ARG fix for D07.22

[igorjnzl]

Description

Small change in graph query to fix parsing issue. Renaming output to make results more readable

Checklist

• [ x] I've tested my changes to ensure they are ready for review.
• I've read the CONTRIBUTING.md guide.
• I've updated the documentation (if applicable).
• [ x] Resource Graph queries have been included (and tested) for recommendations where ever possible¹.
• Resource Graph queries have NOT been included (please explain below).

Footnotes

1. Details on how to add Azure Resource Graph queries to recommendations can be found here. ↩

[brsteph]

We need to add the compliant returned property to the query, and we want it to show the compliant and not compliant. I did a quick rework for this:

resources | where type =~ 'Microsoft.Network/azureFirewalls' | where isempty(properties.virtualHub.id) or isnull(properties.virtualHub.id) | mv-expand ipConfig = properties.ipConfigurations | project name, firewallId = id, tags, vNetName = split(ipConfig.properties.subnet.id, '/', 8)[0], vNetId = tolower(substring(ipConfig.properties.subnet.id, 0, indexof(ipConfig.properties.subnet.id, '/subnet'))) | join kind=fullouter ( resources | where type =~ 'Microsoft.Network/ddosProtectionPlans' | mv-expand vNet = properties.virtualNetworks | project ddosProtectionPlanId = id, vNetId = tolower(vNet.id) ) on vNetId | extend compliant = iif(isempty(ddosProtectionPlanId), false, true) | project name, compliant, id = firewallId, tags, network = strcat('vNet: ', vNetName)

Would that be OK to use instead? That way it works with the dashboarding.