Extracting Nested Fields in Kusto 2.0

What a difference 3 years makes. Since my last Extracting nested fields post, I’ve learned a lot and thought it might be time to provide a new post with new examples and more ways to accomplish the same goal. Like the first version, but better! Operators, Functions & Dynamic Types, Oh my! There are a number …

Read more

Azure Monitor, Security Center, Sentinel Infrastructure as Code with Bicep

When deploying resources to Azure, you have several options, the Azure Portal, PowerShell, Azure Resource Management (ARM) Templates, and now we have Bicep templates. In this post I’ll share a Bicep template I’ve made to help you deploy Log Analytics, the backbone of Azure Monitor, Sentinel and Security Center. For the operations monitoring Application Insights, …

Read more

Azure Workbooks: Icons Thresholds & Heatmaps

Today I want to show you how you can use icons, thresholds and heatmaps in Azure Monitor and Azure Sentinel Workbooks. These have long been things I’ve used in almost all my workbooks. Along with grouping and showing resource icons, these are what I consider nice touches that take your workbooks from a nice idea …

Read more

How to use Grouping Azure Workbooks

This is the second post in some Azure Workbooks quick tips. You can find the first one here. As your Azure environment grows, you’re likely to encounter situations where you have 2 or more subscriptions. Or if you are using Azure Lighthouse you might have dozens or hundreds of subscriptions under your management. This can …

Read more

How to Show Azure Resource Icons in Workbooks

One of my favorite tricks when building Azure Monitor or Azure Sentinel workbooks is to include the Azure Resource specific icons next to resources. For metric based resources the icons are including for you automatically when using Grid visualization. But for logs, you need to bring in  ‘_ResourceId’ in Log Analytics. For Azure Resourec Graph …

Read more

How to Import Azure Monitor, Sentinel Workbooks

A common request I get is how to import one of my Azure Monitor Workbooks into Azure. In this post I’ll show you several ways to import them. Here are some of my Workbooks you can import. Ultimate Azure Inventory Azure SQL LogicApps/Azure Sentinel Playbooks Azure Automation Update Management Azure File Sync Syslog Windows Event …

Read more