More Kusto – Azure Backup reporting

Using KQL against Azure Resource Graph; and here’s another useful snippet – it’s faster by far than PowerShell, subsecond result set.

RecoveryServicesResources

| join kind=leftouter (ResourceContainers | where type==’microsoft.resources/subscriptions’ | project SubName=name, subscriptionId) on subscriptionId

| where type == “microsoft.recoveryservices/vaults/backupjobs”

| where properties.backupManagementType == “AzureIaasVM”

| extend rsg = replace(“;[[:graph:]]*”, “”, replace(“iaasvmcontainerv2;”,””,tostring(properties.containerName)))

| extend vmname = tolower(tostring(properties.entityFriendlyName))

| extend rsvault = tolower(replace(“/[[:graph:]]*”,””, replace(“[[:graph:]]*\\/vaults\\/”,””,id)))

| extend backupage = datetime_diff(‘day’, now(), todatetime(properties.endTime))

| project SubName, rsg, vmname, rsvault, properties.operationCategory, properties.status, backupage