example.yaml

resourceGraph:
  enabled: true

  queries:
    resources:
      prometheus:
        labels:
          resourceID: id

      query: |-
        resources

      enrich: true

      mapping:
        subscriptionId: subscription.id
        resourceGroup: resourcegroup.name
        id: resource.id

      rules: []

roleAssignments:
  enabled: true

  prometheus:
    labels:
      resourceID: resource.id
      subscriptionID: subscription.id
      prinicpalName: principal.displayName
      roleName:  role.name

  report:
    settings:
      groupBy: resourcegroup.tag.owner

  rules:
    # javscript func example
    - rule: unknown-identity
      func: |-
        if (obj["principal.type"] === "unknown") {
          result = true;
        } else {
          result = false;
        }
      action: deny
    - rule: foobar
      principal.type:
        match: null
        regexp: null
      principal.displayName:
        match: null
        regexp: null
      principal.applicationID:
        match: null
        regexp: null
      principal.objectID:
        match: null
        regexp: null
      role.name: "Network Contributor"
      scope: { regexp: "/subscriptions/.+" }
    - role.name: "Contributor"
    - role.name: "Owner"
    - role.name: "Reader"
    - rule: foobar
      age: {maxDuration: "24h"}

resourceGroups:
  enabled: true

  prometheus:
    labels:
      resourceID: resource.id
      subscriptionID: subscription.id
      resourceGroup: resourcegroup.name
      owner: resourcegroup.tag.owner

  rules:
    ## validate location but continue with next rules
    - rule: westeurope
      resourcegroup.location: { regexp: "westeurope" }
      action: continue

    - rule: ignoretest
      resourcegroup.name: barfoo
      action: ignore

    - rule: no-tag-owner-devteam0
      resourcegroup.tag.owner:
          mode: optional
          value: devteam0
      action: deny

    - rule: require-owner-tag
      resourcegroup.tag.owner:
          mode: required
          value: { regexp: "[a-z][-_a-z0-9]+" }
      action: continue

    - rule: match-everything

keyvaultAccessPolicies:
  enabled: true

  scopeRules:
    "/subscriptions/d86bcf13-ddf7-45ea-82f1-6f656767a318/":
      - rule: barfoo
        keyvault.name: { regexp: ".*" }
        permissions.certificates: [ Get,List,Update,Create,Import,Delete,Recover,Backup,Restore,ManageContacts,ManageIssuers,GetIssuers,ListIssuers,SetIssuers,DeleteIssuers ]

  prometheus:
    labels:
      keyvault: keyvault.name
      resourceID: resource.id
      subscriptionID: subscription.id
      resourceGroup: resourcegroup.name
      owner: resourcegroup.tag.owner

  rules:
    - rule: foobarasd123
      keyvault.name:
        match: null
        regexp: null
      principal.type:
        match: null
        regexp: null
      principal.displayName:
        match: null
        regexp: null
      principal.applicationID:
        match: null
        regexp: null
      principal.objectID:
        match: null
        regexp: null
      permissions.certificates: [ "Get","List" ]
      permissions.secrets: [ "Get","List" ]
      permissions.keys: [ "Get","List" ]
      permissions.storage: [ "Get","List" ]


resourceProviders:
  enabled: true

  prometheus:
    labels:
      providerNamespace: provider.namespace

  rules:
    - provider.namespace: Microsoft.ADHybridHealthService
    - provider.namespace: Microsoft.Advisor
    - provider.namespace: Microsoft.AlertsManagement
    - provider.namespace: Microsoft.Authorization
    - provider.namespace: Microsoft.Billing
    - provider.namespace: Microsoft.Cache
    - provider.namespace: Microsoft.ClassicSubscription
    - provider.namespace: Microsoft.Commerce
    - provider.namespace: Microsoft.Compute
    - provider.namespace: Microsoft.Consumption
    - provider.namespace: Microsoft.ContainerRegistry
    - provider.namespace: Microsoft.ContainerService
    - provider.namespace: Microsoft.CostManagement
    - provider.namespace: Microsoft.DevTestLab
    - provider.namespace: Microsoft.EventHub
    - provider.namespace: Microsoft.Features
    - provider.namespace: Microsoft.GuestConfiguration
    - provider.namespace: Microsoft.KeyVault
    - provider.namespace: Microsoft.ManagedIdentity
    - provider.namespace: Microsoft.MarketplaceNotifications
    - provider.namespace: Microsoft.MarketplaceOrdering
    - provider.namespace: Microsoft.Network
    - provider.namespace: Microsoft.OperationalInsights
    - provider.namespace: Microsoft.OperationsManagement
    - provider.namespace: Microsoft.PolicyInsights
    - provider.namespace: Microsoft.Portal
    - provider.namespace: Microsoft.ResourceGraph
    - provider.namespace: Microsoft.ResourceHealth
    - provider.namespace: Microsoft.Resources
    - provider.namespace: Microsoft.Security
    - provider.namespace: Microsoft.SecurityInsights
    - provider.namespace: Microsoft.SerialConsole
    - provider.namespace: Microsoft.Storage
    - provider.namespace: Microsoft.StorageCache
    - provider.namespace: Microsoft.StorageSync
    - provider.namespace: microsoft.insights
    - provider.namespace: microsoft.support

resourceProviderFeatures:
  enabled: true

  prometheus:
    labels:
      providerNamespace: provider.namespace
      providerFeature: provider.feature

  rules:
    - rule: microsoft.ContainerService/CustomNodeConfigPreview
      provider.namespace: microsoft.ContainerService
      provider.feature: CustomNodeConfigPreview
    - rule: microsoft.security/governance
      provider.feature: governance
      provider.namespace: microsoft.security

logAnalytics:
  enabled: true

  queries:
    foobar:
      enabled: true
      query: |-
        union withsource=sourceTable *
        | project sourceTable
        | summarize count_ = count() by sourceTable
        | project sourceTable, count_ = (todouble(count_) / 3600)
      timespan: PT1H

      workspaces:
        - /subscriptions/xxxxx-xxxx-xxxx-xxxx-xxxxxx/resourcegroups/xxxx/providers/microsoft.operationalinsights/workspaces/test