ((([ImpactedResources].[resourceType])="Microsoft.Compute/virtualMachines") And ((UCase([ImpactedResources].[name])) Like "AZ-[LW][P]*")))=True))
GROUP BY ImpactedResources.resourceType, ImpactedResources.name, ImpactedResources.id
ORDER BY ImpactedResources.name;

Additional context

oZakari commented 1 week ago

Hey @terrymandin, could you clarify the ask here? This looks like a query for SQL and not for KQL based upon the operators you're using.

microsoft-github-policy-service[bot] commented 4 days ago

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 4 days. It will be closed if no further activity occurs within 3 days of this comment.