More kusto – Reading email recipients for Azure Action Groups

by ezs | Jun 1, 2023 | evilzenscientist

Lots of hygiene work, including cleaning up Azure Action Groups that send to individual emails. That’s a red flag and anti pattern.

Here’s the KQL to read the Action Groups, their subscriptions, and expand out the recipients.

It’s easy work to continue to audit this, and clean up the dead wood.

resources

| join kind=leftouter (ResourceContainers | where type==’microsoft.resources/subscriptions’ | project SubName=name, subscriptionId) on subscriptionId

| where type == “microsoft.insights/actiongroups”

| extend emailRecsCount =array_length(properties.emailReceivers)

| mv-expand emailRecs = properties.emailReceivers

| project SubName, resourceGroup, name, emailRecsCount, emailRecs.name, emailRecs.status, emailRecs.emailAddress

| order by [‘name’] asc

Using the Azure VM Agent to find server health

by ezs | Jun 1, 2023 | evilzenscientist

I discovered a pool of servers that seemed to be unused, and used the Azure VM Agent “Run PowerShell Script” to determine the real health.

The output told me: not domain joined, not managed, not being patched, so targets for decommissioning.

$boot = Get-CimInstance -ClassName Win32_OperatingSystem

$hotfix = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1

$name = Get-CimInstance -Classname Win32_ComputerSystem

write-host “Server $($name.name) Domain $($name.domain)”

write-host “Last reboot $($boot.LastBootUpTime)”

write-host “Last patch $($hotfix.HotFixID) $($hotfix.InstalledOn)”

Server FOOSERVER Domain WORKGROUP
Last reboot 10/12/2022 18:50:02
Last patch KB4495585 05/15/2019 00:00:00