如何查找未关联/孤立Azure警报组

lsmd5eda  于 2023-03-24  发布在  其他
关注(0)|答案(1)|浏览(87)

我有许多订阅,其中用户之前创建了不同的Azure警报操作组。现在我正在清理那些未关联或孤立的操作组(未与任何警报规则关联)
是否有查询(API/CLI/PowerShell/Graph Query)的方法来获取未关联的操作组列表?

ru9i0ody

ru9i0ody1#

我已经跟踪并从@Juval的answer中获取代码,我尝试在我的环境中重现,并获得了预期的结果如下:

az login
$x=az graph query -q "Resources| where type == 'microsoft.insights/actiongroups'| project name"
$m=$x | ConvertFrom-json
$v=$m.data.name

$y=az graph query -q "Resources| project alertName = name, location, type,props = properties| where type contains 'microsoft.insights/activitylogalerts' | mvexpand actionGroups = parse_json(props['actions']['actionGroups'])| extend actionGroup = extract(@'([^\/]+$)',1,tostring(actionGroups.actionGroupId))| union (resources| project alertName = name,location,type,props = properties| where type contains 'microsoft.insights/metricalerts'| mvexpand actionGroups = parse_json(props['actions'])| extend actionGroup = extract(@'([^\/]+$)',1,tostring(actionGroups.actionGroupId)))|project actionGroup" | ConvertFrom-Json

$t=$y.data.actionGroup 

$diff = Compare-Object $v $t
$result = $diff | Where-Object { $_.SideIndicator -eq "<=" } | Select-Object -ExpandProperty InputObject
$result

输出:

这里$v包含所有操作组的名称。
$t包含与警报关联的操作组名称。
$result包含与警报无关的操作组的名称。

相关问题