Search for Alerting Rule: Microsoft Azure Tokens
Click here to see this page in full context

Search for Alerting Rule: Microsoft Azure Tokens

Use the search tokens below that we provide during rule creation wizard.

subscriptionNamesubscriptionName

Use a text value ##### to find Azure connectors based on the subscription name associated with the connector at the time of creation.

Example

Show connectors with this subscription name

subscriptionName: Sample Cloud Subscription

subscriptionIdsubscriptionId

Use a text value ##### to find Azure connectos based on the unique subscription ID associated with the connector at the time of creation.

Example

Show connectors with this subscription ID

subscriptionId: fbb9ea64-abda-452e-adfa-83442409

regionregion

Select the region code from the drop-down menu. The drop-down menu options contains region code. For example, the region code for Singapore is ap-southeast-1. For the complete mapping of region code to region, view Azure Region Mapping.

Example

Find resources in the ap-southeast-1 (Singapore) region

region: ap-southeast-1

service.typeservice.type

Select the type of service you're interested in. Select from names in the drop-down menu. The drop-down menu options contains service type code. For example, the service code for Azure Active Directory is AZURE_AD. For the complete mapping of service type code to service type Azure Service Type Mapping.

Example

Show service type Azure Active Directory

service.type: AZURE_AD

resource.typeresource.type

Select the type of resource you're interested in. Select from names in the drop-down menu. The drop-down menu options contains of resource type code. For example, the service code for Network Security Group is NETWORK_SECURITY_GROUP. For the complete mapping of resource type code to resource type, view Azure Resource Type Mapping.

Example

Show resources of type Network Security Group

resource.type: NETWORK_SECURITY_GROUP

resource.idresource.id

Use a text value ##### to find resources by the unique ID assigned to the resource.

Example

Show resources with ID acl-8e5198f5

resource.id: acl-8e5198f5

cidcid

Use a text value ##### to show controls based on the unique control ID associated with the control at the time of creation.

Example

Show controls with this ID

cid: 205767712438

control.criticalitycontrol.criticality

Select the control criticality (HIGH, MEDIUM, LOW) you're interested in.

Example

Show controls with High criticality

control.criticality: HIGH

control.resultcontrol.result

Use control result value (FAIL) to view controls with specific result.

Example

Show controls that failed

control.result: FAIL

control.criticalitycontrol.criticality

Select the control criticality (HIGH, MEDIUM, LOW) you're interested in.

Example

Show controls with High criticality

control.criticality: HIGH

evaluatedOnevaluatedOn

Use a date range or specific date to define when the resource was evaluated on.

Examples

Show resources discovered within certain dates

evaluatedOn: [2018-01-01 ... 2018-03-01]

Show resources updated starting 2018-10-01, ending 1 month ago

evaluatedOn: [2018-01-01 ... now-1m]

Show resources updated starting 2 weeks ago, ending 1 second ago

evaluatedOn: [now-2w ... now-1s]

Show resources discovered on specific date

evaluatedOn: 2018-01-08

lastEvaluatedlastEvaluated

Use a date range or specific date to define when the resource was last evaluated on.

Examples

Show resources last evaluated within certain dates

lastEvaluated: [2018-01-01 ... 2018-03-01]

Show resources last evaluated starting 2018-10-01, ending 1 month ago

lastEvaluated: [2018-01-01 ... now-1m]

Show resources last evaluated starting 2 weeks ago, ending 1 second ago

lastEvaluated: [now-2w ... now-1s]

Show resources last evaluated on specific date

lastEvaluated: 2018-01-08

firstEvaluatedfirstEvaluated

Use a date range or specific date to define when the resource was first discovered and evaluated.

Examples

Show resources first evaluated within certain dates

firstEvaluated: [2018-01-01 ... 2018-03-01]

Show resources first evaluated starting 2018-10-01, ending 1 month ago

firstEvaluated: [2018-01-01 ... now-1m]

Show resources first evaluated starting 2 weeks ago, ending 1 second ago

firstEvaluated: [now-2w ... now-1s]

Show resources first evaluated on specific date

firstEvaluated: 2018-01-08

policy.namepolicy.name

Use values within quotes to find a CIS or AWS policy by name.

Examples

Show findings with this name

policy.name: CIS Amazon Web Services Foundations Benchmark

Show any findings that contain parts of name

policy.name: "CIS Amazon Web Services Foundations Benchmark"

Microsoft Azure Region Mapping

Code

Region Name

eastasia

 Hong Kong

southeastasia

 Singapore

centralus

 Iowa

eastus

 Virginia

eastus2

 Virginia 2

westus

 California

northcentralus

 Illinois

southcentralus

 Texas

northeurope

 Ireland

westeurope

 Netherlands

japaneast

 Tokyo Saitama

japanwest

 Osaka

brazilsouth

 Sao Paulo State

australiaeast

 New South Wales

australiasoutheast

 Victoria

southindia

 Chennai

centralindia

 Pune

westindia

 Mumbai

canadacentral

 Toronto

canadaeast

 Quebec City

uksouth

 London

ukwest

 Cardiff

westcentralus

 Wyoming

westus2

 Washington

koreacentral

 Seoul

koreasouth

 Busan

francecentral

 Paris

francesouth

 Marseille

australiacentral

 Canberra

australiacentral2

 Canberra 2

uaecentral

 UAE Central

uaenorth

 UAE North

southafricanorth

 Johannesburg

southafricawest

 Cape Town

switzerlandnorth

 Switzerland North

switzerlandwest

 Switzerland West

germanynorth

 Germany North

germanywestcentral

 Germany West Central

norwaywest

 Norway West

norwayeast

 Norway East

usgovvirginia

 US Gov Virginia

usgoviowa

 US Gov Iowa

usgovarizona

 US Gov Arizona

usgovtexas

 US Gov Texas

usdodeast

 US DoD East

usdodcentral

 US DoD Central

chinaeast

 Shanghai

chinanorth

 Beijing

germanycentral

 Frankfurt

germanynortheast

 Magdeburg

Microsoft Azure Service Type Mapping

Code

Service Type

VIRTUAL_MACHINE

Virtual Machines

VIRTUAL_NETWORK

Virtual Networks

RESOURCE_GROUP

Resource Groups

NETWORK_SECURITY_GROUP

Network Security Groups

SQL_SERVER_DATABASE

SQL Server Databases

SQL_SERVER

SQL Servers

SECURITY_CENTER

Security Center

STORAGE_ACCOUNT

Storage Account

MONITOR

Monitor

KEY_VAULT

Key Vault

PSQL_SERVER

PostgreSQL server

LOCKS

Locks

APP_SERVICE

App Service

AZURE_AD

Azure Active Directory

NETWORK_WATCHER

Network Watcher

MYSQL_SERVER

MySQL server

ACTIVITY_LOG

Activity Log

SNAPSHOT

Snapshot

KUBERNETES_SERVICE

Kubernetes Service

APPLICATION_GATEWAYS

Application Gateways

LOAD_BALANCER

Load Balancer

CONTAINER_REGISTRY

Container Registry

MARIADB_SERVER

MariaDB server

AZURE_SQL

Azure SQL

COSMOS_DB

Cosmos DB

DISK

Disk

Microsoft Azure Resource Mapping

Code

Resource Type

NETWORK_SECURITY_GROUP

Network Security Group

SQL_SERVER

SQL Server

SQL_SERVER_DATABASE

SQL Server Database

VIRTUAL_MACHINE

Virtual Machine

RESOURCE_GROUP

Resource Group

VIRTUAL_NETWORK

Virtual Network

SECURITY_POLICY

Security Policy

STORAGE_ACCOUNT

Storage Account

STORAGE_CONTAINER

Storage Container

ACTIVITY_LOG

Activity Log

DISK

Disk

KEY_VAULT

Key Vault

KEY

Key

SECRET

Secret

WEB_APP

Web App

FUNCTION_APP

Function App

APP_SERVICE_PLAN

App Service Plan

APPLICATION_GATEWAYS

Application Gateways

LOAD_BALANCER

Load Balancer

CONTAINER_REGISTRY

Container Registry

MARIADB_SERVER

MariaDB server

VIRTUAL_NETWORK_SUBNET

Virtual Network Subnet

VIRTUAL_NETWORK_PEERING

Virtual Network Peering

NETWORK_SECURITY_GROUP_FLOW_LOG

NSG Flow Log

COSMOS_DB

Cosmos DB