PSRule to Azure Monitor

Log PSRule analysis results to Azure Monitor.

Disclaimer

This project is open source and not a supported product.

If you are experiencing problems, have a feature request, or a question, please check for an issue on GitHub. If you do not see your problem captured, please file a new issue, and follow the provided template.

If you have any problems with the PSRule engine, please check the project GitHub issues page instead.

Getting the modules

This project requires the PSRule PowerShell module. For details on each see install.

You can download and install these modules from the PowerShell Gallery.

Module	Description	Downloads / instructions
PSRule.Monitor	Log PSRule analysis results to Azure Monitor.	latest / instructions

Getting started

Upload results

To upload results from PSRule to Azure Monitor, use the Send-PSRuleMonitorRecord cmdlet. Results can by piped directly from Invoke-PSRule or stored and piped from a variable.

The Send-PSRuleMonitorRecord cmdlet requires a Log Analytics workspace to send data to. A workspace can be specified by using the -WorkspaceId and -SharedKey parameters.

For example:

$data | Invoke-PSRule | Send-PSRuleMonitorRecord -WorkspaceId <workspaceId> -SharedKey <primaryKey>;

The following example shows using analysis results from a pre-built module:

$results = Invoke-PSRule -InputPath .\*.json -Module 'PSRule.Rules.Azure';
$results | Send-PSRuleMonitorRecord -WorkspaceId <workspaceId> -SharedKey <primaryKey>;

Querying logs from Azure Monitor

By default, PSRule results are stored in the PSRule_CL table. The following query returns all rule records from the last hour that failed:

PSRule_CL
| where Outcome_s == "Fail" and TimeGenerated > ago(1h)

To query these results from PowerShell use:

Invoke-AzOperationalInsightsQuery -WorkspaceId <workspaceId> -Query 'PSRule_CL | where Outcome_s == "Fail" and TimeGenerated > ago(1h)'

Language reference

Commands

The following commands exist in the PSRule.Monitor module:

• Send-PSRuleMonitorRecord - Send analysis results from PSRule to Azure Monitor.

Changes and versioning

Modules in this repository will use the semantic versioning model to declare breaking changes from v1.0.0. Prior to v1.0.0, breaking changes may be introduced in minor (0.x.0) version increments. For a list of module changes please see the change log.

Pre-release module versions are created on major commits and can be installed from the PowerShell Gallery. Pre-release versions should be considered experimental. Modules and change log details for pre-releases will be removed as standard releases are made available.

Contributing

This project welcomes contributions and suggestions. If you are ready to contribute, please visit the contribution guide.

Code of Conduct

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Maintainers

• Bernie White

License

This project is licensed under the MIT License.