diff --git a/samples/features/azure-arc/workbooks/Azure Arc Sql Servers - Best Practices Assessment.workbook b/samples/features/azure-arc/workbooks/Azure Arc Sql Servers - Best Practices Assessment.workbook
index df04edf6..e30077d2 100644
--- a/samples/features/azure-arc/workbooks/Azure Arc Sql Servers - Best Practices Assessment.workbook
+++ b/samples/features/azure-arc/workbooks/Azure Arc Sql Servers - Best Practices Assessment.workbook
@@ -1,356 +1,530 @@
{
- "version": "Notebook/1.0",
- "items": [
- {
- "type": 1,
- "content": {
- "json": "# Azure Arc SQL Servers - Best Practices Assessment"
+ "version": "Notebook/1.0",
+ "items": [
+ {
+ "type": 1,
+ "content": {
+ "json": "# Azure Arc SQL Servers - Best Practices Assessment"
+ },
+ "name": "text - 2"
},
- "name": "text - 2"
- },
- {
- "type": 9,
- "content": {
- "version": "KqlParameterItem/1.0",
- "crossComponentResources": [
- "{Subscription}"
- ],
- "parameters": [
- {
- "id": "5ccbaa77-2a42-4a07-a877-b5a3a6297703",
- "version": "KqlParameterItem/1.0",
- "name": "Subscription",
- "type": 6,
- "isRequired": true,
- "multiSelect": true,
- "quote": "'",
- "delimiter": ",",
- "typeSettings": {
- "additionalResourceOptions": [
+ {
+ "type": 9,
+ "content": {
+ "version": "KqlParameterItem/1.0",
+ "crossComponentResources": [
+ "{LogAnalitycsWorkpace}"
+ ],
+ "parameters": [
+ {
+ "id": "5ccbaa77-2a42-4a07-a877-b5a3a6297703",
+ "version": "KqlParameterItem/1.0",
+ "name": "Subscription",
+ "type": 6,
+ "isRequired": true,
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "typeSettings": {
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "includeAll": true,
+ "showDefault": false
+ },
+ "timeContext": {
+ "durationMs": 86400000
+ },
+ "value": [
"value::all"
+ ]
+ },
+ {
+ "id": "f932fba5-395b-423d-a9b0-538714e1e553",
+ "version": "KqlParameterItem/1.0",
+ "name": "LogAnalitycsWorkpace",
+ "type": 5,
+ "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id",
+ "crossComponentResources": [
+ "{Subscription}"
],
- "includeAll": true,
- "showDefault": false
+ "typeSettings": {
+ "additionalResourceOptions": []
+ },
+ "queryType": 1,
+ "resourceType": "microsoft.resourcegraph/resources",
+ "value": "/subscriptions/71ac1fd6-9ebc-4a20-9667-b873f7cee091/resourceGroups/Arc-Demo/providers/Microsoft.OperationalInsights/workspaces/LA-AzureArc"
},
- "timeContext": {
- "durationMs": 86400000
- },
- "value": [
- "value::all"
+ {
+ "id": "95f19603-3001-41ca-8340-621f3887a3b3",
+ "version": "KqlParameterItem/1.0",
+ "name": "ServerName",
+ "type": 2,
+ "description": "Azure Arc ServerName",
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "query": "SqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend ServerName = tostring(split(tostring(asmt[7]),\":\",0)[0])\r\n| distinct ServerName",
+ "crossComponentResources": [
+ "{LogAnalitycsWorkpace}"
+ ],
+ "typeSettings": {
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "showDefault": false
+ },
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "value": [
+ "SQL2014",
+ "ARC2012R2SQL",
+ "ARC2016SQL"
+ ]
+ }
+ ],
+ "style": "pills",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "name": "parameters - 7"
+ },
+ {
+ "type": 1,
+ "content": {
+ "json": "![\"drawing\"](\"https://code.benco.io/icon-collection/azure-icons/Azure-Arc.svg\")
\r\n![\"drawing\"](\"https://code.benco.io/icon-collection/azure-icons/SQL-Server.svg\")
"
+ },
+ "customWidth": "33",
+ "name": "text - 9"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "SqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend\r\n AsmtId=tostring(asmt[1]),\r\n CheckId=tostring(asmt[2]),\r\n DisplayString=asmt[3],\r\n Description=tostring(asmt[4]),\r\n HelpLink=asmt[5],\r\n TargetType=case(asmt[6] == 1, \"Server\", asmt[6] == 2, \"Database\", \"\"),\r\n TargetName=tostring(asmt[7]), \r\n Severity=case(asmt[8] == 30, \"High\", asmt[8] == 20, \"Medium\", asmt[8] == 10, \"Low\", asmt[8] == 0, \"Information\", asmt[8] == 1, \"Warning\", asmt[8] == 2, \"Critical\", \"Passed\"),\r\n Message=tostring(asmt[9]),\r\n TagsArr=split(tostring(asmt[10]), \",\"),\r\n Sev = toint(asmt[8])\r\n | order by CheckId, _ResourceId\r\n | join kind=inner\r\n (\r\n SqlAssessment_CL\r\n | extend asmt = parse_csv(RawData)\r\n | extend\r\n AsmtId=tostring(asmt[1]) \r\n | summarize arg_max(TimeGenerated, *) by _ResourceId\r\n | project AsmtId\r\n ) on AsmtId\r\n |where Sev >= 0\r\n | extend ServerName = split(TargetName,\":\",0)[0]\r\n | where ServerName in ({ServerName})\r\n | summarize count() by Severity, Sev\r\n | order by Sev",
+ "size": 3,
+ "title": "Issues by severity",
+ "exportFieldName": "Severity",
+ "exportParameterName": "severity",
+ "exportDefaultValue": "",
+ "showExportToExcel": true,
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "crossComponentResources": [
+ "{LogAnalitycsWorkpace}"
+ ],
+ "visualization": "table",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Severity",
+ "formatter": 8,
+ "formatOptions": {
+ "min": 0,
+ "max": 40,
+ "palette": "coldHot"
+ }
+ },
+ {
+ "columnMatch": "Sev",
+ "formatter": 8,
+ "formatOptions": {
+ "min": 0,
+ "max": 40,
+ "palette": "coldHot"
+ }
+ }
]
},
- {
- "id": "f932fba5-395b-423d-a9b0-538714e1e553",
- "version": "KqlParameterItem/1.0",
- "name": "LogAnalitycsWorkpace",
- "type": 5,
- "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id",
- "crossComponentResources": [
- "{Subscription}"
- ],
- "typeSettings": {
- "additionalResourceOptions": []
- },
- "queryType": 1,
- "resourceType": "microsoft.resourcegraph/resources",
- "value": "/subscriptions/71ac1fd6-9ebc-4a20-9667-b873f7cee091/resourceGroups/Arc-Demo/providers/Microsoft.OperationalInsights/workspaces/LA-AzureArc"
- }
- ],
- "style": "pills",
- "queryType": 1,
- "resourceType": "microsoft.resourcegraph/resources"
- },
- "name": "parameters - 7"
- },
- {
- "type": 3,
- "content": {
- "version": "KqlItem/1.0",
- "query": "SqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend\r\n AsmtId=tostring(asmt[1]),\r\n CheckId=tostring(asmt[2]),\r\n DisplayString=asmt[3],\r\n Description=tostring(asmt[4]),\r\n HelpLink=asmt[5],\r\n TargetType=case(asmt[6] == 1, \"Server\", asmt[6] == 2, \"Database\", \"\"),\r\n TargetName=tostring(asmt[7]), \r\n Severity=case(asmt[8] == 30, \"High\", asmt[8] == 20, \"Medium\", asmt[8] == 10, \"Low\", asmt[8] == 0, \"Information\", asmt[8] == 1, \"Warning\", asmt[8] == 2, \"Critical\", \"Passed\"),\r\n Message=tostring(asmt[9]),\r\n TagsArr=split(tostring(asmt[10]), \",\"),\r\n Sev = toint(asmt[8])\r\n | order by CheckId, _ResourceId\r\n | join kind=inner\r\n (\r\n SqlAssessment_CL\r\n | extend asmt = parse_csv(RawData)\r\n | extend\r\n AsmtId=tostring(asmt[1]) \r\n | summarize arg_max(TimeGenerated, *) by _ResourceId\r\n | project AsmtId\r\n ) on AsmtId\r\n |where Sev >= 0\r\n | summarize count() by Severity, Sev\r\n | order by Sev",
- "size": 3,
- "title": "Issues by severity",
- "exportFieldName": "Severity",
- "exportParameterName": "severity",
- "showExportToExcel": true,
- "queryType": 0,
- "resourceType": "microsoft.operationalinsights/workspaces",
- "crossComponentResources": [
- "{LogAnalitycsWorkpace}"
- ],
- "visualization": "table",
- "gridSettings": {
- "formatters": [
- {
- "columnMatch": "Severity",
- "formatter": 8,
- "formatOptions": {
- "min": 0,
- "max": 40,
- "palette": "coldHot"
+ "chartSettings": {
+ "seriesLabelSettings": [
+ {
+ "seriesName": "Medium",
+ "color": "orange"
+ },
+ {
+ "seriesName": "Low",
+ "color": "blue"
+ },
+ {
+ "seriesName": "High",
+ "color": "redBright"
+ },
+ {
+ "seriesName": "Information",
+ "color": "blueDark"
}
+ ],
+ "ySettings": {
+ "numberFormatSettings": {
+ "unit": 0,
+ "options": {
+ "style": "decimal",
+ "useGrouping": true
+ }
+ }
+ }
+ }
+ },
+ "customWidth": "67",
+ "name": "query - 4"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "SqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend\r\n AsmtId=tostring(asmt[1]),\r\n CheckId=tostring(asmt[2]),\r\n DisplayString=asmt[3],\r\n Description=tostring(asmt[4]),\r\n HelpLink=asmt[5],\r\n TargetType=case(asmt[6] == 1, \"Server\", asmt[6] == 2, \"Database\", \"\"),\r\n TargetName=tostring(asmt[7]), \r\n Severity=case(asmt[8] == 30, \"High\", asmt[8] == 20, \"Medium\", asmt[8] == 10, \"Low\", asmt[8] == 0, \"Information\", asmt[8] == 1, \"Warning\", asmt[8] == 2, \"Critical\", \"Passed\"),\r\n Message=tostring(asmt[9]),\r\n TagsArr=split(tostring(asmt[10]), \",\"),\r\n Sev = toint(asmt[8])\r\n | order by CheckId, _ResourceId\r\n | join kind=inner\r\n (\r\n SqlAssessment_CL\r\n | extend asmt = parse_csv(RawData)\r\n | extend\r\n AsmtId=tostring(asmt[1]) \r\n | summarize arg_max(TimeGenerated, *) by _ResourceId\r\n | project AsmtId\r\n ) on AsmtId\r\n |where Sev >= 0 \r\n and TargetType == \"Server\"\r\n | extend ServerName = split(TargetName,\":\",0)[0]\r\n | where ServerName in ({ServerName})\r\n | order by Sev, CheckId\r\n | summarize count() by TargetName \r\n",
+ "size": 3,
+ "title": "Issues by server",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "crossComponentResources": [
+ "{LogAnalitycsWorkpace}"
+ ],
+ "visualization": "piechart",
+ "chartSettings": {
+ "seriesLabelSettings": [
+ {
+ "seriesName": "Protected",
+ "color": "green"
+ },
+ {
+ "seriesName": "Unknown",
+ "color": "gray"
+ },
+ {
+ "seriesName": "Not Protected",
+ "color": "redBright"
+ }
+ ]
+ }
+ },
+ "customWidth": "33",
+ "name": "query - 4 - Copy"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "SqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend\r\n AsmtId=tostring(asmt[1]),\r\n CheckId=tostring(asmt[2]),\r\n DisplayString=asmt[3],\r\n Description=tostring(asmt[4]),\r\n HelpLink=asmt[5],\r\n TargetType=case(asmt[6] == 1, \"Server\", asmt[6] == 2, \"Database\", \"\"),\r\n TargetName=tostring(asmt[7]), \r\n Severity=case(asmt[8] == 30, \"High\", asmt[8] == 20, \"Medium\", asmt[8] == 10, \"Low\", asmt[8] == 0, \"Information\", asmt[8] == 1, \"Warning\", asmt[8] == 2, \"Critical\", \"Passed\"),\r\n Message=tostring(asmt[9]),\r\n TagsArr=split(tostring(asmt[10]), \",\"),\r\n Sev = toint(asmt[8])\r\n | order by CheckId, _ResourceId\r\n | join kind=inner\r\n (\r\n SqlAssessment_CL\r\n | extend asmt = parse_csv(RawData)\r\n | extend\r\n AsmtId=tostring(asmt[1]) \r\n | summarize arg_max(TimeGenerated, *) by _ResourceId\r\n | project AsmtId\r\n ) on AsmtId\r\n |where Sev >= 0 \r\n and TargetType == \"Database\"\r\n | extend ServerName = split(TargetName,\":\",0)[0]\r\n | where ServerName in ({ServerName})\r\n | order by Sev, CheckId\r\n | summarize count() by TargetName \r\n",
+ "size": 3,
+ "title": "Issues by Database",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "crossComponentResources": [
+ "{LogAnalitycsWorkpace}"
+ ],
+ "visualization": "piechart"
+ },
+ "customWidth": "33",
+ "name": "query - 4 - Copy - Copy"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "\r\nSqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend\r\n AsmtId=tostring(asmt[1]),\r\n CheckId=tostring(asmt[2]),\r\n DisplayString=asmt[3],\r\n Description=tostring(asmt[4]),\r\n HelpLink=asmt[5],\r\n TargetType=case(asmt[6] == 1, \"Server\", asmt[6] == 2, \"Database\", \"\"),\r\n TargetName=tostring(asmt[7]), \r\n Severity=case(asmt[8] == 30, \"High\", asmt[8] == 20, \"Medium\", asmt[8] == 10, \"Low\", asmt[8] == 0, \"Information\", asmt[8] == 1, \"Warning\", asmt[8] == 2, \"Critical\", \"Passed\"),\r\n Message=tostring(asmt[9]),\r\n TagsArr=split(tostring(asmt[10]), \",\"),\r\n Sev = toint(asmt[8])\r\n | order by CheckId, _ResourceId\r\n | join kind=inner\r\n (\r\n SqlAssessment_CL\r\n | extend asmt = parse_csv(RawData)\r\n | extend\r\n AsmtId=tostring(asmt[1]) \r\n | summarize arg_max(TimeGenerated, *) by _ResourceId\r\n | project AsmtId\r\n ) on AsmtId\r\n |where Sev >= 0\r\n | extend ServerName = split(TargetName,\":\",0)[0]\r\n | where ServerName in ({ServerName})\r\n and Severity == \"{severity}\"\r\n | order by Sev, CheckId\r\n | project CheckId, Description, _ResourceId, AsmtId, Sev, Severity \r\n",
+ "size": 3,
+ "title": "Issues by Severity Level: {severity}",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "crossComponentResources": [
+ "{LogAnalitycsWorkpace}"
+ ]
+ },
+ "name": "query - 8"
+ },
+ {
+ "type": 9,
+ "content": {
+ "version": "KqlParameterItem/1.0",
+ "crossComponentResources": [
+ "{LogAnalitycsWorkpace}"
+ ],
+ "parameters": [
+ {
+ "id": "ced45d66-52da-4f9c-b473-6781309a78cc",
+ "version": "KqlParameterItem/1.0",
+ "name": "CheckId",
+ "type": 2,
+ "isRequired": true,
+ "query": "\r\nSqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend\r\n AsmtId=tostring(asmt[1]),\r\n CheckId=tostring(asmt[2]),\r\n DisplayString=asmt[3],\r\n Description=tostring(asmt[4]),\r\n HelpLink=asmt[5],\r\n TargetType=case(asmt[6] == 1, \"Server\", asmt[6] == 2, \"Database\", \"\"),\r\n TargetName=tostring(asmt[7]), \r\n Severity=case(asmt[8] == 30, \"High\", asmt[8] == 20, \"Medium\", asmt[8] == 10, \"Low\", asmt[8] == 0, \"Information\", asmt[8] == 1, \"Warning\", asmt[8] == 2, \"Critical\", \"Passed\"),\r\n Message=tostring(asmt[9]),\r\n TagsArr=split(tostring(asmt[10]), \",\"),\r\n Sev = toint(asmt[8])\r\n | order by CheckId, _ResourceId\r\n | join kind=inner\r\n (\r\n SqlAssessment_CL\r\n | extend asmt = parse_csv(RawData)\r\n | extend\r\n AsmtId=tostring(asmt[1]) \r\n | summarize arg_max(TimeGenerated, *) by _ResourceId\r\n | project AsmtId\r\n ) on AsmtId\r\n |where Sev >= 0\r\n | extend ServerName = split(TargetName,\":\",0)[0]\r\n | where ServerName in ({ServerName})\r\n and Severity == \"{severity}\"\r\n | distinct (CheckId)\r\n|order by CheckId asc\r\n\r\n\r\n ",
+ "crossComponentResources": [
+ "{LogAnalitycsWorkpace}"
+ ],
+ "typeSettings": {
+ "additionalResourceOptions": [],
+ "showDefault": false
+ },
+ "timeContext": {
+ "durationMs": 2592000000
+ },
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "value": null
+ }
+ ],
+ "style": "pills",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "name": "paarameter_CheckId"
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "items": [
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "SqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend\r\n AsmtId=tostring(asmt[1]),\r\n CheckId=tostring(asmt[2]),\r\n DisplayString=asmt[3],\r\n Description=tostring(asmt[4]),\r\n HelpLink=asmt[5],\r\n TargetType=case(asmt[6] == 1, \"Server\", asmt[6] == 2, \"Database\", \"\"),\r\n TargetName=tostring(asmt[7]), \r\n Severity=case(asmt[8] == 30, \"High\", asmt[8] == 20, \"Medium\", asmt[8] == 10, \"Low\", asmt[8] == 0, \"Information\", asmt[8] == 1, \"Warning\", asmt[8] == 2, \"Critical\", \"Passed\"),\r\n Message=tostring(asmt[9]),\r\n TagsArr=split(tostring(asmt[10]), \",\"),\r\n Sev = toint(asmt[8])\r\n | order by CheckId, _ResourceId\r\n | join kind=inner\r\n (\r\n SqlAssessment_CL\r\n | extend asmt = parse_csv(RawData)\r\n | extend\r\n AsmtId=tostring(asmt[1]) \r\n | summarize arg_max(TimeGenerated, *) by _ResourceId\r\n | project AsmtId\r\n ) on AsmtId\r\n | extend ServerName = split(TargetName,\":\",0)[0]\r\n | where ServerName in ({ServerName})\r\n | where CheckId == \"{CheckId}\"\r\n |where Sev >= 0\r\n | order by Sev, CheckId\r\n| project TimeGenerated, CheckId,DisplayString,TargetName,Severity,TargetType,Description,Message,HelpLink,TagsArr",
+ "size": 0,
+ "exportedParameters": [
+ {
+ "fieldName": "Description",
+ "parameterName": "Description",
+ "parameterType": 1
+ },
+ {
+ "fieldName": "Message",
+ "parameterName": "Message",
+ "parameterType": 1
+ },
+ {
+ "fieldName": "HelpLink",
+ "parameterName": "HelpLink",
+ "parameterType": 1
+ },
+ {
+ "fieldName": "TagsArr",
+ "parameterName": "TagsArr",
+ "parameterType": 1
+ }
+ ],
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "crossComponentResources": [
+ "{LogAnalitycsWorkpace}"
+ ],
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "TimeGenerated",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "22.2851ch"
+ }
+ },
+ {
+ "columnMatch": "CheckId",
+ "formatter": 18,
+ "formatOptions": {
+ "linkColumn": "HelpLink",
+ "linkTarget": "Url",
+ "linkLabel": "",
+ "linkIsContextBlade": false,
+ "thresholdsOptions": "icons",
+ "thresholdsGrid": [
+ {
+ "operator": "Default",
+ "thresholdValue": null,
+ "representation": "Hyperlink",
+ "text": "{0}{1}"
+ }
+ ],
+ "customColumnWidthSetting": "14.8566ch"
+ }
+ },
+ {
+ "columnMatch": "DisplayString",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "29.7131ch"
+ }
+ },
+ {
+ "columnMatch": "TargetName",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "20.5706ch"
+ }
+ },
+ {
+ "columnMatch": "Severity",
+ "formatter": 18,
+ "formatOptions": {
+ "thresholdsOptions": "icons",
+ "thresholdsGrid": [
+ {
+ "operator": "==",
+ "thresholdValue": "High",
+ "representation": "Sev0",
+ "text": "{0}"
+ },
+ {
+ "operator": "==",
+ "thresholdValue": "Medium",
+ "representation": "Sev1",
+ "text": "{0}"
+ },
+ {
+ "operator": "==",
+ "thresholdValue": "Low",
+ "representation": "Sev2",
+ "text": "{0}"
+ },
+ {
+ "operator": "==",
+ "thresholdValue": "Information",
+ "representation": "Sev3",
+ "text": "{0}"
+ },
+ {
+ "operator": "Default",
+ "thresholdValue": null,
+ "representation": "success",
+ "text": "{0}{1}"
+ }
+ ],
+ "customColumnWidthSetting": "16.2846ch"
+ }
+ },
+ {
+ "columnMatch": "TargetType",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "16ch"
+ }
+ },
+ {
+ "columnMatch": "Description",
+ "formatter": 5
+ },
+ {
+ "columnMatch": "Message",
+ "formatter": 5
+ },
+ {
+ "columnMatch": "HelpLink",
+ "formatter": 5
+ },
+ {
+ "columnMatch": "TagsArr",
+ "formatter": 5
+ }
+ ]
+ }
+ },
+ "customWidth": "65",
+ "name": "query - 0"
},
{
- "columnMatch": "Sev",
- "formatter": 8,
- "formatOptions": {
- "min": 0,
- "max": 40,
- "palette": "coldHot"
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "items": [
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "title": " Description",
+ "items": [
+ {
+ "type": 1,
+ "content": {
+ "json": "{Description}",
+ "style": "info"
+ },
+ "name": "Description",
+ "styleSettings": {
+ "showBorder": true
+ }
+ }
+ ]
+ },
+ "name": "Description"
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "title": " Message",
+ "items": [
+ {
+ "type": 1,
+ "content": {
+ "json": "{Message}",
+ "style": "warning"
+ },
+ "name": "text - 1"
+ }
+ ]
+ },
+ "name": "Message"
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "title": "Tags",
+ "items": [
+ {
+ "type": 1,
+ "content": {
+ "json": "{TagsArr}"
+ },
+ "name": "Tags"
+ }
+ ]
+ },
+ "name": "Tags"
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "title": " Help Link",
+ "items": [
+ {
+ "type": 1,
+ "content": {
+ "json": "{HelpLink}"
+ },
+ "name": "text - 2"
+ }
+ ]
+ },
+ "name": "HelpLink"
+ }
+ ]
+ },
+ "customWidth": "35",
+ "conditionalVisibility": {
+ "parameterName": "Message",
+ "comparison": "isNotEqualTo",
+ "value": ""
+ },
+ "name": "Details",
+ "styleSettings": {
+ "showBorder": true
}
}
]
},
- "chartSettings": {
- "seriesLabelSettings": [
- {
- "seriesName": "Medium",
- "color": "orange"
- },
- {
- "seriesName": "Low",
- "color": "blue"
- },
- {
- "seriesName": "High",
- "color": "redBright"
- },
- {
- "seriesName": "Information",
- "color": "blueDark"
- }
- ],
- "ySettings": {
- "numberFormatSettings": {
- "unit": 0,
- "options": {
- "style": "decimal",
- "useGrouping": true
- }
- }
- }
- }
- },
- "customWidth": "33",
- "name": "query - 4"
- },
- {
- "type": 3,
- "content": {
- "version": "KqlItem/1.0",
- "query": "\r\nSqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend\r\n AsmtId=tostring(asmt[1]),\r\n CheckId=tostring(asmt[2]),\r\n DisplayString=asmt[3],\r\n Description=tostring(asmt[4]),\r\n HelpLink=asmt[5],\r\n TargetType=case(asmt[6] == 1, \"Server\", asmt[6] == 2, \"Database\", \"\"),\r\n TargetName=tostring(asmt[7]), \r\n Severity=case(asmt[8] == 30, \"High\", asmt[8] == 20, \"Medium\", asmt[8] == 10, \"Low\", asmt[8] == 0, \"Information\", asmt[8] == 1, \"Warning\", asmt[8] == 2, \"Critical\", \"Passed\"),\r\n Message=tostring(asmt[9]),\r\n TagsArr=split(tostring(asmt[10]), \",\"),\r\n Sev = toint(asmt[8])\r\n | order by CheckId, _ResourceId\r\n | join kind=inner\r\n (\r\n SqlAssessment_CL\r\n | extend asmt = parse_csv(RawData)\r\n | extend\r\n AsmtId=tostring(asmt[1]) \r\n | summarize arg_max(TimeGenerated, *) by _ResourceId\r\n | project AsmtId\r\n ) on AsmtId\r\n |where Sev >= 0 \r\n and Severity == \"{severity}\"\r\n | order by Sev, CheckId\r\n | project CheckId, Description, _ResourceId, AsmtId, Sev, Severity \r\n",
- "size": 3,
- "queryType": 0,
- "resourceType": "microsoft.operationalinsights/workspaces",
- "crossComponentResources": [
- "{LogAnalitycsWorkpace}"
- ]
- },
- "name": "query - 8"
- },
- {
- "type": 3,
- "content": {
- "version": "KqlItem/1.0",
- "query": "SqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend\r\n AsmtId=tostring(asmt[1]),\r\n CheckId=tostring(asmt[2]),\r\n DisplayString=asmt[3],\r\n Description=tostring(asmt[4]),\r\n HelpLink=asmt[5],\r\n TargetType=case(asmt[6] == 1, \"Server\", asmt[6] == 2, \"Database\", \"\"),\r\n TargetName=tostring(asmt[7]), \r\n Severity=case(asmt[8] == 30, \"High\", asmt[8] == 20, \"Medium\", asmt[8] == 10, \"Low\", asmt[8] == 0, \"Information\", asmt[8] == 1, \"Warning\", asmt[8] == 2, \"Critical\", \"Passed\"),\r\n Message=tostring(asmt[9]),\r\n TagsArr=split(tostring(asmt[10]), \",\"),\r\n Sev = toint(asmt[8])\r\n | order by CheckId, _ResourceId\r\n | join kind=inner\r\n (\r\n SqlAssessment_CL\r\n | extend asmt = parse_csv(RawData)\r\n | extend\r\n AsmtId=tostring(asmt[1]) \r\n | summarize arg_max(TimeGenerated, *) by _ResourceId\r\n | project AsmtId\r\n ) on AsmtId\r\n |where Sev >= 0 \r\n and TargetType == \"Server\"\r\n | order by Sev, CheckId\r\n | summarize count() by TargetName \r\n",
- "size": 3,
- "title": "Issues by server",
- "queryType": 0,
- "resourceType": "microsoft.operationalinsights/workspaces",
- "crossComponentResources": [
- "{LogAnalitycsWorkpace}"
- ],
- "visualization": "piechart",
- "chartSettings": {
- "seriesLabelSettings": [
- {
- "seriesName": "Protected",
- "color": "green"
- },
- {
- "seriesName": "Unknown",
- "color": "gray"
- },
- {
- "seriesName": "Not Protected",
- "color": "redBright"
- }
- ]
- }
- },
- "customWidth": "33",
- "name": "query - 4 - Copy"
- },
- {
- "type": 3,
- "content": {
- "version": "KqlItem/1.0",
- "query": "SqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend\r\n AsmtId=tostring(asmt[1]),\r\n CheckId=tostring(asmt[2]),\r\n DisplayString=asmt[3],\r\n Description=tostring(asmt[4]),\r\n HelpLink=asmt[5],\r\n TargetType=case(asmt[6] == 1, \"Server\", asmt[6] == 2, \"Database\", \"\"),\r\n TargetName=tostring(asmt[7]), \r\n Severity=case(asmt[8] == 30, \"High\", asmt[8] == 20, \"Medium\", asmt[8] == 10, \"Low\", asmt[8] == 0, \"Information\", asmt[8] == 1, \"Warning\", asmt[8] == 2, \"Critical\", \"Passed\"),\r\n Message=tostring(asmt[9]),\r\n TagsArr=split(tostring(asmt[10]), \",\"),\r\n Sev = toint(asmt[8])\r\n | order by CheckId, _ResourceId\r\n | join kind=inner\r\n (\r\n SqlAssessment_CL\r\n | extend asmt = parse_csv(RawData)\r\n | extend\r\n AsmtId=tostring(asmt[1]) \r\n | summarize arg_max(TimeGenerated, *) by _ResourceId\r\n | project AsmtId\r\n ) on AsmtId\r\n |where Sev >= 0 \r\n and TargetType == \"Database\"\r\n | order by Sev, CheckId\r\n | summarize count() by TargetName \r\n",
- "size": 3,
- "title": "Issues by Database",
- "queryType": 0,
- "resourceType": "microsoft.operationalinsights/workspaces",
- "crossComponentResources": [
- "{LogAnalitycsWorkpace}"
- ],
- "visualization": "piechart"
- },
- "customWidth": "33",
- "name": "query - 4 - Copy - Copy"
- },
- {
- "type": 9,
- "content": {
- "version": "KqlParameterItem/1.0",
- "crossComponentResources": [
- "{LogAnalitycsWorkpace}"
- ],
- "parameters": [
- {
- "id": "ced45d66-52da-4f9c-b473-6781309a78cc",
- "version": "KqlParameterItem/1.0",
- "name": "CheckId",
- "type": 2,
- "isRequired": true,
- "query": "\r\nSqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend\r\n AsmtId=tostring(asmt[1]),\r\n CheckId=tostring(asmt[2]),\r\n DisplayString=asmt[3],\r\n Description=tostring(asmt[4]),\r\n HelpLink=asmt[5],\r\n TargetType=case(asmt[6] == 1, \"Server\", asmt[6] == 2, \"Database\", \"\"),\r\n TargetName=tostring(asmt[7]), \r\n Severity=case(asmt[8] == 30, \"High\", asmt[8] == 20, \"Medium\", asmt[8] == 10, \"Low\", asmt[8] == 0, \"Information\", asmt[8] == 1, \"Warning\", asmt[8] == 2, \"Critical\", \"Passed\"),\r\n Message=tostring(asmt[9]),\r\n TagsArr=split(tostring(asmt[10]), \",\"),\r\n Sev = toint(asmt[8])\r\n | order by CheckId, _ResourceId\r\n | join kind=inner\r\n (\r\n SqlAssessment_CL\r\n | extend asmt = parse_csv(RawData)\r\n | extend\r\n AsmtId=tostring(asmt[1]) \r\n | summarize arg_max(TimeGenerated, *) by _ResourceId\r\n | project AsmtId\r\n ) on AsmtId\r\n |where Sev >= 0 \r\n | distinct (CheckId)\r\n|order by CheckId asc\r\n\r\n\r\n ",
- "crossComponentResources": [
- "{LogAnalitycsWorkpace}"
- ],
- "typeSettings": {
- "additionalResourceOptions": [],
- "showDefault": false
- },
- "timeContext": {
- "durationMs": 2592000000
- },
- "queryType": 0,
- "resourceType": "microsoft.operationalinsights/workspaces",
- "value": "DbIntegrity"
- }
- ],
- "style": "pills",
- "queryType": 0,
- "resourceType": "microsoft.operationalinsights/workspaces"
- },
- "name": "paarameter_CheckId"
- },
- {
- "type": 3,
- "content": {
- "version": "KqlItem/1.0",
- "query": "SqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend\r\n AsmtId=tostring(asmt[1]),\r\n CheckId=tostring(asmt[2]),\r\n DisplayString=asmt[3],\r\n Description=tostring(asmt[4]),\r\n HelpLink=asmt[5],\r\n TargetType=case(asmt[6] == 1, \"Server\", asmt[6] == 2, \"Database\", \"\"),\r\n TargetName=tostring(asmt[7]), \r\n Severity=case(asmt[8] == 30, \"High\", asmt[8] == 20, \"Medium\", asmt[8] == 10, \"Low\", asmt[8] == 0, \"Information\", asmt[8] == 1, \"Warning\", asmt[8] == 2, \"Critical\", \"Passed\"),\r\n Message=tostring(asmt[9]),\r\n TagsArr=split(tostring(asmt[10]), \",\"),\r\n Sev = toint(asmt[8])\r\n | order by CheckId, _ResourceId\r\n | join kind=inner\r\n (\r\n SqlAssessment_CL\r\n | extend asmt = parse_csv(RawData)\r\n | extend\r\n AsmtId=tostring(asmt[1]) \r\n | summarize arg_max(TimeGenerated, *) by _ResourceId\r\n | project AsmtId\r\n ) on AsmtId\r\n |where Sev >= 0 \r\n and CheckId ==\"{CheckId}\"\r\n | project _ResourceId, tostring(DisplayString), TargetType, CheckId\r\n | summarize count() by _ResourceId, tostring(DisplayString), TargetType, CheckId\r\n | order by CheckId",
- "size": 3,
- "title": "sqlmonitoring",
- "queryType": 0,
- "resourceType": "microsoft.operationalinsights/workspaces",
- "crossComponentResources": [
- "{LogAnalitycsWorkpace}"
- ],
- "gridSettings": {
- "formatters": [
- {
- "columnMatch": "createdAt",
- "formatter": 0,
- "formatOptions": {
- "customColumnWidthSetting": "21.1429ch"
- }
- },
- {
- "columnMatch": "AzureArcServer",
- "formatter": 0,
- "formatOptions": {
- "customColumnWidthSetting": "20.1429ch"
- }
- },
- {
- "columnMatch": "SQLInstance",
- "formatter": 0,
- "formatOptions": {
- "customColumnWidthSetting": "23.4286ch"
- }
- },
- {
- "columnMatch": "version",
- "formatter": 0,
- "formatOptions": {
- "customColumnWidthSetting": "21ch"
- }
- },
- {
- "columnMatch": "currentVersion",
- "formatter": 0,
- "formatOptions": {
- "customColumnWidthSetting": "20ch"
- }
- },
- {
- "columnMatch": "patchLevel",
- "formatter": 0,
- "formatOptions": {
- "customColumnWidthSetting": "17ch"
- }
- },
- {
- "columnMatch": "edition",
- "formatter": 0,
- "formatOptions": {
- "customColumnWidthSetting": "11.4286ch"
- }
- },
- {
- "columnMatch": "vcores",
- "formatter": 0,
- "formatOptions": {
- "customColumnWidthSetting": "9.7143ch"
- }
- },
- {
- "columnMatch": "subscriptionId",
- "formatter": 13,
- "formatOptions": {
- "linkTarget": "Resource",
- "showIcon": true,
- "customColumnWidthSetting": "26.5714ch"
- }
- },
- {
- "columnMatch": "licenseType",
- "formatter": 0,
- "formatOptions": {
- "customColumnWidthSetting": "14.4286ch"
- }
- },
- {
- "columnMatch": "azureDefenderStatus",
- "formatter": 0,
- "formatOptions": {
- "customColumnWidthSetting": "25ch"
- }
- }
- ],
- "rowLimit": 500,
- "filter": true
- }
- },
- "name": "query - 1"
- },
- {
- "type": 3,
- "content": {
- "version": "KqlItem/1.0",
- "query": "SqlAssessment_CL\r\n| extend asmt = parse_csv(RawData)\r\n| extend\r\n AsmtId=tostring(asmt[1]),\r\n CheckId=tostring(asmt[2]),\r\n DisplayString=asmt[3],\r\n Description=tostring(asmt[4]),\r\n HelpLink=asmt[5],\r\n TargetType=case(asmt[6] == 1, \"Server\", asmt[6] == 2, \"Database\", \"\"),\r\n TargetName=tostring(asmt[7]), \r\n Severity=case(asmt[8] == 30, \"High\", asmt[8] == 20, \"Medium\", asmt[8] == 10, \"Low\", asmt[8] == 0, \"Information\", asmt[8] == 1, \"Warning\", asmt[8] == 2, \"Critical\", \"Passed\"),\r\n Message=tostring(asmt[9]),\r\n TagsArr=split(tostring(asmt[10]), \",\"),\r\n Sev = toint(asmt[8])\r\n | order by CheckId, _ResourceId\r\n | join kind=inner\r\n (\r\n SqlAssessment_CL\r\n | extend asmt = parse_csv(RawData)\r\n | extend\r\n AsmtId=tostring(asmt[1]) \r\n | summarize arg_max(TimeGenerated, *) by _ResourceId\r\n | project AsmtId\r\n ) on AsmtId\r\n |where Sev >= 0\r\n | order by Sev, CheckId",
- "size": 0,
- "queryType": 0,
- "resourceType": "microsoft.operationalinsights/workspaces",
- "crossComponentResources": [
- "{LogAnalitycsWorkpace}"
- ]
- },
- "name": "query - 0"
- }
- ],
- "fallbackResourceIds": [
- "azure monitor"
- ],
- "fromTemplateId": "sentinel-UserWorkbook",
- "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
-}
\ No newline at end of file
+ "name": "Issues"
+ }
+ ],
+ "fallbackResourceIds": [
+ "azure monitor"
+ ],
+ "fromTemplateId": "sentinel-UserWorkbook",
+ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
+ }
\ No newline at end of file
diff --git a/samples/features/azure-arc/workbooks/README.md b/samples/features/azure-arc/workbooks/README.md
index 42d1c71b..ef440aa6 100644
--- a/samples/features/azure-arc/workbooks/README.md
+++ b/samples/features/azure-arc/workbooks/README.md
@@ -14,7 +14,8 @@ This section contains workbooks to use with Azure Arc SQL Servers. Please follow
## Azure Arc SQL Best Practices Assessment
-
+
+
## Disclaimers
diff --git a/samples/features/azure-arc/workbooks/img/AzureSqlServerBPA.png b/samples/features/azure-arc/workbooks/img/AzureSqlServerBPA.png
deleted file mode 100644
index 2e26b025..00000000
Binary files a/samples/features/azure-arc/workbooks/img/AzureSqlServerBPA.png and /dev/null differ
diff --git a/samples/features/azure-arc/workbooks/img/AzureSqlServerBPAa.png b/samples/features/azure-arc/workbooks/img/AzureSqlServerBPAa.png
new file mode 100644
index 00000000..f3e03f9f
Binary files /dev/null and b/samples/features/azure-arc/workbooks/img/AzureSqlServerBPAa.png differ
diff --git a/samples/features/azure-arc/workbooks/img/AzureSqlServerBPAb.png b/samples/features/azure-arc/workbooks/img/AzureSqlServerBPAb.png
new file mode 100644
index 00000000..0fc740c1
Binary files /dev/null and b/samples/features/azure-arc/workbooks/img/AzureSqlServerBPAb.png differ