Well it’s been a long time since part one of this blog and much has changed with OMS Log Analytics. Namely, the query language has transitioned to Kusto and the webhook format that OMS sends to Azure Automation has changed.

The webhook payload change is very different if the Log Analytics workspace has been upgraded to Kusto (or if it is a new workspace). Examples of this payload can be found here. The method to consume this webhook data in PowerShell is below. The meat of it is lines 67-83, but just as important (and similar to the old method) is accepting the webhook payload via a PowerShell parameter.

[sourcecode language='powershell'  padlinenumbers='true' wraplines='false']
<# 
 
     .SYNOPSIS 
  
         vmcreate_v2.0.ps1 is an Azure Automation Powershell Runbook 
       .DESCRIPTION 
  
     This script recieves webhook data from OMS based on Azure Activity Logs recording a VM create 
     It will record the basic CMDB data and write it to the automation account output and to an azure storage table with the write-cmdbdata function     
 
 
    .EXAMPLE 
          This should be called by OMS based on an activity log search. See blogs.technet.microsoft.com/knightly 
 
     
 
    .NOTES 
  v 1.2 checks for vnet peering and only writes to the table if the vnet is peered. It also records the source image name.
  v 2.0 is updated for new webhook format of an array of tables containing the vm information 
   #> 


param ( 
    [object]$WebhookData
)

$RequestBody = ConvertFrom-JSON -InputObject $WebhookData.RequestBody
$connectionName = "AzureRunAsConnection"
try
{
    # Get the connection "AzureRunAsConnection "
    $servicePrincipalConnection=Get-AutomationConnection -Name $connectionName         

    "Logging in to Azure..."
    Add-AzureRmAccount `
        -ServicePrincipal `
        -TenantId $servicePrincipalConnection.TenantId `
        -ApplicationId $servicePrincipalConnection.ApplicationId `
        -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint 
}
catch {
    if (!$servicePrincipalConnection)
    {
        $ErrorMessage = "Connection $connectionName not found."
        throw $ErrorMessage
    } else{
        Write-Error -Message $_.Exception
        throw $_.Exception
    }
}
 
#Get all metadata properties    
$AlertRuleName = $RequestBody.AlertRuleName
$AlertThresholdOperator = $RequestBody.AlertThresholdOperator
$AlertThresholdValue = $RequestBody.AlertThresholdValue
$AlertDescription = $RequestBody.Description
$LinktoSearchResults =$RequestBody.LinkToSearchResults
$ResultCount =$RequestBody.ResultCount
$Severity = $RequestBody.Severity
$SearchQuery = $RequestBody.SearchQuery
$WorkspaceID = $RequestBody.WorkspaceId
$SearchWindowStartTime = $RequestBody.SearchIntervalStartTimeUtc
$SearchWindowEndTime = $RequestBody.SearchIntervalEndtimeUtc
$SearchWindowInterval = $RequestBody.SearchIntervalInSeconds

# Get detailed search results
if($RequestBody.SearchResult -ne $null)
{
    $SearchResultRows    = $RequestBody.SearchResult.tables[0].rows 
    $SearchResultColumns = $RequestBody.SearchResult.tables[0].columns;

    foreach ($SearchResultRow in $SearchResultRows)
    {   
        $Column = 0
        $Record = New-Object -TypeName PSObject 

        foreach ($SearchResultColumn in $SearchResultColumns)
        {
            $Name = $SearchResultColumn.name
            $ColumnValue = $SearchResultRow[$Column]
            $Record | Add-Member -MemberType NoteProperty -Name $name -Value $ColumnValue -Force
            $Column++
        }
$resourceID = $record.resourceID
$vmname = $record.resource
$rgname = $record.resourcegroup
$subID = $record.subscriptionID 
$caller = $record.caller
write-output $vmname + 'in resource group ' + $rgname 'in sub' + $subID + 'was created'
Select-AzureRmSubscription -SubscriptionId $SubId
$vminfo = Get-AzureRmvm -Name $vmname -ResourceGroupName $Rgname
$vmsize = $vminfo.HardwareProfile.vmsize
$nic = $vminfo.NetworkProfile.NetworkInterfaces
$string = $nic.id.ToString()
$nicname = $string.split("/")[-1]
$ipconfig = Get-AzureRmNetworkInterface -ResourceGroupName $rgname -Name $nicname
$subnet = $ipconfig.ipconfigurations.subnet.id.ToString()
$ipconfig = $ipconfig.IpConfigurations.privateipaddress
$vnet = $subnet.split("/")[-3]
$name = $vminfo.Name
$ostype = $vminfo.StorageProfile.OsDisk.OsType 
$location = $vminfo.location

#imageref is null if marketplace image was used
$imageref = $vminfo.StorageProfile.ImageReference.id
            if ($imageref -ne $null)
                {$sourceimg = $imageref.Split("/")[-1]}
                   else {$sourceimg = 'marketplace'}
$subname = (Get-AzureRmSubscription -SubscriptionId $subid).SubscriptionName

            
#check to see if the VM is on an ER conencted VNET by checking its peering
$peer=Get-AzureRmVirtualNetwork -Name $vnet -ResourceGroupName $rgname
$peer= $peer.VirtualNetworkPeerings

if ($peer.count -gt 0) #only write this data to the storage table if the network is peered (only peer'd vnets can talk to ER vnets)
  {
      
 

   
    #writing output into the automation account for debugging
    write-output "$vmsize $Ipconfig $location $name $ostype $caller $timestamp $subname, $Vnet, $LID"

    #once VM information is collected, it can be written into a storage table 
    Select-AzureRmSubscription -SubscriptionName 'Sub1' #this should be the subscription that owns the storage account, not where the VM is deployed
    $resourceGroup = "RGNAME" #resource group that contains the storage table
    $storageAccount = "cmdbtable" #storage account that contains the table
    $tableName = "CMData"
    $saContext = (Get-AzureRmStorageAccount -ResourceGroupName $resourceGroup -Name $storageAccount).Context
    $table = Get-AzureStorageTable -Name $tableName -Context $saContext 

 
    #search the storage table to see if the VM already exists
    [string]$filter1 = [Microsoft.WindowsAzure.Storage.Table.TableQuery]::GenerateFilterCondition("ResourceID", [Microsoft.WindowsAzure.Storage.Table.QueryComparisons]::Equal, "$resourceID")
    $new = Get-AzureStorageTableRowByCustomFilter -table $table -customFilter $filter1 
    if ($new -eq $null) {
        $partitionKey = "VMcreates"
        Add-StorageTableRow -table $table -partitionKey $partitionKey -rowKey ([guid]::NewGuid().tostring()) -property @{"SourceIMG" = "$sourceIMG"; "SubscriptionID" = "$subid"; "ResourceGroup" = "$rgname"; "ResourceID" = "$resourceID"; "computerName" = "$vmname"; "ostype" = "$ostype"; "CreatorID" = "$caller"; "PrivateIP" = "$IPconfig"; "Vnet"="$Vnet";"Location" = "$Location"}
          
    }
    else {
        $partitionKey = "VMUpdates"
        Add-StorageTableRow -table $table -partitionKey $partitionKey -rowKey ([guid]::NewGuid().tostring()) -property @{"SourceIMG" = "$sourceIMG"; "SubscriptionID" = "$subid"; "ResourceGroup" = "$rgname"; "ResourceID" = "$resourceID"; "computerName" = "$vmname"; "ostype" = "$ostype"; "CreatorID" = "$caller"; "PrivateIP" = "$IPconfig";"Vnet"="$Vnet"; "Location" = "$Location"}
          
    }

}}  }


  
[/sourcecode]

 $Conn = Get-AutomationConnection -Name AzureRunAsConnection 
add-AzureRmAccount -ServicePrincipal -Tenant $Conn.TenantID -ApplicationId $Conn.ApplicationID -CertificateThumbprint #yourthumbprint

Select-AzureRmSubscription -SubscriptionName 'sub2'
$rg = 'testrg'
New-AzureRmResourceGroup -Name $rg -Location westus2


    





]]>
    
    
      
      https://docs.microsoft.com/archive/blogs/knightly/rdp-not-working-over-azure-s2s-vpn-with-palo-alto
      Fri, 26 May 2017 02:06:36 GMT
      
      https://blogs.technet.microsoft.com/knightly/?p=85
      
      

NAT Setting:


We don't (yet) have a good reason as to why this setting solved the RDP issue. I'll comment on this when I know, and if you have some ideas, please feel free to comment.]]>
    
    
      
      https://docs.microsoft.com/archive/blogs/knightly/greenfield-test-environments-in-azure
      Wed, 17 May 2017 19:57:18 GMT
      
      https://blogs.technet.microsoft.com/knightly/?p=35
      
      
 	
Get an Azure subscription (MSDN is a great solution here - https://azure.microsoft.com/en-us/pricing/member-offers/msdn-benefits-details/)
 	
build the lab VMs in Azure (leave yourself a password or two set to never expire - you may want to greenfield this lab in a year!)
 	
shut down the lab VMs so you can re-deploy off their VHDs
 	
Use an ARM template like this one https://azure.microsoft.com/en-us/resources/templates/101-vm-from-user-image/a PowerShell script, or a combination of the two (like I have sampled below).
 	
Once you are done working in the lab, delete the resource group (using my script example the resource group is 'greenfieldlab') and that will delete all of the VMs and storage.
 	
Re-deploy the lab as often as needed for new testing. To update the source lab, just start and update the source VMs/VHDs.

 


    This code is Copyright (c) 2017 Microsoft Corporation.
All rights reserved.
THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED,
INCLUDING BUT NOT LIMITED To THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
PARTICULAR PURPOSE.'

IN NO EVENT SHALL MICROSOFT AND/OR ITS RESPECTIVE SUPPLIERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
WITH THE USE OR PERFORMANCE OF THIS CODE OR INFORMATION.

.SYNOPSIS

Script deploys a test lab including 7 VMs.
.DESCRIPTIONin

.PARAMETER

.INPUTS
The script will ask for credentials. These are the credentials for your azure subscription, not the VMs. VM creds are already set.

.NOTES
Version: 1.3
Author: John Knightly Microsoft
Creation Date: 4/25/17

#change this to the path of your template deployment file
$templatefile= 'https://mystorageaccountname.blob.core.windows.net/json/lab.json'

#get credential information
login-azurermaccount

#create resourcegroup
$region = 'westus2'
$RG='GreenfieldLab'
New-AzureRmResourceGroup -Name $RG -Location $region

#create vnet
$subnet1 = new-azurermvirtualnetworksubnetconfig -name 'subnet1' -addressprefix '10.6.0.0/24'
$subnetname='subnet1'
$vnetname=$rg+'vnet'

$VNET = New-AzureRmVirtualNetwork -Name $vnetname -Location $region -ResourceGroupName $RG -AddressPrefix '10.6.0.0/24' -subnet $subnet -DnsServer '10.6.0.4'

#create new storage account, get the access key and create a storage context
$saprefix=get-random -Minimum 1000 -Maximum 10000000
$saname = 'greenfieldlab'+$saprefix
$storage = New-AzureRMStorageAccount -ResourceGroupName $RG -Name $saname -Location $region -type Standard_LRS
$storagekey = (get-azureRMstorageaccountkey -resourcegroupname $RG -StorageAccountName $saname).value[1]
$destcontext = New-AzureStorageContext -StorageAccountName $saname -StorageAccountKey $storagekey
$destcontainer = New-AzureStorageContainer -Name 'images' -Context $destcontext
$destvhd = New-AzureStorageContainer -Name 'vhds' -Context $destcontext

#setup vars to copy files from source to newly created storage account
$sourcesaname = 'yourstorageaccountname'
#use your own source key
$sourcekey= 'youcanthavemystorageaccountkey_gogenerateyourown'
$sourcecontext = New-AzureStorageContext -StorageAccountName $sourcesaname -StorageAccountKey $sourcekey
$sourcecontainer = Get-AzureStoragecontainer -Context $sourcecontext
$blobs = get-azurestorageblob -container $sourcecontainer.Name -Context $sourcecontext

#file copy
foreach ($b in $blobs)
{
Start-AzureStorageBlobCopy -SrcContainer $sourcecontainer.name -DestContainer $destcontainer.name -Context $sourcecontext -DestContext $destcontext -SrcBlob $b.Name

}

write-host "Copy could take some time please be patient. Generally 1-2 hours is normal, but there is no SLA in Azure for storage account copies" -ForegroundColor yellow
# below status checks are functioning to hold script until all blobs are completed copying
$_copytime = get-date
$Blobs | foreach {
while ((get-azurestorageblob $_.name -context $destcontext -Container $destcontainer.name | get-azurestorageblobcopystate).Status -eq "pending"){
$_results = get-azurestorageblob $blobs[1].name -context $destcontext -Container $destcontainer.name | get-azurestorageblobcopystate
Write-Progress -Activity "Copying Blobs" -Status "Progress: $(($_results).bytescopied) of $(($_results).TotalBytes) - Total Time Passed: $((new-TimeSpan($_copytime) $(Get-Date)).minutes) minutes" -PercentComplete ($(($_results).bytescopied)/$(($_results).TotalBytes)*100)
start-sleep -Seconds 60
}
}

write-host "Total copy time $((new-TimeSpan($_copytime) $(Get-Date)).minutes) minutes" -foregroundcolor yellow

#set vars for path of VHD file for each vm to be deployed
$contosoVHD = $destcontext.BlobEndPoint + 'images/contosodc120170331122936.vhd'
$eudc1vhd = $destcontext.BlobEndPoint + 'images/eucontosodc120170417083825.vhd'
$fabdcvhd = $destcontext.BlobEndPoint + 'images/fabrikamdc120170331123706.vhd'
$exchvhd = $destcontext.BlobEndPoint + 'images/contosoex120170331131217.vhd'
$contosofsvhd = $destcontext.BlobEndPoint + 'images/contosofs120170331123927.vhd'
$fabfsvhd = $destcontext.BlobEndPoint + 'images/fabrikamFS120170331130906.vhd'
$eufsvhd = $destcontext.BlobEndPoint + 'images/EUFS120170331131044.vhd'
$templatefile= 'https://812231westus2.blob.core.windows.net/json/lab.json'

#deployment of contosodc1 waiting for this one to deploy first since it is vnets DNS server
New-AzureRmResourceGroupDeployment -Name 'contosodc1' -ResourceGroupName $RG -TemplateUri $templatefile -vmName 'contosodc1' -ostype 'Windows' -osdiskvhduri $contosovhd -vmsize 'standard_d2_v2' -existingvirtualnetworkname $vnetname -existingvirtualnetworkresourcegroup $RG -subnetname $subnetname

#wait for contosodc1 deployment to be complete
$contosodcstatus = Get-AzureRmVM -Name contosodc1 -resourcegroup aclxraylab
while ($contosodcstatus.ProvisioningState -ne 'Succeeded')
{start-sleep -seconds 10
$contosodcstatus = Get-AzureRmVM -Name contosodc1 -resourcegroup aclxraylab
write-host 'Waiting for Forest Root DC deployment to complete'
}
Start-Sleep -Seconds 15

#set contosodc1 to static IP
$nic=Get-AzureRmNetworkInterface -Name contosodc1 -ResourceGroupName $rg
$nic.IpConfigurations[0].PrivateIpAllocationMethod = "Static"
$nic.IpConfigurations[0].PrivateIpAddress = "10.6.0.4"
Set-AzureRmNetworkInterface -NetworkInterface $nic

#deploy remaining VMs
New-AzureRmResourceGroupDeployment -Name 'eucontosodc1' -ResourceGroupName $RG -TemplateUri $templatefile -vmName 'eucontosodc1' -ostype 'Windows' -osdiskvhduri $eudc1vhd -vmsize 'standard_d2_v2' -existingvirtualnetworkname $vnetname -existingvirtualnetworkresourcegroup $RG -subnetname $subnetname
New-AzureRmResourceGroupDeployment -Name 'fabrikamdc1' -ResourceGroupName $RG -TemplateUri $templatefile -vmName 'fabrikamdc1' -ostype 'Windows' -osdiskvhduri $fabdcvhd -vmsize 'standard_d2_v2' -existingvirtualnetworkname $vnetname -existingvirtualnetworkresourcegroup $RG -subnetname $subnetname
New-AzureRmResourceGroupDeployment -Name 'contosoex1' -ResourceGroupName $RG -TemplateUri $templatefile -vmName 'contosoex1' -ostype 'Windows' -osdiskvhduri $exchvhd -vmsize 'standard_d2_v2' -existingvirtualnetworkname $vnetname -existingvirtualnetworkresourcegroup $RG -subnetname $subnetname
New-AzureRmResourceGroupDeployment -Name 'contosofs' -ResourceGroupName $RG -TemplateUri $templatefile -vmName 'contosofs1' -ostype 'Windows' -osdiskvhduri $contosofsvhd -vmsize 'standard_d2_v2' -existingvirtualnetworkname $vnetname -existingvirtualnetworkresourcegroup $RG -subnetname $subnetname
New-AzureRmResourceGroupDeployment -Name 'fabrikamfs' -ResourceGroupName $RG -TemplateUri $templatefile -vmName 'FabrikamFS' -ostype 'Windows' -osdiskvhduri $fabfsvhd -vmsize 'standard_d2_v2' -existingvirtualnetworkname $vnetname -existingvirtualnetworkresourcegroup $RG -subnetname $subnetname
New-AzureRmResourceGroupDeployment -Name 'eufs' -ResourceGroupName $RG -TemplateUri $templatefile -vmName 'eufs1' -ostype 'Windows' -osdiskvhduri $eufsvhd -vmsize 'standard_d2_v2' -existingvirtualnetworkname $vnetname -existingvirtualnetworkresourcegroup $RG -subnetname $subnetname

#stop the environment so i'm not getting charged for compute while waiting to start using it
Get-AzureRmvm -ResourceGroupName $rg | stop-AzureRmVM -force

Write-host "Lab deployment is now complete. The VMs are stopped." -ForegroundColor Cyan

]]>