diff --git a/src/bicep/modules/azdo-rule-hits-by-resource.bicep b/src/bicep/modules/azdo-rule-hits-by-resource.bicep index 1a859f6..c18294a 100644 --- a/src/bicep/modules/azdo-rule-hits-by-resource.bicep +++ b/src/bicep/modules/azdo-rule-hits-by-resource.bicep @@ -23,6 +23,7 @@ var workbook = { name: 'resourceName' label: 'Resource Name' type: 2 + isRequired: true multiSelect: true quote: '\'' delimiter: ',' @@ -55,7 +56,7 @@ var workbook = { type: 3 content: { version: 'KqlItem/1.0' - query: '\r\nPSRule_CL\r\n| where TimeGenerated >= datetime_add(\'day\', -1, now()) and (TargetName_s in ({resourceName}) or \'All Resources\' == {resourceName})\r\n| extend a=parse_json(Annotations_s), f=parse_json(Field_s)\r\n| extend [\'Resource Id\']=f.id, Severity=a.severity, [\'Rule Help Url\']=a.[\'online version\'],Category=a.category\r\n| extend severity_level = case(\r\n Severity == "Informational" and Outcome_s == \'Fail\', 1,\r\n Severity == "Important" and Outcome_s == \'Fail\', 2,\r\n Severity == "Severe" and Outcome_s == \'Fail\', 3,\r\n Severity == "Critical" and Outcome_s == \'Fail\', 4,\r\n 0)\r\n| project [\'Resource FQN\']=TargetName_s,Rule=DisplayName_s,Outcome=Outcome_s,Severity,[\'Rule Help Url\'],severity_level\r\n| sort by severity_level desc' + query: 'PSRule_CL\r\n| where TimeGenerated >= datetime_add(\'day\', -1, now()) and (\'All Resources\' in ({resourceName}) or TargetName_s in ({resourceName}))\r\n| extend a=parse_json(Annotations_s), f=parse_json(Field_s)\r\n| extend [\'Resource Id\']=f.id, Severity=a.severity, [\'Rule Help Url\']=a.[\'online version\'],Category=a.category\r\n| extend severity_level = case(\r\n Severity == "Informational" and Outcome_s == \'Fail\', 1,\r\n Severity == "Important" and Outcome_s == \'Fail\', 2,\r\n Severity == "Severe" and Outcome_s == \'Fail\', 3,\r\n Severity == "Critical" and Outcome_s == \'Fail\', 4,\r\n 0)\r\n| project [\'Resource FQN\']=TargetName_s,Rule=DisplayName_s,Outcome=Outcome_s,Severity,[\'Rule Help Url\'],severity_level\r\n| sort by severity_level desc' size: 0 timeContext: { durationMs: 86400000