custom_recommendations

Creates, updates, deletes, gets or lists a custom_recommendations resource.

Overview

Name	custom_recommendations
Type	Resource
Id	azure.security.custom_recommendations

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assessmentKey	string	The assessment metadata key used when an assessment is generated for this Recommendation.
cloudProviders	array	List of all standard supported clouds.
description	string	The description to relate to the assessments generated by this Recommendation.
displayName	string	The display name of the assessments generated by this Recommendation.
query	string	KQL query representing the Recommendation results required.
remediationDescription	string	The remediation description to relate to the assessments generated by this Recommendation.
securityIssue	string	The severity to relate to the assessments generated by this Recommendation. Known values are: "Vulnerability", "ExcessivePermissions", "AnonymousAccess", "NetworkExposure", "TrafficEncryption", and "BestPractices". (Vulnerability, ExcessivePermissions, AnonymousAccess, NetworkExposure, TrafficEncryption, BestPractices)
severity	string	The severity to relate to the assessments generated by this Recommendation. Known values are: "High", "Medium", and "Low". (High, Medium, Low)
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assessmentKey	string	The assessment metadata key used when an assessment is generated for this Recommendation.
cloudProviders	array	List of all standard supported clouds.
description	string	The description to relate to the assessments generated by this Recommendation.
displayName	string	The display name of the assessments generated by this Recommendation.
query	string	KQL query representing the Recommendation results required.
remediationDescription	string	The remediation description to relate to the assessments generated by this Recommendation.
securityIssue	string	The severity to relate to the assessments generated by this Recommendation. Known values are: "Vulnerability", "ExcessivePermissions", "AnonymousAccess", "NetworkExposure", "TrafficEncryption", and "BestPractices". (Vulnerability, ExcessivePermissions, AnonymousAccess, NetworkExposure, TrafficEncryption, BestPractices)
severity	string	The severity to relate to the assessments generated by this Recommendation. Known values are: "High", "Medium", and "Low". (High, Medium, Low)
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	scope, custom_recommendation_name		Get a specific custom recommendation for the requested scope by customRecommendationName.
list	select	scope		Get a list of all relevant custom recommendations over a scope.
create_or_update	insert	scope, custom_recommendation_name		Creates or updates a custom recommendation over a given scope.
create_or_update	replace	scope, custom_recommendation_name		Creates or updates a custom recommendation over a given scope.
delete	delete	scope, custom_recommendation_name		Delete a custom recommendation over a given scope.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
custom_recommendation_name	string	Name of the Custom Recommendation. Required.
scope	string	The fully qualified Azure Resource manager identifier of the resource. Required.

SELECT examples

get

Get a specific custom recommendation for the requested scope by customRecommendationName.

SELECT
id,
name,
assessmentKey,
cloudProviders,
description,
displayName,
query,
remediationDescription,
securityIssue,
severity,
systemData,
type
FROM azure.security.custom_recommendations
WHERE scope = '{{ scope }}' -- required
AND custom_recommendation_name = '{{ custom_recommendation_name }}' -- required
;

list

Get a list of all relevant custom recommendations over a scope.

SELECT
id,
name,
assessmentKey,
cloudProviders,
description,
displayName,
query,
remediationDescription,
securityIssue,
severity,
systemData,
type
FROM azure.security.custom_recommendations
WHERE scope = '{{ scope }}' -- required
;

INSERT examples

create_or_update

Creates or updates a custom recommendation over a given scope.

INSERT INTO azure.security.custom_recommendations (
properties,
scope,
custom_recommendation_name
)
SELECT 
'{{ properties }}',
'{{ scope }}',
'{{ custom_recommendation_name }}'
RETURNING
id,
name,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: custom_recommendations
props:
  - name: scope
    value: "{{ scope }}"
    description: Required parameter for the custom_recommendations resource.
  - name: custom_recommendation_name
    value: "{{ custom_recommendation_name }}"
    description: Required parameter for the custom_recommendations resource.
  - name: properties
    description: |
      describes Custom Recommendation properties.
    value:
      query: "{{ query }}"
      cloudProviders:
        - "{{ cloudProviders }}"
      severity: "{{ severity }}"
      securityIssue: "{{ securityIssue }}"
      displayName: "{{ displayName }}"
      description: "{{ description }}"
      remediationDescription: "{{ remediationDescription }}"
      assessmentKey: "{{ assessmentKey }}"

REPLACE examples

create_or_update

Creates or updates a custom recommendation over a given scope.

REPLACE azure.security.custom_recommendations
SET 
properties = '{{ properties }}'
WHERE 
scope = '{{ scope }}' --required
AND custom_recommendation_name = '{{ custom_recommendation_name }}' --required
RETURNING
id,
name,
properties,
systemData,
type;

DELETE examples

delete

Delete a custom recommendation over a given scope.

DELETE FROM azure.security.custom_recommendations
WHERE scope = '{{ scope }}' --required
AND custom_recommendation_name = '{{ custom_recommendation_name }}' --required
;