Queries for the NTARuleRecommendation table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Display all the recommended rules for a Vnet in given time duration

Gets list of rules recommended for a particular vnet.

let targetResource = <vnetResourceId>
let flowStartTime =  <startTime>
let flowEndTime = <endTime>
source
| where TargetResourceId contains targetResource
| where StartTime >= flowStartTime and EndTime <= flowEndTime
| where RuleScope == "Vnet"
| where SummarizationType == "Hourly"
| project
	TimeGenerated = now(),
	RecommendedRuleName = RecommendedRuleName,
	SchemaVersion = SchemaVersion,
	StartTime = StartTime,
	EndTime = EndTime,
	TargetResourceId = TargetResourceId,
	TargetResourceIdsList = TargetResourceIdsList,
	SrcSubscriptionId = SrcSubscriptionId,
	DestSubscriptionId = DestSubscriptionId,
	L4Protocol = L4Protocol,
	PortCategory = PortCategory,
	SrcPublicIpCidrs = SrcPublicIpCidrs,
	DestPublicIpCidrs = DestPublicIpCidrs,
	SrcServiceTagsList = SrcServiceTagsList,
	DestServiceTagsList = DestServiceTagsList,
	TotalFlowCount = TotalFlowCount,
	DestPortsRanges = DestPortsRanges,
	IpRegionDetails = IpRegionDetails,
	IpUrls = IpUrls,
	UnecryptedFlowDetails = UnecryptedFlowDetails,
	RecommendedAction = RecommendedAction