入門 Resource Graph 查詢範例

發行項
04/25/2024

使用 Azure Resource Graph 了解查詢的第一個步驟是對查詢語言的基本瞭解。如果您還不熟悉 Kusto 查詢語言（KQL），建議您檢閱 KQL 教學課程，以瞭解如何撰寫所要尋找資源的要求。

本文使用下列入門查詢：

計算 Azure 資源計數
計算金鑰保存庫資源
列出依名稱排序的資源
以遞減順序顯示依名稱排序的所有虛擬機
依名稱顯示前五部虛擬機及其操作系統類型
依 OS 類型計算虛擬機
顯示包含記憶體的資源
列出所有虛擬網路子網
列出所有公用IP位址
計算訂用帳戶所設定IP位址的資源
列出具有特定標籤值的資源
列出具有特定標籤值的所有記憶體帳戶
列出所有標記及其值
顯示未關聯的網路安全組
列出依嚴重性排序的 Azure 監視器警示
列出依嚴重性和警示狀態排序的 Azure 監視器警示
列出依嚴重性、監視服務和目標資源類型排序的 Azure 監視器警示

如果您沒有 Azure 訂用帳戶，請在開始前建立免費帳戶。

語言支援

Azure CLI（透過擴充功能）和 Azure PowerShell（透過模組）支援 Azure Resource Graph。在執行下列任何查詢之前，請先檢查您的環境是否已就緒。如需安裝和驗證您選擇的殼層環境的步驟，請參閱 Azure CLI 和 Azure PowerShell 。

計算 Azure 資源計數

此查詢會傳回您有權存取之訂用帳戶中的 Azure 資源數目。這也是一個很好的查詢，可驗證您選擇的殼層已安裝適當的 Azure Resource Graph 元件，並依工作順序進行。

Resources
| summarize count()

根據預設，Azure CLI 會查詢所有可存取的訂用帳戶，但您可以指定 --subscriptions 參數來查詢特定訂用帳戶。

az graph query -q "Resources | summarize count()"

此範例會針對訂用帳戶標識碼使用變數。

subid=$(az account show --query id --output tsv)
az graph query -q "Resources | summarize count()" --subscriptions $subid

您也可以依管理群組和租用戶的範圍進行查詢。將 <managementGroupId> 和 <tenantId> 取代為您自己的值。

az graph query -q "Resources | summarize count()" --management-groups '<managementGroupId>'

az graph query -q "Resources | summarize count()" --management-groups '<tenantId>'

您也可以使用變數作為租用戶標識碼。

tenantid=$(az account show --query tenantId --output tsv)
az graph query -q "Resources | summarize count()" --management-groups $tenantid

根據預設，Azure PowerShell 會取得租使用者中所有訂用帳戶的結果。

Search-AzGraph -Query "Resources | summarize count()"

此範例會使用變數來查詢特定的訂用帳戶標識碼。

$subid = (Get-AzContext).Subscription.Id
Search-AzGraph -Query "authorizationresources | summarize count()" -Subscription $subid

您可以依管理群組和租用戶的範圍進行查詢。以您的值取代 <managementGroupId>。參數 UseTenantScope 不需要值。

Search-AzGraph -Query "Resources | summarize count()" -ManagementGroup '<managementGroupId>'

Search-AzGraph -Query "Resources | summarize count()" -UseTenantScope

計算金鑰保存庫資源

此查詢會使用 count 而不是 summarize 來計算所傳回的記錄數目。只有金鑰保存庫會包含在計數中。

Resources
| where type =~ 'microsoft.keyvault/vaults'
| count

az graph query -q "Resources | where type =~ 'microsoft.keyvault/vaults' | count"

Search-AzGraph -Query "Resources | where type =~ 'microsoft.keyvault/vaults' | count"

列出依名稱排序的資源

此查詢會傳回任何類型的資源，但只會傳回名稱、類型和位置屬性。它會使用 order by ，以遞增（asc）順序依 name 屬性排序屬性。

Resources
| project name, type, location
| order by name asc

az graph query -q "Resources | project name, type, location | order by name asc"

Search-AzGraph -Query "Resources | project name, type, location | order by name asc"

依名稱遞減順序顯示所有虛擬機器

若只要列出虛擬機器 (類型為 Microsoft.Compute/virtualMachines)，我們可以在結果中比對 type 屬性。與上述查詢類似，desc 會將 order by 變更為遞減。類型比對中的 =~ 會告知 Resource Graph 不區分大小寫。

Resources
| project name, location, type
| where type =~ 'Microsoft.Compute/virtualMachines'
| order by name desc

az graph query -q "Resources | project name, location, type| where type =~ 'Microsoft.Compute/virtualMachines' | order by name desc"

Search-AzGraph -Query "Resources | project name, location, type| where type =~ 'Microsoft.Compute/virtualMachines' | order by name desc"

依名稱顯示前五個虛擬機器及其作業系統類型

此查詢使用 top，僅擷取按名稱排序的五個相符記錄。 Azure 資源類型為 Microsoft.Compute/virtualMachines。 project 會告訴 Azure Resource Graph 要包含哪些屬性。

Resources
| where type =~ 'Microsoft.Compute/virtualMachines'
| project name, properties.storageProfile.osDisk.osType
| top 5 by name desc

az graph query -q "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | project name, properties.storageProfile.osDisk.osType | top 5 by name desc"

Search-AzGraph -Query "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | project name, properties.storageProfile.osDisk.osType | top 5 by name desc"

依作業系統類型計算的虛擬機器計數

在上一個查詢的基礎上，我們仍會依 Microsoft.Compute/virtualMachines 類型的 Azure 資源限制，但不再限制傳回的記錄數目。相反地，我們使用 summarize 和 count() 來定義如何依屬性分組和彙總值，在此範例中為 properties.storageProfile.osDisk.osType。如需此字串在完整物件中顯示方式的範例，請參閱探索資源 - 虛擬機器探索。

Resources
| where type =~ 'Microsoft.Compute/virtualMachines'
| summarize count() by tostring(properties.storageProfile.osDisk.osType)

az graph query -q "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | summarize count() by tostring(properties.storageProfile.osDisk.osType)"

Search-AzGraph -Query "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | summarize count() by tostring(properties.storageProfile.osDisk.osType)"

撰寫相同查詢的不同方式是屬性extend，並在此案例中為它提供暫存名稱供查詢使用。 os 接著會由 summarize 和 count() 使用，如上一個範例所示。

Resources
| where type =~ 'Microsoft.Compute/virtualMachines'
| extend os = properties.storageProfile.osDisk.osType
| summarize count() by tostring(os)

az graph query -q "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | extend os = properties.storageProfile.osDisk.osType | summarize count() by tostring(os)"

Search-AzGraph -Query "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | extend os = properties.storageProfile.osDisk.osType | summarize count() by tostring(os)"

注意

請注意，雖然 =~ 允許不區分大小寫的比對，但在查詢中使用屬性（例如 properties.storageProfile.osDisk.osType）需要正確案例。如果屬性不正確，則會傳回 Null 或不正確的值，而且群組或摘要不正確。

顯示包含儲存體的資源

此範例查詢會尋找任何 Azure 資源contains，而不是明確定義要比對的類型。

Resources
| where type contains 'storage' | distinct type

az graph query -q "Resources | where type contains 'storage' | distinct type"

Search-AzGraph -Query "Resources | where type contains 'storage' | distinct type"

列出所有 Azure 虛擬網路子網

此查詢會傳回 Azure 虛擬網路（VNet）的清單，包括子網名稱和地址前綴。

Resources
| where type == 'microsoft.network/virtualnetworks'
| extend subnets = properties.subnets
| mv-expand subnets
| project name, subnets.name, subnets.properties.addressPrefix, location, resourceGroup, subscriptionId

az graph query -q "Resources | where type == 'microsoft.network/virtualnetworks' | extend subnets = properties.subnets | mv-expand subnets | project name, subnets.name, subnets.properties.addressPrefix, location, resourceGroup, subscriptionId"

Search-AzGraph -Query "Resources | where type == 'microsoft.network/virtualnetworks' | extend subnets = properties.subnets | mv-expand subnets | project name, subnets.name, subnets.properties.addressPrefix, location, resourceGroup, subscriptionId

列出所有公用 IP 位址

與上一個查詢類似，尋找類型為 publicIPAddresses 一詞 的所有專案。此查詢會展開該模式，只包含 properties.ipAddressisnotempty 的結果、只傳回 properties.ipAddress，以及limit前 100 名的結果。視您選擇的殼層而定，您可能需要逸出引號。

Resources
| where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress)
| project properties.ipAddress
| limit 100

az graph query -q "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | project properties.ipAddress | limit 100"

Search-AzGraph -Query "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | project properties.ipAddress | limit 100"

計算具有按訂用帳戶設定之 IP 位址的資源計數

使用上述範例查詢和新增和 count()，我們可以依資源訂用帳戶取得已設定 summarize IP位址的清單。

Resources
| where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress)
| summarize count () by subscriptionId

az graph query -q "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId"

Search-AzGraph -Query "Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress) | summarize count () by subscriptionId"

列出具有特定標籤值的資源

我們可以根據 Azure 資源類型以外的屬性限制結果，例如標籤。在此範例中，我們會篩選標籤名稱為 Environment 的 Azure 資源進行篩選，其值為 Internal。

Resources
| where tags.environment=~'internal'
| project name

az graph query -q "Resources | where tags.environment=~'internal' | project name"

Search-AzGraph -Query "Resources | where tags.environment=~'internal' | project name"

若也要提供資源具有哪些標籤和其值，請將 tags 屬性新增至 project 關鍵字。

Resources
| where tags.environment=~'internal'
| project name, tags

az graph query -q "Resources | where tags.environment=~'internal' | project name, tags"

Search-AzGraph -Query "Resources | where tags.environment=~'internal' | project name, tags"

列出具有特定標籤值的所有儲存體帳戶

結合前一個範例的篩選功能，依 type 屬性篩選 Azure 資源類型。此查詢也會將搜尋限制為具有特定標籤名稱和值的特定類型 Azure 資源。

Resources
| where type =~ 'Microsoft.Storage/storageAccounts'
| where tags['tag with a space']=='Custom value'

az graph query -q "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where tags['tag with a space']=='Custom value'"

Search-AzGraph -Query "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | where tags['tag with a space']=='Custom value'"

注意

此範例會使用 == 來比對， =~ 而不是條件式。 == 是區分大小寫的相符專案。

列出所有標籤及其值

此查詢會列出管理群組、訂用帳戶和資源上的標籤及其值。首先，查詢會限制標籤為 isnotempty() 的資源，只在 project、mvexpand、extend 中包含 tags 來限制內含的欄位，然後從屬性包取得配對資料。接著使用 union，合併來自 ResourceContainers 的結果與來自 Resources 的相同結果，提供可擷取標籤的廣泛範圍。最後，查詢會將結果限制為 distinct 配對資料，並排除系統隱藏的標籤。

ResourceContainers
| where isnotempty(tags)
| project tags
| mvexpand tags
| extend tagKey = tostring(bag_keys(tags)[0])
| extend tagValue = tostring(tags[tagKey])
| union (
    resources
    | where isnotempty(tags)
    | project tags
    | mvexpand tags
    | extend tagKey = tostring(bag_keys(tags)[0])
    | extend tagValue = tostring(tags[tagKey])
)
| distinct tagKey, tagValue
| where tagKey !startswith "hidden-"

az graph query -q "ResourceContainers | where isnotempty(tags) | project tags | mvexpand tags | extend tagKey = tostring(bag_keys(tags)[0]) | extend tagValue = tostring(tags[tagKey]) | union (resources | where notempty(tags) | project tags | mvexpand tags | extend tagKey = tostring(bag_keys(tags)[0]) | extend tagValue = tostring(tags[tagKey]) ) | distinct tagKey, tagValue | where tagKey !startswith "hidden-""

Search-AzGraph -Query "ResourceContainers | where isnotempty(tags) | project tags | mvexpand tags | extend tagKey = tostring(bag_keys(tags)[0]) | extend tagValue = tostring(tags[tagKey]) | union (resources | where notempty(tags) | project tags | mvexpand tags | extend tagKey = tostring(bag_keys(tags)[0]) | extend tagValue = tostring(tags[tagKey]) ) | distinct tagKey, tagValue | where tagKey !startswith "hidden-""

顯示未建立關聯的網路安全性群組

此查詢會傳回未與網路介面或子網相關聯的網路安全組（NSG）。

Resources
| where type =~ "microsoft.network/networksecuritygroups" and isnull(properties.networkInterfaces) and isnull(properties.subnets)
| project name, resourceGroup
| sort by name asc

az graph query -q "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc"

Search-AzGraph -Query "Resources | where type =~ 'microsoft.network/networksecuritygroups' and isnull(properties.networkInterfaces) and isnull(properties.subnets) | project name, resourceGroup | sort by name asc"

列出依嚴重性排序的 Azure 監視器警示

此查詢會 alertsmanagementresources 使用數據表來傳回依嚴重性排序的 Azure 監視器警示。

alertsmanagementresources
| where type =~ 'microsoft.alertsmanagement/alerts'
| where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now()
| project Severity = tostring(properties.essentials.severity)
| summarize AlertsCount = count() by Severity

az graph query -q "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity) | summarize AlertsCount = count() by Severity"

Search-AzGraph -Query "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity) | summarize AlertsCount = count() by Severity"

列出依嚴重性和警示狀態排序的 Azure 監視器警示

此查詢會 alertsmanagementresources 使用數據表來傳回依嚴重性和警示狀態排序的 Azure 監視器警示。

alertsmanagementresources
| where type =~ 'microsoft.alertsmanagement/alerts'
| where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now()
| project Severity = tostring(properties.essentials.severity), AlertState = tostring(properties.essentials.alertState)
| summarize AlertsCount = count() by Severity, AlertState

az graph query -q "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity), AlertState = tostring(properties.essentials.alertState) | summarize AlertsCount = count() by Severity, AlertState"

Search-AzGraph -Query "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity), AlertState = tostring(properties.essentials.alertState) | summarize AlertsCount = count() by Severity, AlertState"

列出依嚴重性、監視服務和目標資源類型排序的 Azure 監視器警示

此查詢會 alertsmanagementresources 使用數據表傳回依嚴重性、監視服務和目標資源類型排序的 Azure 監視器警示。

alertsmanagementresources
| where type =~ 'microsoft.alertsmanagement/alerts'
| where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now()
| project Severity = tostring(properties.essentials.severity),
MonitorCondition = tostring(properties.essentials.monitorCondition),
ObjectState = tostring(properties.essentials.alertState),
MonitorService = tostring(properties.essentials.monitorService),
AlertRuleId = tostring(properties.essentials.alertRule),
SignalType = tostring(properties.essentials.signalType),
TargetResource = tostring(properties.essentials.targetResourceName),
TargetResourceType = tostring(properties.essentials.targetResourceName), id
| summarize AlertsCount = count() by Severity, MonitorService , TargetResourceType

az graph query -q "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity), MonitorCondition = tostring(properties.essentials.monitorCondition), ObjectState = tostring(properties.essentials.alertState), MonitorService = tostring(properties.essentials.monitorService), AlertRuleId = tostring(properties.essentials.alertRule), SignalType = tostring(properties.essentials.signalType), TargetResource = tostring(properties.essentials.targetResourceName), TargetResourceType = tostring(properties.essentials.targetResourceName), id | summarize AlertsCount = count() by Severity, MonitorService , TargetResourceType"

Search-AzGraph -Query "alertsmanagementresources | where type =~ 'microsoft.alertsmanagement/alerts' | where todatetime(properties.essentials.startDateTime) >= ago(2h) and todatetime(properties.essentials.startDateTime) < now() | project Severity = tostring(properties.essentials.severity), MonitorCondition = tostring(properties.essentials.monitorCondition), ObjectState = tostring(properties.essentials.alertState), MonitorService = tostring(properties.essentials.monitorService), AlertRuleId = tostring(properties.essentials.alertRule), SignalType = tostring(properties.essentials.signalType), TargetResource = tostring(properties.essentials.targetResourceName), TargetResourceType = tostring(properties.essentials.targetResourceName), id | summarize AlertsCount = count() by Severity, MonitorService , TargetResourceType"

下一步

深入了解查詢語言。
深入了解如何探索資源。
請參閱進階查詢的範例。