Log PSRule analysis results to Azure Monitor.

This project requires the PSRule PowerShell module. For detail on installation and dependencies see install.

You can download and install these modules from the PowerShell Gallery.

A convention can be used to upload the results of a PSRule analysis to Azure Monitor. To use the convention:

• Install the PSRule.Monitor module from the PowerShell Gallery.
• Include the PSRule.Monitor module. This can be set in PSRule options or specified at runtime as a parameter.
• Reference Monitor.LogAnalytics.Import convention. This can be set in PSRule options or specified at runtime as a parameter.

For example:

include:
  module:
  - 'PSRule.Monitor'

convention:
  include:
  - 'Monitor.LogAnalytics.Import

When using the convention a Log Analytics workspace must be specified. This can be done by setting the following environment variables:

• PSRULE_CONFIGURATION_MONITOR_WORKSPACE_ID - Containing the Log Analytics workspace ID.
• PSRULE_CONFIGURATION_MONITOR_WORKSPACE_KEY - Containing either the primary or secondary key to the workspace. This value is sensitive and should be stored securely. To protect this value, avoid storing it in source control.

For example:

# PowerShell: Setting environment variable
$Env:PSRULE_CONFIGURATION_MONITOR_WORKSPACE_ID = '00000000-0000-0000-0000-000000000000'
$Env:PSRULE_CONFIGURATION_MONITOR_WORKSPACE_KEY = Get-Secret -Name 'WORKSPACE_KEY' -AsPlainText

# GitHub Actions: Setting environment variable with microsoft/ps-rule action
- name: Run PSRule analysis
  uses: microsoft/ps-rule@main
  env:
    PSRULE_CONFIGURATION_MONITOR_WORKSPACE_ID: 00000000-0000-0000-0000-000000000000
    PSRULE_CONFIGURATION_MONITOR_WORKSPACE_KEY: ${{ secrets.WORKSPACE_KEY }}

# Azure Pipelines: Setting environment variable with ps-rule-assert task
- task: ps-rule-assert@0
  displayName: Run PSRule analysis
  inputs:
    inputType: repository
  env:
    PSRULE_CONFIGURATION_MONITOR_WORKSPACE_ID: 00000000-0000-0000-0000-000000000000
    PSRULE_CONFIGURATION_MONITOR_WORKSPACE_KEY: $(WORKSPACE_KEY)

To upload results from PSRule to Azure Monitor, use the Send-PSRuleMonitorRecord cmdlet. Results can by piped directly from Invoke-PSRule or stored and piped from a variable.

The Send-PSRuleMonitorRecord cmdlet requires a Log Analytics workspace to send data to. A workspace can be specified by using the -WorkspaceId and -SharedKey parameters.

For example:

$data | Invoke-PSRule | Send-PSRuleMonitorRecord -WorkspaceId <workspaceId> -SharedKey <primaryKey>;

The following example shows using analysis results from a pre-built module:

$results = Invoke-PSRule -InputPath .\*.json -Module 'PSRule.Rules.Azure';
$results | Send-PSRuleMonitorRecord -WorkspaceId <workspaceId> -SharedKey <primaryKey>;

By default, PSRule results are stored in the PSRule_CL table. The results can be queries from the Log Analytics workspace using Kusto.

The following query returns all rule records from the last hour that failed:

PSRule_CL
| where Outcome_s == "Fail" and TimeGenerated > ago(1h)

To query these results from PowerShell use:

Invoke-AzOperationalInsightsQuery -WorkspaceId <workspaceId> -Query 'PSRule_CL | where Outcome_s == "Fail" and TimeGenerated > ago(1h)'

The following commands exist in the PSRule.Monitor module:

• Send-PSRuleMonitorRecord - Send analysis results from PSRule to Azure Monitor.

This project welcomes contributions and suggestions. If you are ready to contribute, please visit the contribution guide.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

• Bernie White

This project is licensed under the MIT License.