初学者 Resource Graph 查询示例

项目
02/19/2024

了解使用 Azure 资源图表进行查询的第一步是对查询语言有基本的了解。如果还不熟悉 Kusto 查询语言 (KQL)，建议查看 KQL 的教程，了解如何为正在寻找的资源撰写请求。

本文使用以下入门查询：

对 Azure 资源进行计数
统计密钥保管库资源
列出按名称排序的资源
按降序显示按名称排序的所有虚拟机
按名称及其 OS 类型显示前五个虚拟机
按 OS 类型对虚拟机进行计数
显示包含存储的资源
列出所有虚拟网络子网
列出所有公共 IP 地址
对具有由订阅配置的 IP 地址的资源进行计数
列出具有特定标记值的资源
列出具有特定标记值的所有存储帐户
列出所有标记及其值
显示未关联的网络安全组
列出按严重性排序的 Azure Monitor 警报
列出按严重性和警报状态排序的 Azure Monitor 警报
列出按严重性排序的 Azure Monitor 警报、监视服务和目标资源类型

如果没有 Azure 订阅，请在开始前创建一个试用版订阅。

语言支持

Azure CLI（通过扩展）和 Azure PowerShell（通过模块）支持 Azure 资源图表。在运行以下任何查询之前，请检查环境是否已准备就绪。有关安装和验证所选 shell 环境的步骤，请参阅 Azure CLI 和 Azure PowerShell。

对 Azure 资源进行计数

此查询返回有权访问的订阅中存在的 Azure 资源的数量。这是一个良好查询，用于验证所选 shell 是否已安装适当的 Azure 资源图表组件并处于正常工作状态。

Resources
| summarize count()

默认情况下，Azure CLI 查询所有可访问的订阅，但你可以指定 --subscriptions 参数以查询特定订阅。

az graph query -q "Resources | summarize count()"

此示例对订阅 ID 使用一个变量。

subid=$(az account show --query id --output tsv)
az graph query -q "Resources | summarize count()" --subscriptions $subid

你也可以按管理组和租户的范围进行查询。将 <managementGroupId> 和 <tenantId> 替换为自定义值。

az graph query -q "Resources | summarize count()" --management-groups '<managementGroupId>'

az graph query -q "Resources | summarize count()" --management-groups '<tenantId>'

还可以对租户 ID 使用一个变量。

tenantid=$(az account show --query tenantId --output tsv)
az graph query -q "Resources | summarize count()" --management-groups $tenantid

默认情况下，Azure PowerShell 获取租户中所有订阅的结果。

Search-AzGraph -Query "Resources | summarize count()"

此示例使用一个变量查询特定的订阅 ID。

$subid = (Get-AzContext).Subscription.Id
Search-AzGraph -Query "authorizationresources | summarize count()" -Subscription $subid

你可以按管理组和租户的范围进行查询。将 <managementGroupId> 替换为自己的值。 UseTenantScope 参数不需要值。

Search-AzGraph -Query "Resources | summarize count()" -ManagementGroup '<managementGroupId>'

Search-AzGraph -Query "Resources | summarize count()" -UseTenantScope

统计 Key Vault 资源

此查询使用 count 而不是 summarize 来计算返回的记录数。只有密钥保管库才包括在计数中。

Resources
| where type =~ 'microsoft.keyvault/vaults'
| count

az graph query -q "Resources | where type =~ 'microsoft.keyvault/vaults' | count"

Search-AzGraph -Query "Resources | where type =~ 'microsoft.keyvault/vaults' | count"

列出按名称排序的资源

此查询返回任意类型的资源，但只返回“名称”、“类型”和“位置”属性。它使用 order by以升序 (asc) 按“名称”属性对属性排序。

Resources
| project name, type, location
| order by name asc

az graph query -q "Resources | project name, type, location | order by name asc"

Search-AzGraph -Query "Resources | project name, type, location | order by name asc"

按降序显示按名称排序的所有虚拟机

若要只列出虚拟机（类型为 Microsoft.Compute/virtualMachines），我们可在结果中匹配属性“类型”。与上一查询类似，desc 将 order by 更改为降序。类型匹配中的 =~ 告知资源图表不区分大小写。

Resources
| project name, location, type
| where type =~ 'Microsoft.Compute/virtualMachines'
| order by name desc

az graph query -q "Resources | project name, location, type| where type =~ 'Microsoft.Compute/virtualMachines' | order by name desc"

Search-AzGraph -Query "Resources | project name, location, type| where type =~ 'Microsoft.Compute/virtualMachines' | order by name desc"

按名称及其 OS 类型显示前五个虚拟机

此查询使用 top，仅检索按名称排序的五条匹配记录。 Azure 资源的类型为 Microsoft.Compute/virtualMachines。 project 告诉 Azure 资源图表要包含哪些属性。

Resources
| where type =~ 'Microsoft.Compute/virtualMachines'
| project name, properties.storageProfile.osDisk.osType
| top 5 by name desc

az graph query -q "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | project name, properties.storageProfile.osDisk.osType | top 5 by name desc"

Search-AzGraph -Query "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | project name, properties.storageProfile.osDisk.osType | top 5 by name desc"

按 OS 类型对虚拟机进行计数

基于前面的查询，我们仍受限于类型 Microsoft.Compute/virtualMachines 的 Azure 资源，但不再限制返回的记录数量。相反，我们使用 summarize 和 count() 来定义如何按属性对值进行分组和聚合，在此示例中为 properties.storageProfile.osDisk.osType。有关此字符串在完整对象中的外观示例，请参阅浏览资源 - 虚拟机发现。

Resources
| where type =~ 'Microsoft.Compute/virtualMachines'
| summarize count() by tostring(properties.storageProfile.osDisk.osType)

az graph query -q "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | summarize count() by tostring(properties.storageProfile.osDisk.osType)"

Search-AzGraph -Query "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | summarize count() by tostring(properties.storageProfile.osDisk.osType)"

编写同一查询的另一种方法是 extend 某个属性，并赋予其临时名称，以供查询使用。在本例中该属性为 os。然后，os 会被 summarize 和 count() 使用，如上一示例中的情况。

Resources
| where type =~ 'Microsoft.Compute/virtualMachines'
| extend os = properties.storageProfile.osDisk.osType
| summarize count() by tostring(os)

az graph query -q "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | extend os = properties.storageProfile.osDisk.osType | summarize count() by tostring(os)"

Search-AzGraph -Query "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | extend os = properties.storageProfile.osDisk.osType | summarize count() by tostring(os)"

注意

请注意，虽然 =~ 允许不区分大小写的匹配，但在查询中使用属性（例如 properties.storageProfile.osDisk.osType）要求大小写正确。如果属性的大小写不正确，则会返回 null 值或不正确值，但分组或汇总可能不正确。

显示包含存储的资源

此示例查询不显式定义要匹配的类型，而是查找 contains 单词“存储”的任何 Azure 资源。

Resources
| where type contains 'storage' | distinct type

az graph query -q "Resources | where type contains 'storage' | distinct type"

Search-AzGraph -Query "Resources | where type contains 'storage' | distinct type"

列出所有 Azure 虚拟网络子网

此查询返回 Azure 虚拟网络列表 (VNet)，包括子网名称和地址前缀。

Resources
| where type == 'microsoft.network/virtualnetworks'
| extend subnets = properties.subnets
| mv-expand subnets
| project name, subnets.name, subnets.properties.addressPrefix, location, resourceGroup, subscriptionId

az graph query -q "Resources | where type == 'microsoft.network/virtualnetworks' | extend subnets = properties.subnets | mv-expand subnets | project name, subnets.name, subnets.properties.addressPrefix, location, resourceGroup, subscriptionId"

Search-AzGraph -Query "Resources | where type == 'microsoft.network/virtualnetworks' | extend subnets = properties.subnets | mv-expand subnets | project name, subnets.name, subnets.properties.addressPrefix, location, resourceGroup, subscriptionId

列出所有公共 IP 地址

与上一查询类似，查找包含单词“publicIPAddresses”的所有类型。此查询扩展了该模式，以仅包括 properties.ipAddress 为 isnotempty 的结果，仅返回 properties.ipAddress，并将结果 limit 于前 100 条。根据所选 shell，可能需要转义引号。

Resources
| where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress)
| project properties.ipAddress
| limit 100

az graph query -q "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | project properties.ipAddress | limit 100"

Search-AzGraph -Query "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | project properties.ipAddress | limit 100"

对具有由订阅配置的 IP 地址的资源进行计数

使用前面的示例查询并添加 summarize 和 count()，我们可通过订阅配置了 IP 地址的资源来获取列表。

Resources
| where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress)
| summarize count () by subscriptionId

az graph query -q "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId"

Search-AzGraph -Query "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId"

列出具有特定标记值的资源

我们可通过 Azure 资源类型以外的属性（如标记）来限制结果。在此示例中，我们正在筛选 Azure 资源，其标记名为“环境”，其值为 Internal 。

Resources
| where tags.environment=~'internal'
| project name

az graph query -q "Resources | where tags.environment=~'internal' | project name"

Search-AzGraph -Query "Resources | where tags.environment=~'internal' | project name"

如果还要提供资源具有的标记及其值，请将属性“标记”添加到 project 关键字。

Resources
| where tags.environment=~'internal'
| project name, tags

az graph query -q "Resources | where tags.environment=~'internal' | project name, tags"

Search-AzGraph -Query "Resources | where tags.environment=~'internal' | project name, tags"

列出具有特定标记值的所有存储帐户

组合前面示例的筛选功能，按“类型”属性筛选 Azure 资源类型。此查询还使用特定的标记名称和值来限制对 Azure 资源特定类型的搜索。

Resources
| where type =~ 'Microsoft.Storage/storageAccounts'
| where tags['tag with a space']=='Custom value'

az graph query -q "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where tags['tag with a space']=='Custom value'"

Search-AzGraph -Query "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where tags['tag with a space']=='Custom value'"

注意

此示例使用 == 进行匹配，而不是使用 =~ 条件。 == 是区分大小写的匹配项。

列出所有标记及其值

此查询会列出管理组、订阅和资源上的标记及其值。查询首先仅查找带有 isnotempty() 标记的资源，通过仅包含 project、mvexpand 和 extend 中的标记来限制所包含的字段，从而获取属性包中配对的数据。然后，它使用 union 将 ResourceContainers 中的结果合并到资源中的相同结果，从而广泛覆盖要提取的标记。最后，它将结果限制为 distinct 配对数据，并排除系统隐藏的标记。

ResourceContainers
| where isnotempty(tags)
| project tags
| mvexpand tags
| extend tagKey = tostring(bag_keys(tags)[0])
| extend tagValue = tostring(tags[tagKey])
| union (
    resources
    | where isnotempty(tags)
    | project tags
    | mvexpand tags
    | extend tagKey = tostring(bag_keys(tags)[0])
    | extend tagValue = tostring(tags[tagKey])
)
| distinct tagKey, tagValue
| where tagKey !startswith "hidden-"

az graph query -q "ResourceContainers | where isnotempty(tags) | project tags | mvexpand tags | extend tagKey = tostring(bag_keys(tags)[0]) | extend tagValue = tostring(tags[tagKey]) | union (resources | where notempty(tags) | project tags | mvexpand tags | extend tagKey = tostring(bag_keys(tags)[0]) | extend tagValue = tostring(tags[tagKey]) ) | distinct tagKey, tagValue | where tagKey !startswith "hidden-""

Search-AzGraph -Query "ResourceContainers | where isnotempty(tags) | project tags | mvexpand tags | extend tagKey = tostring(bag_keys(tags)[0]) | extend tagValue = tostring(tags[tagKey]) | union (resources | where notempty(tags) | project tags | mvexpand tags | extend tagKey = tostring(bag_keys(tags)[0]) | extend tagValue = tostring(tags[tagKey]) ) | distinct tagKey, tagValue | where tagKey !startswith "hidden-""

显示未关联的网络安全组

此查询返回未与网络接口或子网关联的网络安全组 (NSG)。

Resources
| where type =~ "microsoft.network/networksecuritygroups" and isnull(properties.networkInterfaces) and isnull(properties.subnets)
| project name, resourceGroup
| sort by name asc

az graph query -q "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc"

Search-AzGraph -Query "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc"

列出按严重性排序的 Azure Monitor 警报

此查询使用 alertsmanagementresources 表返回按严重性排序的 Azure Monitor 警报。

alertsmanagementresources
| where type =~ 'microsoft.alertsmanagement/alerts'
| where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now()
| project Severity = tostring(properties.essentials.severity)
| summarize AlertsCount = count() by Severity

az graph query -q "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity) | summarize AlertsCount = count() by Severity"

Search-AzGraph -Query "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity) | summarize AlertsCount = count() by Severity"

列出按严重性和警报状态排序的 Azure Monitor 警报

此查询使用 alertsmanagementresources 表返回按严重性和警报状态排序的 Azure Monitor 警报。

alertsmanagementresources
| where type =~ 'microsoft.alertsmanagement/alerts'
| where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now()
| project Severity = tostring(properties.essentials.severity), AlertState = tostring(properties.essentials.alertState)
| summarize AlertsCount = count() by Severity, AlertState

az graph query -q "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity), AlertState = tostring(properties.essentials.alertState) | summarize AlertsCount = count() by Severity, AlertState"

Search-AzGraph -Query "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity), AlertState = tostring(properties.essentials.alertState) | summarize AlertsCount = count() by Severity, AlertState"

列出按严重性排序的 Azure Monitor 警报、监视服务和目标资源类型

此查询使用 alertsmanagementresources 表返回按严重性、监视服务和目标资源类型排序的 Azure Monitor 警报。

alertsmanagementresources
| where type =~ 'microsoft.alertsmanagement/alerts'
| where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now()
| project Severity = tostring(properties.essentials.severity),
MonitorCondition = tostring(properties.essentials.monitorCondition),
ObjectState = tostring(properties.essentials.alertState),
MonitorService = tostring(properties.essentials.monitorService),
AlertRuleId = tostring(properties.essentials.alertRule),
SignalType = tostring(properties.essentials.signalType),
TargetResource = tostring(properties.essentials.targetResourceName),
TargetResourceType = tostring(properties.essentials.targetResourceName), id
| summarize AlertsCount = count() by Severity, MonitorService , TargetResourceType

az graph query -q "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity), MonitorCondition = tostring(properties.essentials.monitorCondition), ObjectState = tostring(properties.essentials.alertState), MonitorService = tostring(properties.essentials.monitorService), AlertRuleId = tostring(properties.essentials.alertRule), SignalType = tostring(properties.essentials.signalType), TargetResource = tostring(properties.essentials.targetResourceName), TargetResourceType = tostring(properties.essentials.targetResourceName), id | summarize AlertsCount = count() by Severity, MonitorService , TargetResourceType"

Search-AzGraph -Query "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity), MonitorCondition = tostring(properties.essentials.monitorCondition), ObjectState = tostring(properties.essentials.alertState), MonitorService = tostring(properties.essentials.monitorService), AlertRuleId = tostring(properties.essentials.alertRule), SignalType = tostring(properties.essentials.signalType), TargetResource = tostring(properties.essentials.targetResourceName), TargetResourceType = tostring(properties.essentials.targetResourceName), id | summarize AlertsCount = count() by Severity, MonitorService , TargetResourceType"

后续步骤

详细了解查询语言。
详细了解如何浏览资源。
查看高级查询的示例。