Fix the coverage section of the AKS workbook

Workbooks/AksSecurity.json

@@ -239,7 +239,7 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "resources\r\n| where type == \"microsoft.containerservice/managedclusters\"\r\n| summarize AksClusters = count() by subscriptionId, DefenderForAks = 0\r\n| union\r\n(securityresources\r\n| where type =~ \"microsoft.security/pricings\"\r\n| where name == \"KubernetesService\"\r\n| project DefenderForAks = iif(properties.pricingTier == 'Standard', 1, 0), AksClusters = 0, subscriptionId)\r\n| summarize AksClusters = sum(AksClusters), DefenderForAks = sum(DefenderForAks) by subscriptionId\r\n| project Subscription = strcat('/subscriptions/', subscriptionId), [\"AKS clusters\"] = AksClusters, ['Defender for AKS'] = iif(DefenderForAks > 0,'yes','no'), ['Onboard Azure Defender'] = iif(DefenderForAks > 0, '', 'https://ms.portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/26')\r\n| order by ['Defender for AKS'] asc\r\n",
+              "query": "datatable (Event:string)\r\n    [\"AKS Workbook\"]\r\n| extend cluster = (strcat(\"[\", \"{clustername}\", \"]\"))\r\n| extend cluster = todynamic(replace(\"'\", '\"', cluster))\r\n| mvexpand cluster\r\n| extend subscriptionId = extract(@\"/subscriptions/([^/]+)\", 1, tostring(cluster))\r\n| summarize AksClusters = count() by subscriptionId, DefenderForAks = 0\r\n| union\r\n(\r\nsecurityresources\r\n| where type =~ \"microsoft.security/pricings\"\r\n| where name == \"KubernetesService\"\r\n| project DefenderForAks = iif(properties.pricingTier == 'Standard', 1, 0), AksClusters = 0, subscriptionId\r\n)\r\n| summarize AksClusters = sum(AksClusters), DefenderForAks = sum(DefenderForAks) by subscriptionId\r\n| project Subscription = strcat('/subscriptions/', subscriptionId), [\"AKS clusters\"] = AksClusters, ['Defender for AKS'] = iif(DefenderForAks > 0,'yes','no'), ['Onboard Azure Defender'] = iif(DefenderForAks > 0, '', 'https://ms.portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/26')\r\n| order by ['Defender for AKS'] asc",
               "size": 0,
               "queryType": 1,
               "resourceType": "microsoft.resourcegraph/resources",
@@ -287,7 +287,7 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "resources\r\n| where type == \"microsoft.containerservice/managedclusters\"\r\n| summarize AksClusters = count() by subscriptionId, DefenderForAks = 0\r\n| union\r\n(securityresources\r\n| where type =~ \"microsoft.security/pricings\"\r\n| where name == \"KubernetesService\"\r\n| project DefenderForAks = iif(properties.pricingTier == 'Standard', 1, 0), AksClusters = 0, subscriptionId)\r\n| summarize AksClusters = sum(AksClusters), DefenderForAks = sum(DefenderForAks) by subscriptionId\r\n| project Subscription = 1, ['Defender for AKS'] = iif(DefenderForAks > 0,'Protected by Azure Defender','Not protected by Azure Defender')",
+              "query": "datatable (Event:string)\r\n    [\"AKS Workbook\"]\r\n| extend cluster = (strcat(\"[\", \"{clustername}\", \"]\"))\r\n| extend cluster = todynamic(replace(\"'\", '\"', cluster))\r\n| mvexpand cluster\r\n| extend subscriptionId = extract(@\"/subscriptions/([^/]+)\", 1, tostring(cluster))\r\n| summarize AksClusters = count() by subscriptionId, DefenderForAks = 0\r\n| union\r\n(\r\nsecurityresources\r\n| where type =~ \"microsoft.security/pricings\"\r\n| where name == \"KubernetesService\"\r\n| project DefenderForAks = iif(properties.pricingTier == 'Standard', 1, 0), AksClusters = 0, subscriptionId\r\n)\r\n| summarize AksClusters = sum(AksClusters), DefenderForAks = sum(DefenderForAks) by subscriptionId\r\n| project Subscription = 1, ['Defender for AKS'] = iif(DefenderForAks > 0,'Protected by Azure Defender','Not protected by Azure Defender')",
               "size": 0,
               "queryType": 1,
               "resourceType": "microsoft.resourcegraph/resources",

Workbooks/WorkbooksMetadata.json

@@ -1017,7 +1017,7 @@
     "dataTypesDependencies": [ "SecurityAlert", "AzureDiagnostics" ],
     "dataConnectorsDependencies": [ "AzureSecurityCenter" ],
     "previewImagesFileNames": [ "AksSecurityWhite.png", "AksSecurityBlack.png" ],
-    "version": "1.1",
+    "version": "1.2",
     "title": "Azure Kubernetes Service (AKS) Security",
     "templateRelativePath": "AksSecurity.json",
     "subtitle": "",