Function: AzureTagSearch()

Description

This function returns all resources based on the SearchTag variable that has been used as input. Note that only the resources that your account has access to are returned.

Query · kql

let AzureTagSearch = (SearchTag: string) {
    arg("").Resources
    | extend StringTags = tolower(tostring(tags))
    | extend SearchTagToLower = SearchTag
    | where StringTags has SearchTagToLower
    | project tags, type, name, kind, resourceGroup
};
AzureTagSearch("Test")
Raw source Function: AzureTagSearch() · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Function: AzureTagSearch()

## Query Information

#### Description
This function returns all resources based on the *SearchTag* variable that has been used as input. Note that only the resources that your account has access to are returned. 

#### References
- https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview
- https://learn.microsoft.com/en-us/azure/governance/resource-graph/samples/starter?tabs=azure-portal

## Log Analytics (Sentinel)
```
let AzureTagSearch = (SearchTag: string) {
    arg("").Resources
    | extend StringTags = tolower(tostring(tags))
    | extend SearchTagToLower = SearchTag
    | where StringTags has SearchTagToLower
    | project tags, type, name, kind, resourceGroup
};
AzureTagSearch("Test")
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.