diff --git a/Azure Services/Azure Arc/Queries/MultiSQLBPAAlerts b/Azure Services/Azure Arc/Queries/MultiSQLBPAAlerts new file mode 100644 index 00000000..9585630f --- /dev/null +++ b/Azure Services/Azure Arc/Queries/MultiSQLBPAAlerts @@ -0,0 +1,22 @@ +//Modified query to find all Windows SQL server Best Practice Assessment Alerts in a single query +//Updated by Lee Schuenemeyer Principal Technical Specialist Microsoft Enterprise HPSI +let timeSpan = toscalar(workbookParameter("TimeRange", "7d")); +let selectedCategories = dynamic([]); +let selectedTotSev = dynamic([]); +SqlAssessment_CL +| extend asmt = parse_csv(RawData) +| extend AsmtId=tostring(asmt[1]), CheckId=tostring(asmt[2]), DisplayString=asmt[3], Description=tostring(asmt[4]), HelpLink=asmt[5], TargetType=case(asmt[6] == 1, "Server", asmt[6] == 2, "Database", ""), TargetName=tostring(asmt[7]), +Severity=case(asmt[8] == 30, "High", asmt[8] == 20, "Medium", asmt[8] == 10, "Low", asmt[8] == 0, "Information", asmt[8] == 1, "Warning", asmt[8] == 2, "Critical", "Passed"), Message=tostring(asmt[9]), TagsArr=split(tostring(asmt[10]), ","), Sev = toint(asmt[8]) +| where (Sev >= 0 and array_length(selectedTotSev) == 0 or Sev in (selectedTotSev)) +| project +TargetType, +TargetName, +Severity, +Message, +Tags=strcat_array(array_slice(TagsArr, 1, -1), ','), +CheckId, +Description, +HelpLink = tostring(HelpLink), +SeverityCode = toint(Sev) +| order by SeverityCode desc, TargetType desc, TargetName asc +| project-away SeverityCode