{"resources":{"azure":{"id":"azure","name":"azure","fields":{"subscription":{"name":"subscription","type":"\u001bazure.subscription","title":"Azure subscription","desc":"Billing, identity, and policy container that owns every Azure resource accessible to the provider, and the top of the resource hierarchy for auditing an Azure tenant. Exposes the subscription state, authorization source, applied tags, managing tenants, and the placement, quota, and spending-limit settings in subscriptionsPolicies. Resource groups, individual resources, and deployments are reachable from here, along with per-service accessors for compute, network, storage, identity, Key Vault, Defender for Cloud, and every other modeled Azure service, letting you traverse from a subscription into any resource it contains.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true}},"title":"Microsoft Azure","desc":"Root namespace and entry point for the Azure provider. The active subscription is exposed as `azure.subscription`, and every Azure service-specific accessor (Compute, Storage, Network, Key Vault, Cosmos DB, Monitor, Defender for Cloud, AKS, and so on) is reached through that subscription.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription":{"id":"azure.subscription","name":"azure.subscription","fields":{"advisor":{"name":"advisor","type":"\u001bazure.subscription.advisorService","title":"Advisor resources in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"advisorService":{"name":"advisorService","type":"\u001bazure.subscription.advisorService","title":"Azure Advisor","desc":"Azure Advisor recommendations and category scores for a subscription. Advisor analyzes resource configuration and usage telemetry and flags improvements across cost, security, reliability, operational excellence, and performance. The `recommendations` field enumerates individual findings, while `scores` and the rolled-up `averageScore` track posture per category over time.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"aks":{"name":"aks","type":"\u001bazure.subscription.aksService","title":"AKS resources in the subscription","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"aksService":{"name":"aksService","type":"\u001bazure.subscription.aksService","title":"Azure Kubernetes Service","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"apiManagement":{"name":"apiManagement","type":"\u001bazure.subscription.apiManagementService","title":"API Management resources in the subscription","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"apiManagementService":{"name":"apiManagementService","type":"\u001bazure.subscription.apiManagementService","title":"Azure API Management","desc":"API Management gateway instances configured in the subscription. Each entry in `services` is a multi-tenant API gateway that fronts backend APIs, exposing its SKU, virtual-network integration mode, public network access posture, gateway TLS and cipher policy, managed identity, endpoint URLs, and private endpoint connection state.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"appConfiguration":{"name":"appConfiguration","type":"\u001bazure.subscription.appConfigurationService","title":"App Configuration resources in the subscription","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"appConfigurationService":{"name":"appConfigurationService","type":"\u001bazure.subscription.appConfigurationService","title":"App Configuration","desc":"App Configuration stores in the subscription, each centralizing application settings and feature flags. That content routinely includes references to secrets, so this namespace is the entry point for auditing per-store public-network exposure, customer-managed-key encryption, and authentication posture.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"authorizationService":{"name":"authorizationService","type":"\u001bazure.subscription.authorizationService","title":"Azure IAM service","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"authorizationSource":{"name":"authorizationSource","type":"\u0007","is_mandatory":true,"title":"Subscription authorization source","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"automation":{"name":"automation","type":"\u001bazure.subscription.automationService","title":"Azure Automation accounts in the subscription","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"automationService":{"name":"automationService","type":"\u001bazure.subscription.automationService","title":"Azure Automation","desc":"Entry point for the Azure Automation accounts in the subscription, available through `accounts`. Automation accounts host runbooks, DSC configurations, and shared assets (variables, credentials, and certificates), so this is the starting point for auditing how a subscription automates operations and what secrets that automation stores.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"batch":{"name":"batch","type":"\u001bazure.subscription.batchService","title":"Batch resources in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"batchService":{"name":"batchService","type":"\u001bazure.subscription.batchService","title":"Azure Batch","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"cache":{"name":"cache","type":"\u001bazure.subscription.cacheService","title":"Cache resources in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cacheService":{"name":"cacheService","type":"\u001bazure.subscription.cacheService","title":"Azure Cache for Redis","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"cloudDefender":{"name":"cloudDefender","type":"\u001bazure.subscription.cloudDefenderService","title":"Cloud defender resources in the subscription","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cloudDefenderService":{"name":"cloudDefenderService","type":"\u001bazure.subscription.cloudDefenderService","title":"Microsoft Defender for Cloud","desc":"Microsoft Defender for Cloud posture and threat protection for the subscription. Reports which Defender plans (servers, containers, storage, databases, key vaults, App Service, Resource Manager, APIs, and CSPM) are enabled and at what pricing tier, alongside security assessments, active alerts, secure scores, regulatory compliance results, just-in-time VM access policies, alert suppression rules, workspace settings, and security contacts. Audit it to confirm the intended protections are turned on and to review the subscription's overall security posture.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"cognitiveServices":{"name":"cognitiveServices","type":"\u001bazure.subscription.cognitiveServicesService","title":"Azure AI Services / Cognitive Services resources in the subscription","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cognitiveServicesService":{"name":"cognitiveServicesService","type":"\u001bazure.subscription.cognitiveServicesService","title":"Azure AI Services","desc":"Azure AI Services (formerly Cognitive Services) accounts in the subscription, backed by the `Microsoft.CognitiveServices` resource provider. Each account exposes AI APIs (OpenAI, Speech, Vision, Language, and others) whose prompts and responses can carry sensitive data, so this namespace is the entry point for auditing their public-network exposure, network ACLs, customer-managed-key encryption, and authentication posture. The `accounts` field holds the per-account records.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"compute":{"name":"compute","type":"\u001bazure.subscription.computeService","title":"Compute resources in the subscription","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"computeService":{"name":"computeService","type":"\u001bazure.subscription.computeService","title":"Azure Compute","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"containerApp":{"name":"containerApp","type":"\u001bazure.subscription.containerAppService","title":"Azure Container Apps resources in the subscription","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"containerAppService":{"name":"containerAppService","type":"\u001bazure.subscription.containerAppService","title":"Azure Container Apps","desc":"Azure Container Apps managed environments, the container apps running in them, and Container Apps jobs across the subscription. Covers ingress posture, image pinning, identity-vs-secret registry auth, Easy Auth configuration, and revision history.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"containerInstance":{"name":"containerInstance","type":"\u001bazure.subscription.containerInstanceService","title":"Azure Container Instances resources in the subscription","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"containerInstanceService":{"name":"containerInstanceService","type":"\u001bazure.subscription.containerInstanceService","title":"Azure Container Instances","desc":"Container Instances (ACI) container groups in the subscription and the containers within them. The auditable surface includes OS type, restart policy, image pinning, registry authentication, VNET delegation, container security context (privileged, runAsUser), and confidential-ACI usage.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"containerRegistry":{"name":"containerRegistry","type":"\u001bazure.subscription.containerRegistryService","title":"Container Registry resources in the subscription","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"containerRegistryService":{"name":"containerRegistryService","type":"\u001bazure.subscription.containerRegistryService","title":"Azure Container Registry service","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"cosmosDb":{"name":"cosmosDb","type":"\u001bazure.subscription.cosmosDbService","title":"Cosmos DB resources in the subscription","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cosmosDbService":{"name":"cosmosDbService","type":"\u001bazure.subscription.cosmosDbService","title":"Azure Cosmos DB","desc":"Entry point to Azure Cosmos DB resources in a subscription. Lists the classic multi-model Cosmos DB accounts, the Cosmos DB for MongoDB (vCore) clusters, and the Cosmos DB for PostgreSQL (Citus) clusters, each a distinct Azure resource type with its own configuration and security posture.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"dataFactory":{"name":"dataFactory","type":"\u001bazure.subscription.dataFactoryService","title":"Data Factory resources in the subscription","min_provider_version":"13.3.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataFactoryService":{"name":"dataFactoryService","type":"\u001bazure.subscription.dataFactoryService","title":"Azure Data Factory service","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"databricks":{"name":"databricks","type":"\u001bazure.subscription.databricksService","title":"Databricks resources in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"databricksService":{"name":"databricksService","type":"\u001bazure.subscription.databricksService","title":"Azure Databricks","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"deployment":{"name":"deployment","type":"\u001bazure.subscription.deployment","title":"Azure Resource Manager deployment","desc":"Azure Resource Manager template deployment, the unit that provisions or updates a set of resources from a template. The deployment reports its provisioning state and completion timestamp, the deployment mode, the template and parameters used, the resources it produced through `outputResources`, and the `correlationId` that links it to the activity log events it generated. Query this to trace which deployment created or last changed a group of resources.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"deployments":{"name":"deployments","type":"\u0019\u001bazure.subscription.deployment","title":"Subscription-scoped Azure Resource Manager deployments","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"desktopVirtualization":{"name":"desktopVirtualization","type":"\u001bazure.subscription.desktopVirtualizationService","title":"Azure Virtual Desktop resources in the subscription","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"desktopVirtualizationService":{"name":"desktopVirtualizationService","type":"\u001bazure.subscription.desktopVirtualizationService","title":"Azure Virtual Desktop","desc":"Azure Virtual Desktop deployment in the subscription and the entry point for auditing virtual desktop infrastructure. The `hostPools` field lists every host pool, each of which governs RDP redirection settings, session limits, public network exposure, and single sign-on for the session hosts that deliver desktops and applications to users.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"dns":{"name":"dns","type":"\u001bazure.subscription.dnsService","title":"DNS resources in the subscription","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dnsService":{"name":"dnsService","type":"\u001bazure.subscription.dnsService","title":"Azure DNS service","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"eventGrid":{"name":"eventGrid","type":"\u001bazure.subscription.eventGridService","title":"Event Grid resources in the subscription","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"eventGridService":{"name":"eventGridService","type":"\u001bazure.subscription.eventGridService","title":"Azure Event Grid service","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"eventHub":{"name":"eventHub","type":"\u001bazure.subscription.eventHubService","title":"Event Hubs resources in the subscription","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"eventHubService":{"name":"eventHubService","type":"\u001bazure.subscription.eventHubService","title":"Azure Event Hubs service","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"frontDoor":{"name":"frontDoor","type":"\u001bazure.subscription.frontDoorService","title":"Front Door and CDN resources in the subscription","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"frontDoorService":{"name":"frontDoorService","type":"\u001bazure.subscription.frontDoorService","title":"Azure Front Door and CDN service","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"functions":{"name":"functions","type":"\u001bazure.subscription.functionsService","title":"Azure Functions resources in the subscription","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"functionsService":{"name":"functionsService","type":"\u001bazure.subscription.functionsService","title":"Azure Functions service","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"iam":{"name":"iam","type":"\u001bazure.subscription.authorizationService","title":"Authorization resources in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Full resource identifier of the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"iot":{"name":"iot","type":"\u001bazure.subscription.iotService","title":"IoT resources in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"iotService":{"name":"iotService","type":"\u001bazure.subscription.iotService","title":"Azure IoT Hub Service","desc":"IoT Hub deployments across the subscription. IoT Hub is the managed service that brokers bidirectional communication between IoT devices and Azure. Query `iotHubs` to audit each hub's authentication policy (SAS-key controls), TLS enforcement, public network exposure, outbound egress restrictions, and managed identity assignment.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"keyVault":{"name":"keyVault","type":"\u001bazure.subscription.keyVaultService","title":"Azure Key Vault resources in the subscription","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultService":{"name":"keyVaultService","type":"\u001bazure.subscription.keyVaultService","title":"Azure Key Vault","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"kusto":{"name":"kusto","type":"\u001bazure.subscription.kustoService","title":"Azure Data Explorer (Kusto) resources in the subscription","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kustoService":{"name":"kustoService","type":"\u001bazure.subscription.kustoService","title":"Azure Data Explorer (Kusto)","desc":"Azure Data Explorer (Kusto) clusters in the subscription. Enumerate `clusters` to audit real-time analytics deployments for public network exposure, encryption at rest, and the principals granted access.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"lighthouse":{"name":"lighthouse","type":"\u001bazure.subscription.lighthouseService","title":"Azure Lighthouse cross-tenant delegated resource management on the subscription","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lighthouseService":{"name":"lighthouseService","type":"\u001bazure.subscription.lighthouseService","title":"Azure Lighthouse","desc":"Cross-tenant delegated resource management on the subscription, backed by the `Microsoft.ManagedServices` resource provider. Registration definitions describe an external (managedBy) tenant and the access its principals receive; registration assignments attach those definitions to this subscription or a resource group within it. A standing delegation grants an outside tenant persistent access, so this namespace is the entry point for detecting unexpected or overprivileged cross-tenant management. The `registrationDefinitions` field lists the offers and `registrationAssignments` the attachments in effect.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"logic":{"name":"logic","type":"\u001bazure.subscription.logicService","title":"Logic Apps resources in the subscription","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"logicService":{"name":"logicService","type":"\u001bazure.subscription.logicService","title":"Azure Logic Apps","desc":"Consumption-tier Logic Apps workflows in the subscription, enumerated through `workflows`. Auditing these surfaces workflow state, access-control policies, secret-typed parameters, and the trigger and action set defined in each workflow's JSON definition.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"machineLearning":{"name":"machineLearning","type":"\u001bazure.subscription.machineLearningService","title":"Azure Machine Learning resources in the subscription","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"machineLearningService":{"name":"machineLearningService","type":"\u001bazure.subscription.machineLearningService","title":"Azure Machine Learning","desc":"Machine Learning namespace covering the Azure Machine Learning workspaces in the subscription, backed by the `Microsoft.MachineLearningServices` resource provider. A workspace is the top-level container for ML assets (experiments, models, compute, and datastores) and binds to a Key Vault, Storage account, Application Insights component, and Container Registry, so the namespace is the entry point for auditing their public-network exposure, network isolation, customer-managed-key encryption, and authentication posture. The `workspaces` field returns the per-workspace records.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"managedByTenants":{"name":"managedByTenants","type":"\u0019\u0007","is_mandatory":true,"title":"List of tenants that manage the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedIdentity":{"name":"managedIdentity","type":"\u001bazure.subscription.managedIdentity","title":"Azure managed identity","desc":"Azure managed identity that a resource uses to authenticate to other Azure services without an embedded secret, either system-assigned (tied to a single resource's lifecycle) or user-assigned (a standalone identity attachable to many resources). The `roleAssignments` show the privileges granted to the identity across scopes, and `federatedIdentityCredentials` reveal external OIDC issuers trusted to obtain tokens for it (workload identity federation), a common privilege-escalation path worth auditing.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"monitor":{"name":"monitor","type":"\u001bazure.subscription.monitorService","title":"Monitor resources in the subscription","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"monitorService":{"name":"monitorService","type":"\u001bazure.subscription.monitorService","title":"Azure Monitor","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"mySql":{"name":"mySql","type":"\u001bazure.subscription.mySqlService","title":"MySQL resources inside the subscription","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mySqlService":{"name":"mySqlService","type":"\u001bazure.subscription.mySqlService","title":"Azure Database for MySQL","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"network":{"name":"network","type":"\u001bazure.subscription.networkService","title":"Network resources in the subscription","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkService":{"name":"networkService","type":"\u001bazure.subscription.networkService","title":"Azure network","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"policy":{"name":"policy","type":"\u001bazure.subscription.policy","title":"Policy service in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"postgreSql":{"name":"postgreSql","type":"\u001bazure.subscription.postgreSqlService","title":"PostgreSQL resources in the subscription","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"postgreSqlService":{"name":"postgreSqlService","type":"\u001bazure.subscription.postgreSqlService","title":"Azure Database for PostgreSQL","desc":"Managed PostgreSQL databases in a subscription, covering both the current Flexible Server deployment model (flexibleServers) and the earlier Single Server model (servers) that Azure is retiring. Use it to enumerate every managed PostgreSQL instance and audit their network exposure, authentication mode, encryption, and backup posture.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"privateEndpointConnection":{"name":"privateEndpointConnection","type":"\u001bazure.subscription.privateEndpointConnection","title":"Azure private endpoint connection","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"purview":{"name":"purview","type":"\u001bazure.subscription.purviewService","title":"Microsoft Purview resources in the subscription","desc":"Data-governance accounts that classify, map, and monitor sensitive data across the subscription.","min_provider_version":"13.11.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"purviewService":{"name":"purviewService","type":"\u001bazure.subscription.purviewService","title":"Microsoft Purview","desc":"Microsoft Purview accounts in the subscription. Each account is a tenant-scoped data-governance and sensitive-data-discovery hub that catalogs data assets across Azure (Storage, SQL, Synapse, Cosmos DB, Power BI) and external clouds. The `accounts` list holds the per-region Purview accounts, where their public-network-access posture, managed-resource-group bindings, SKU, and public endpoints are queryable.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"recoveryServices":{"name":"recoveryServices","type":"\u001bazure.subscription.recoveryServicesService","title":"Recovery Services resources in the subscription","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"recoveryServicesService":{"name":"recoveryServicesService","type":"\u001bazure.subscription.recoveryServicesService","title":"Azure Recovery Services","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"resource":{"name":"resource","type":"\u001bazure.subscription.resource","title":"Azure resource","desc":"Generic Azure Resource Manager inventory record for a single resource in a subscription, covering resources of every type (compute, storage, networking, and so on) in one uniform shape. Useful for cross-cutting audits: locating resources by tags, location, or type, checking provisioningState, or reviewing the managed identity attached through identity. Deep, type-specific properties are not populated on this record; query the dedicated resource for a given type when you need those.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"resourceGroups":{"name":"resourceGroups","type":"\u0019\u001bazure.subscription.resourcegroup","title":"Resource groups in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourcegroup":{"name":"resourcegroup","type":"\u001bazure.subscription.resourcegroup","title":"Azure resource group","desc":"Logical container that holds related Azure resources and defines a shared location, tag set, and lifecycle boundary for them. Resource groups anchor governance and access control: tags drive cost and ownership policy, location constrains where child resources may live, and provisioningState reports the outcome of the last management operation. A non-empty managedBy marks a group created and owned by another service (for example a managed application or cluster), which should not be modified directly. The deployments field lists the Azure Resource Manager deployments run into the group.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"resources":{"name":"resources","type":"\u0019\u001bazure.subscription.resource","title":"All resources in a subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"search":{"name":"search","type":"\u001bazure.subscription.searchService","title":"Azure AI Search resources in the subscription","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"searchService":{"name":"searchService","type":"\u001bazure.subscription.searchService","title":"Azure AI Search","desc":"Azure AI Search services in the subscription. Each service hosts search indexes that frequently hold sensitive or business-critical content, making this the entry point for auditing their public-network exposure, customer-managed-key encryption, and authentication posture.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"sentinel":{"name":"sentinel","type":"\u001bazure.subscription.sentinelService","title":"Microsoft Sentinel onboarded workspaces in the subscription","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sentinelService":{"name":"sentinelService","type":"\u001bazure.subscription.sentinelService","title":"Microsoft Sentinel","desc":"Microsoft Sentinel onboarding and analytics surface in a subscription. Sentinel is layered on a Log Analytics workspace via the SecurityInsights solution; a Log Analytics workspace appears under `workspaces` only when Sentinel has been onboarded on it. Use this to audit which subscriptions have Sentinel coverage, which analytics rules are active, and which data connectors are ingesting telemetry.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"serviceBus":{"name":"serviceBus","type":"\u001bazure.subscription.serviceBusService","title":"Service Bus resources in the subscription","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceBusService":{"name":"serviceBusService","type":"\u001bazure.subscription.serviceBusService","title":"Azure Service Bus service","desc":"Service Bus messaging across the subscription. The `namespaces` field lists every Service Bus namespace, each exposing its SKU and tier, network access controls, encryption settings, and the queues, topics, and subscriptions defined inside it.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"signalR":{"name":"signalR","type":"\u001bazure.subscription.signalRService","title":"Azure SignalR Service resources in the subscription","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"signalRService":{"name":"signalRService","type":"\u001bazure.subscription.signalRService","title":"Azure SignalR Service","desc":"Real-time messaging (WebSockets) service instances in the subscription, each available through `instances`. SignalR delivers server-to-client push messaging for applications. Auditing the instances surfaces public network exposure and the authentication methods enabled on each.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"sql":{"name":"sql","type":"\u001bazure.subscription.sqlService","title":"SQL resources in the subscription","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sqlService":{"name":"sqlService","type":"\u001bazure.subscription.sqlService","title":"Azure SQL","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Subscription state","desc":"One of Enabled, Warned, PastDue, Disabled, or Deleted.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storage":{"name":"storage","type":"\u001bazure.subscription.storageService","title":"Storage resources in the subscription","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageService":{"name":"storageService","type":"\u001bazure.subscription.storageService","title":"Azure Storage","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionsPolicies":{"name":"subscriptionsPolicies","type":"\n","is_mandatory":true,"title":"Subscription placement and spending policies","desc":"Policy settings scoped to the subscription. Keys: `locationPlacementId` (the group of regions the subscription may deploy into), `quotaId` (the offer or quota tier), and `spendingLimit` (one of On, Off, or CurrentPeriodOff).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"synapse":{"name":"synapse","type":"\u001bazure.subscription.synapseService","title":"Synapse Analytics resources in the subscription","min_provider_version":"13.3.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"synapseService":{"name":"synapseService","type":"\u001bazure.subscription.synapseService","title":"Azure Synapse Analytics service","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"systemData":{"name":"systemData","type":"\u001bazure.subscription.systemData","title":"Azure Resource Manager system metadata","desc":"Creation and last-modification provenance that Azure Resource Manager records for a resource: the identity that created it, the identity that last modified it, the type of each identity, and the corresponding timestamps. Answers \"who created this resource and when\" across the resources that report system metadata.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Subscription tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Subscription tenant identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"web":{"name":"web","type":"\u001bazure.subscription.webService","title":"Web resources in the subscription","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"webPubSub":{"name":"webPubSub","type":"\u001bazure.subscription.webPubSubService","title":"Azure Web PubSub Service resources in the subscription","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"webPubSubService":{"name":"webPubSubService","type":"\u001bazure.subscription.webPubSubService","title":"Azure Web PubSub Service","desc":"Web PubSub Service instances in the subscription, each providing real-time publish/subscribe messaging over WebSockets. Query the instances to audit public network exposure, the enabled authentication methods, and network access rules across the subscription.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"webService":{"name":"webService","type":"\u001bazure.subscription.webService","title":"Azure Web","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true}},"title":"Azure subscription","desc":"Billing, identity, and policy container that owns every Azure resource accessible to the provider, and the top of the resource hierarchy for auditing an Azure tenant. Exposes the subscription state, authorization source, applied tags, managing tenants, and the placement, quota, and spending-limit settings in subscriptionsPolicies. Resource groups, individual resources, and deployments are reachable from here, along with per-service accessors for compute, network, storage, identity, Key Vault, Defender for Cloud, and every other modeled Azure service, letting you traverse from a subscription into any resource it contains.","min_provider_version":"11.4.28","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.advisorService":{"id":"azure.subscription.advisorService","name":"azure.subscription.advisorService","fields":{"averageScore":{"name":"averageScore","type":"\u0006","title":"Average advisory score","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"recommendation":{"name":"recommendation","type":"\u001bazure.subscription.advisorService.recommendation","title":"Azure Advisor recommendation","desc":"Single Advisor finding for a subscription, describing a suggested improvement and the resource it applies to. Each recommendation carries a `category`, an `impact` rating, and a `risk` level, together with the affected resource in `impactedResource`. The `id` selects the record.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"recommendations":{"name":"recommendations","type":"\u0019\u001bazure.subscription.advisorService.recommendation","title":"List of all recommendations by the advisor","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"score":{"name":"score","type":"\u001bazure.subscription.advisorService.score","title":"Azure Advisor score","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"scores":{"name":"scores","type":"\u0019\u001bazure.subscription.advisorService.score","title":"List of scores by categories","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityScore":{"name":"securityScore","type":"\u001bazure.subscription.advisorService.securityScore","title":"Azure Advisor security score","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeSeries":{"name":"timeSeries","type":"\u001bazure.subscription.advisorService.timeSeries","title":"Azure Advisor time series","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true}},"title":"Azure Advisor","desc":"Azure Advisor recommendations and category scores for a subscription. Advisor analyzes resource configuration and usage telemetry and flags improvements across cost, security, reliability, operational excellence, and performance. The `recommendations` field enumerates individual findings, while `scores` and the rolled-up `averageScore` track posture per category over time.","private":true,"min_provider_version":"9.0.13","defaults":"averageScore recommendations.length scores.length","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.advisorService.recommendation":{"id":"azure.subscription.advisorService.recommendation","name":"azure.subscription.advisorService.recommendation","fields":{"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Recommendation category","desc":"One of Cost, HighAvailability, OperationalExcellence, Performance, or Security.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Recommendation description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Recommendation ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"impact":{"name":"impact","type":"\u0007","is_mandatory":true,"title":"Recommendation impact","desc":"Business impact of the recommendation. One of High, Medium, or Low.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"impactedResource":{"name":"impactedResource","type":"\u0007","is_mandatory":true,"title":"The impacted resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"impactedResourceType":{"name":"impactedResourceType","type":"\u0007","is_mandatory":true,"title":"The impacted resource category type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Recommendation name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Full recommendation properties","desc":"The complete Advisor recommendation record. Keys include `category`, `impact`, and `risk` (also surfaced as top-level fields), `impactedField` and `impactedValue` (the affected resource type and resource), plus `shortDescription`, `extendedProperties`, `metadata`, `resourceMetadata`, `recommendationTypeId`, `learnMoreLink`, `potentialBenefits`, `actions`, `remediation`, `label`, and `lastUpdated`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"remediation":{"name":"remediation","type":"\u0007","is_mandatory":true,"title":"Recommendation remediation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"risk":{"name":"risk","type":"\u0007","is_mandatory":true,"title":"Recommendation risk","desc":"Potential risk of not implementing the recommendation. One of Error, Warning, or None.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Recommendation resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Advisor recommendation","desc":"Single Advisor finding for a subscription, describing a suggested improvement and the resource it applies to. Each recommendation carries a `category`, an `impact` rating, and a `risk` level, together with the affected resource in `impactedResource`. The `id` selects the record.","private":true,"min_provider_version":"9.0.13","defaults":"name category impact description impactedResource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.advisorService.score":{"id":"azure.subscription.advisorService.score","name":"azure.subscription.advisorService.score","fields":{"currentScore":{"name":"currentScore","type":"\u001bazure.subscription.advisorService.securityScore","is_mandatory":true,"title":"Current score for the advisor category","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Score identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Score name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeSeries":{"name":"timeSeries","type":"\u0019\u001bazure.subscription.advisorService.timeSeries","is_mandatory":true,"title":"List of time series, containing previous scores for the category","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Score type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Advisor score","private":true,"min_provider_version":"9.0.13","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.advisorService.securityScore":{"id":"azure.subscription.advisorService.securityScore","name":"azure.subscription.advisorService.securityScore","fields":{"categoryCount":{"name":"categoryCount","type":"\u0005","is_mandatory":true,"title":"The count of impacted categories","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"consumptionUnits":{"name":"consumptionUnits","type":"\u0006","is_mandatory":true,"title":"The consumption units for the score","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"date":{"name":"date","type":"\t","is_mandatory":true,"title":"The date the score was calculated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Security score identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"impactedResourcesCount":{"name":"impactedResourcesCount","type":"\u0005","is_mandatory":true,"title":"The number of impacted resources","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"potentialScoreIncrease":{"name":"potentialScoreIncrease","type":"\u0006","is_mandatory":true,"title":"The potential percentage increase in overall score at subscription level after all recommendations are implemented","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"score":{"name":"score","type":"\u0006","is_mandatory":true,"title":"Security score score","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Advisor security score","private":true,"min_provider_version":"9.0.13","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.advisorService.timeSeries":{"id":"azure.subscription.advisorService.timeSeries","name":"azure.subscription.advisorService.timeSeries","fields":{"aggregationLevel":{"name":"aggregationLevel","type":"\u0007","is_mandatory":true,"title":"The aggregation level for the time series","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Advisor time series identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scores":{"name":"scores","type":"\u0019\u001bazure.subscription.advisorService.securityScore","is_mandatory":true,"title":"The scores in the time series","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Advisor time series","private":true,"min_provider_version":"9.0.13","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.aksService":{"id":"azure.subscription.aksService","name":"azure.subscription.aksService","fields":{"cluster":{"name":"cluster","type":"\u001bazure.subscription.aksService.cluster","title":"Azure Kubernetes Service (AKS) cluster","desc":"Managed Kubernetes cluster and its control-plane security posture: the Kubernetes version, private-cluster and API server access controls, network plugin and policy, RBAC and Azure AD integration, workload identity federation through the OIDC issuer, KMS encryption of cluster secrets, Microsoft Defender monitoring, the auto-upgrade channel, and the node pools that back the cluster. The `internetReachable` predicate reports whether the API server is reachable from the public internet.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"clusters":{"name":"clusters","type":"\u0019\u001bazure.subscription.aksService.cluster","title":"List all the AKS clusters inside the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Kubernetes Service","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.aksService.cluster":{"id":"azure.subscription.aksService.cluster","name":"azure.subscription.aksService.cluster","fields":{"aadProfile":{"name":"aadProfile","type":"\u001bazure.subscription.aksService.cluster.aadProfile","title":"Azure Active Directory configuration for the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"addonProfiles":{"name":"addonProfiles","type":"\u0019\n","is_mandatory":true,"title":"Managed add-ons enabled on the cluster","desc":"Each entry is a single-key object whose key is the add-on name (for example `omsagent`, `azurepolicy`, `azureKeyvaultSecretsProvider`, or `ingressApplicationGateway`) and whose value is an object with `enabled`, `config`, and `identity`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"advancedNetworking":{"name":"advancedNetworking","type":"\u001bazure.subscription.aksService.cluster.advancedNetworking","title":"Advanced networking configuration for the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"agentPoolProfiles":{"name":"agentPoolProfiles","type":"\u0019\n","is_mandatory":true,"title":"Raw agent pool profiles attached to the cluster","desc":"Deprecated in favor of `nodePools()`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"apiServerAccessProfile":{"name":"apiServerAccessProfile","type":"\n","is_mandatory":true,"title":"Kubernetes API server access configuration","desc":"Keys: `authorizedIPRanges`, `enablePrivateCluster`, `enablePrivateClusterPublicFQDN`, `enableVnetIntegration`, `privateDNSZone`, `disableRunCommand`, and `subnetId`. The same values are exposed as the apiServerAuthorizedIPRanges, enablePrivateCluster, privateDnsZone, and disableRunCommand fields.","min_provider_version":"11.0.22","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"apiServerAuthorizedIPRanges":{"name":"apiServerAuthorizedIPRanges","type":"\u0019\u0007","is_mandatory":true,"title":"CIDR ranges authorized to access the AKS API server","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"autoUpgradeProfile":{"name":"autoUpgradeProfile","type":"\u001bazure.subscription.aksService.cluster.autoUpgradeProfile","title":"Auto-upgrade configuration for the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azureKeyVaultKmsEnabled":{"name":"azureKeyVaultKmsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Azure Key Vault KMS encryption is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azureKeyVaultKmsKey":{"name":"azureKeyVaultKmsKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used for Azure Key Vault KMS encryption (null if not enabled)","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azureKeyVaultKmsNetworkAccess":{"name":"azureKeyVaultKmsNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Network access mode for Azure Key Vault KMS (\"Public\" or \"Private\")","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"controlPlaneMetricsEnabled":{"name":"controlPlaneMetricsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether managed Prometheus collects control-plane metrics for the cluster","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the AKS cluster was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defenderEnabled":{"name":"defenderEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Microsoft Defender security monitoring is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defenderSecurityGatingEnabled":{"name":"defenderSecurityGatingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Microsoft Defender security gating is enabled","desc":"When enabled, Defender for Containers admission control scans container images and audits or blocks deployment of images that fail the configured security rules.","min_provider_version":"13.33.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAccounts":{"name":"disableLocalAccounts","type":"\u0004","is_mandatory":true,"title":"Whether local accounts are disabled (forces AAD-only auth)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableRunCommand":{"name":"disableRunCommand","type":"\u0004","is_mandatory":true,"title":"Whether run command is disabled on the AKS cluster","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskCsiDriverEnabled":{"name":"diskCsiDriverEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the Azure Disk CSI driver is enabled on the cluster","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskEncryptionSet":{"name":"diskEncryptionSet","type":"\u001bazure.subscription.computeService.diskEncryptionSet","title":"Disk encryption set used to encrypt cluster OS and data disks with a customer-managed key","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dnsPrefix":{"name":"dnsPrefix","type":"\u0007","is_mandatory":true,"title":"The DNS prefix of the AKS cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablePrivateCluster":{"name":"enablePrivateCluster","type":"\u0004","is_mandatory":true,"title":"Whether the AKS cluster API server is a private cluster","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablePrivateClusterPublicFQDN":{"name":"enablePrivateClusterPublicFQDN","type":"\u0004","is_mandatory":true,"title":"Whether the private cluster has a public FQDN","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fqdn":{"name":"fqdn","type":"\u0007","is_mandatory":true,"title":"The fully qualified domain name of the AKS cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fqdnSubdomain":{"name":"fqdnSubdomain","type":"\u0007","is_mandatory":true,"title":"FQDN subdomain for private DNS zone clusters","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"httpProxyConfig":{"name":"httpProxyConfig","type":"\n","is_mandatory":true,"title":"Outbound HTTP proxy configuration for cluster nodes","desc":"Keys: `enabled`, `httpProxy`, `httpsProxy`, `noProxy` (list of no-proxy hosts), and `trustedCa` (base64 CA certificate bundle).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the AKS cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Control-plane managed identity configuration (type, system- and user-assigned identities)","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityBinding":{"name":"identityBinding","type":"\u001bazure.subscription.aksService.cluster.identityBinding","title":"Azure Kubernetes Service cluster identity binding","desc":"Binding between an external workload identity and an Azure user-assigned managed identity on an AKS cluster. Each binding ties a federated identity, selected by the `name` field, to a managed identity, letting in-cluster workloads authenticate as that identity through the cluster's OIDC issuer. Surfaces the bound managed identity's client, object, and tenant IDs, the OIDC issuer URL the binding federates against, and the provisioning state.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"identityBindings":{"name":"identityBindings","type":"\u0019\u001bazure.subscription.aksService.cluster.identityBinding","title":"Workload identity bindings attached to the cluster","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"imageCleanerEnabled":{"name":"imageCleanerEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Image Cleaner is enabled on the cluster","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"imageCleanerIntervalHours":{"name":"imageCleanerIntervalHours","type":"\u0005","is_mandatory":true,"title":"Image Cleaner scanning interval in hours","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"internetReachable":{"name":"internetReachable","type":"\u0004","title":"Whether the AKS API server is reachable from the public internet","desc":"True when the cluster is not a private cluster, `publicNetworkAccess` is not disabled, and no authorized-IP-range allowlist restricts API access. False when any of those gates (private cluster, disabled public access, or a non-empty authorized-IP-range list) is present.","min_provider_version":"13.20.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kubeletIdentity":{"name":"kubeletIdentity","type":"\u001bazure.subscription.managedIdentity","title":"Managed identity used by the kubelet to pull images from Azure Container Registry","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kubernetesVersion":{"name":"kubernetesVersion","type":"\u0007","is_mandatory":true,"title":"The Kubernetes version of the AKS cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Location of the AKS cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the AKS cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkPlugin":{"name":"networkPlugin","type":"\u0007","is_mandatory":true,"title":"Network plugin used for building the Kubernetes network (\"azure\", \"kubenet\", \"none\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkPolicy":{"name":"networkPolicy","type":"\u0007","is_mandatory":true,"title":"Network policy used for building the Kubernetes network (\"calico\", \"azure\", \"cilium\", \"none\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkProfile":{"name":"networkProfile","type":"\n","is_mandatory":true,"title":"Cluster network configuration","desc":"Keys include `networkPlugin`, `networkPluginMode`, `networkPolicy`, `networkDataplane`, `networkMode`, `outboundType`, `loadBalancerSku`, `loadBalancerProfile`, `natGatewayProfile`, `serviceCidr`(s), `podCidr`(s), `dnsServiceIP`, `ipFamilies`, and `advancedNetworking`. The networkPlugin and networkPolicy scalar fields expose the two most common values directly.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodePool":{"name":"nodePool","type":"\u001bazure.subscription.aksService.cluster.nodePool","title":"Azure Kubernetes Service cluster node pool (agent pool)","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"nodePools":{"name":"nodePools","type":"\u0019\u001bazure.subscription.aksService.cluster.nodePool","title":"Node pools (agent pools) attached to the cluster","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodeResourceGroup":{"name":"nodeResourceGroup","type":"\u0007","is_mandatory":true,"title":"The node resource group of the AKS cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodeResourceGroupRestrictionLevel":{"name":"nodeResourceGroupRestrictionLevel","type":"\u0007","is_mandatory":true,"title":"Restriction level for the node resource group (\"Unrestricted\" or \"ReadOnly\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"oidcIssuerEnabled":{"name":"oidcIssuerEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the OIDC issuer is enabled for workload identity federation","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"podIdentityProfile":{"name":"podIdentityProfile","type":"\n","is_mandatory":true,"title":"Azure AD pod-managed identity configuration","desc":"Keys: `enabled`, `allowNetworkPluginKubenet`, `userAssignedIdentities`, and `userAssignedIdentityExceptions`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"powerState":{"name":"powerState","type":"\u0007","is_mandatory":true,"title":"The power state of the AKS cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the cluster's system-assigned control-plane managed identity; empty when a user-assigned identity is used","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateDnsZone":{"name":"privateDnsZone","type":"\u0007","is_mandatory":true,"title":"Private DNS zone mode for the AKS cluster","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections to the cluster API server","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateFqdn":{"name":"privateFqdn","type":"\u0007","is_mandatory":true,"title":"Private FQDN of the AKS cluster (only set for private clusters)","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"The provisioning state of the AKS cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether public network access is enabled for the cluster (\"Enabled\" or \"Disabled\")","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rbacEnabled":{"name":"rbacEnabled","type":"\u0004","is_mandatory":true,"title":"Whether RBAC is enabled for the AKS cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityProfile":{"name":"securityProfile","type":"\n","is_mandatory":true,"title":"Cluster security add-on configuration","desc":"Keys: `azureKeyVaultKms` (`{enabled, keyId, keyVaultNetworkAccess, keyVaultResourceId}`), `defender` (`{logAnalyticsWorkspaceResourceId, securityMonitoring}`), `imageCleaner` (`{enabled, intervalHours}`), `workloadIdentity` (`{enabled}`), and `customCATrustCertificates`. Individual states are also exposed as the defenderEnabled, imageCleanerEnabled, workloadIdentityEnabled, and azureKeyVaultKmsEnabled fields.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceMeshMode":{"name":"serviceMeshMode","type":"\u0007","is_mandatory":true,"title":"Service mesh mode (\"Disabled\" or \"Istio\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"servicePrincipalClientId":{"name":"servicePrincipalClientId","type":"\u0007","is_mandatory":true,"title":"Client ID of the legacy service principal used by the cluster; empty when the cluster uses a managed identity","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuTier":{"name":"skuTier","type":"\u0007","is_mandatory":true,"title":"SKU tier for the AKS cluster (\"Free\", \"Standard\", or \"Premium\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageProfile":{"name":"storageProfile","type":"\n","is_mandatory":true,"title":"CSI storage driver configuration for the cluster","desc":"Keys: `blobCSIDriver`, `diskCSIDriver`, `fileCSIDriver`, and `snapshotController`, each an object with an `enabled` boolean. See diskCsiDriverEnabled for the disk-driver state as a boolean.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"supportPlan":{"name":"supportPlan","type":"\u0007","is_mandatory":true,"title":"Kubernetes support plan (\"KubernetesOfficial\" or \"AKSLongTermSupport\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemAssignedIdentity":{"name":"systemAssignedIdentity","type":"\u001bazure.subscription.managedIdentity","title":"System-assigned control-plane managed identity of the cluster; null when a user-assigned identity is used","desc":"Resolves the system-assigned identity so its role assignments, and their role definitions and permissions, can be traversed, completing the resource-to-privilege leg of an attack path.","min_provider_version":"13.26.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"The tags of the AKS cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities attached to the cluster control plane","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workloadAutoScalerProfile":{"name":"workloadAutoScalerProfile","type":"\n","is_mandatory":true,"title":"Workload autoscaler add-on configuration","desc":"Keys: `keda` (Kubernetes Event-driven Autoscaling) and `verticalPodAutoscaler`, each an object with an `enabled` boolean.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workloadIdentityEnabled":{"name":"workloadIdentityEnabled","type":"\u0004","is_mandatory":true,"title":"Whether workload identity federation is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Kubernetes Service (AKS) cluster","desc":"Managed Kubernetes cluster and its control-plane security posture: the Kubernetes version, private-cluster and API server access controls, network plugin and policy, RBAC and Azure AD integration, workload identity federation through the OIDC issuer, KMS encryption of cluster secrets, Microsoft Defender monitoring, the auto-upgrade channel, and the node pools that back the cluster. The `internetReachable` predicate reports whether the API server is reachable from the public internet.","min_provider_version":"9.0.1","defaults":"name location kubernetesVersion","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.aksService.cluster.aadProfile":{"id":"azure.subscription.aksService.cluster.aadProfile","name":"azure.subscription.aksService.cluster.aadProfile","fields":{"adminGroupObjectIDs":{"name":"adminGroupObjectIDs","type":"\u0019\u0007","is_mandatory":true,"title":"AAD group object IDs with cluster admin role","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableAzureRBAC":{"name":"enableAzureRBAC","type":"\u0004","is_mandatory":true,"title":"Whether Azure RBAC for Kubernetes authorization is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"AAD profile ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managed":{"name":"managed","type":"\u0004","is_mandatory":true,"title":"Whether managed AAD integration is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Kubernetes Service cluster AAD profile","private":true,"min_provider_version":"11.4.28","defaults":"managed enableAzureRBAC","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.aksService.cluster.advancedNetworking":{"id":"azure.subscription.aksService.cluster.advancedNetworking","name":"azure.subscription.aksService.cluster.advancedNetworking","fields":{"accelerationMode":{"name":"accelerationMode","type":"\u0007","is_mandatory":true,"title":"Network acceleration mode: \"BpfVeth\" or \"None\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether advanced networking is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Advanced networking ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityEnabled":{"name":"securityEnabled","type":"\u0004","is_mandatory":true,"title":"Whether advanced network security (FQDN-based policies) is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"transitEncryptionType":{"name":"transitEncryptionType","type":"\u0007","is_mandatory":true,"title":"Transit encryption type for pod-to-pod encryption: \"None\" or \"WireGuard\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Kubernetes Service cluster advanced networking configuration","private":true,"min_provider_version":"13.1.8","defaults":"transitEncryptionType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.aksService.cluster.autoUpgradeProfile":{"id":"azure.subscription.aksService.cluster.autoUpgradeProfile","name":"azure.subscription.aksService.cluster.autoUpgradeProfile","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Auto-upgrade profile ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodeOSUpgradeChannel":{"name":"nodeOSUpgradeChannel","type":"\u0007","is_mandatory":true,"title":"Node OS upgrade channel (\"None\", \"NodeImage\", \"SecurityPatch\", \"Unmanaged\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"upgradeChannel":{"name":"upgradeChannel","type":"\u0007","is_mandatory":true,"title":"Auto-upgrade channel (\"none\", \"patch\", \"stable\", \"rapid\", \"node-image\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Kubernetes Service cluster auto-upgrade profile","private":true,"min_provider_version":"11.4.28","defaults":"upgradeChannel nodeOSUpgradeChannel","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.aksService.cluster.identityBinding":{"id":"azure.subscription.aksService.cluster.identityBinding","name":"azure.subscription.aksService.cluster.identityBinding","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID of the identity binding","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedIdentity":{"name":"managedIdentity","type":"\u001bazure.subscription.managedIdentity","title":"Bound user-assigned managed identity","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedIdentityClientId":{"name":"managedIdentityClientId","type":"\u0007","is_mandatory":true,"title":"Client ID of the bound user-assigned managed identity","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedIdentityObjectId":{"name":"managedIdentityObjectId","type":"\u0007","is_mandatory":true,"title":"Object (principal) ID of the bound user-assigned managed identity","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedIdentityTenantId":{"name":"managedIdentityTenantId","type":"\u0007","is_mandatory":true,"title":"Tenant ID of the bound user-assigned managed identity","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the identity binding","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"oidcIssuerUrl":{"name":"oidcIssuerUrl","type":"\u0007","is_mandatory":true,"title":"OIDC issuer URL the binding federates against","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the identity binding","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Kubernetes Service cluster identity binding","desc":"Binding between an external workload identity and an Azure user-assigned managed identity on an AKS cluster. Each binding ties a federated identity, selected by the `name` field, to a managed identity, letting in-cluster workloads authenticate as that identity through the cluster's OIDC issuer. Surfaces the bound managed identity's client, object, and tenant IDs, the OIDC issuer URL the binding federates against, and the provisioning state.","private":true,"min_provider_version":"13.15.2","defaults":"name provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.aksService.cluster.nodePool":{"id":"azure.subscription.aksService.cluster.nodePool","name":"azure.subscription.aksService.cluster.nodePool","fields":{"availabilityZones":{"name":"availabilityZones","type":"\u0019\u0007","is_mandatory":true,"title":"Availability zones the pool is spread across","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"count":{"name":"count","type":"\u0005","is_mandatory":true,"title":"Number of nodes currently in the pool","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"currentOrchestratorVersion":{"name":"currentOrchestratorVersion","type":"\u0007","is_mandatory":true,"title":"Resolved Kubernetes version currently running on the nodes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableAutoScaling":{"name":"enableAutoScaling","type":"\u0004","is_mandatory":true,"title":"Whether the cluster autoscaler manages this pool","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableEncryptionAtHost":{"name":"enableEncryptionAtHost","type":"\u0004","is_mandatory":true,"title":"Whether host-based encryption is enabled on nodes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableFIPS":{"name":"enableFIPS","type":"\u0004","is_mandatory":true,"title":"Whether nodes use a FIPS-enabled OS image","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableNodePublicIP":{"name":"enableNodePublicIP","type":"\u0004","is_mandatory":true,"title":"Whether each node receives its own public IP","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableSecureBoot":{"name":"enableSecureBoot","type":"\u0004","is_mandatory":true,"title":"Whether Secure Boot is enabled on nodes (Trusted Launch)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableUltraSSD":{"name":"enableUltraSSD","type":"\u0004","is_mandatory":true,"title":"Whether ultra-SSD support is enabled on the pool","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableVTPM":{"name":"enableVTPM","type":"\u0004","is_mandatory":true,"title":"Whether vTPM is enabled on nodes (Trusted Launch)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostGroupId":{"name":"hostGroupId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the dedicated host group (empty when not configured)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Node pool resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxCount":{"name":"maxCount","type":"\u0005","is_mandatory":true,"title":"Maximum node count when autoscaling is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxPods":{"name":"maxPods","type":"\u0005","is_mandatory":true,"title":"Maximum number of pods that can run on a node","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minCount":{"name":"minCount","type":"\u0005","is_mandatory":true,"title":"Minimum node count when autoscaling is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Pool mode (\"System\" for kube-system pods, \"User\" for workloads, \"Gateway\" for static-egress gateway pools)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Node pool name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodeImageVersion":{"name":"nodeImageVersion","type":"\u0007","is_mandatory":true,"title":"Image version the nodes are currently running","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodeLabels":{"name":"nodeLabels","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Node labels applied to every node in the pool","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodePublicIPPrefixId":{"name":"nodePublicIPPrefixId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the public IP prefix used for node IPs (empty when not configured)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodeTaints":{"name":"nodeTaints","type":"\u0019\u0007","is_mandatory":true,"title":"Node taints applied to every node in the pool (e.g. \"key=value:NoSchedule\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"orchestratorVersion":{"name":"orchestratorVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes version requested for the pool (may be major.minor or major.minor.patch)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osDiskSizeGB":{"name":"osDiskSizeGB","type":"\u0005","is_mandatory":true,"title":"OS disk size in GB","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osDiskType":{"name":"osDiskType","type":"\u0007","is_mandatory":true,"title":"OS disk type (\"Ephemeral\" or \"Managed\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osSku":{"name":"osSku","type":"\u0007","is_mandatory":true,"title":"OS SKU (\"Ubuntu\", \"AzureLinux\", \"Mariner\", \"Windows2019\", \"Windows2022\", etc.)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osType":{"name":"osType","type":"\u0007","is_mandatory":true,"title":"OS type (\"Linux\" or \"Windows\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"podSubnetId":{"name":"podSubnetId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the subnet pods are placed in when using delegated pod subnets (empty otherwise)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"powerState":{"name":"powerState","type":"\u0007","is_mandatory":true,"title":"Power state of the pool (\"Running\" or \"Stopped\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the pool","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"proximityPlacementGroupId":{"name":"proximityPlacementGroupId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the proximity placement group (empty when not configured)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"recentlyUsedVersions":{"name":"recentlyUsedVersions","type":"\u0019\n","title":"Node image and Kubernetes versions recently used by the pool, available for rollback","desc":"Each entry has `orchestratorVersion`, `nodeImageVersion`, and the `timestamp` when that version was last in use.","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scaleSetEvictionPolicy":{"name":"scaleSetEvictionPolicy","type":"\u0007","is_mandatory":true,"title":"Spot eviction policy (\"Delete\" or \"Deallocate\"; only when scaleSetPriority is \"Spot\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scaleSetPriority":{"name":"scaleSetPriority","type":"\u0007","is_mandatory":true,"title":"Scale set priority (\"Regular\" or \"Spot\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"spotMaxPrice":{"name":"spotMaxPrice","type":"\u0006","is_mandatory":true,"title":"Maximum price billed for spot nodes (-1 indicates \"any on-demand price\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sshAccess":{"name":"sshAccess","type":"\u0007","is_mandatory":true,"title":"SSH access mode for the pool (\"LocalUser\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Tags on the pool's underlying scale set","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"upgradeDrainTimeoutInMinutes":{"name":"upgradeDrainTimeoutInMinutes","type":"\u0005","is_mandatory":true,"title":"Drain timeout in minutes during pool upgrades","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"upgradeMaxSurge":{"name":"upgradeMaxSurge","type":"\u0007","is_mandatory":true,"title":"Maximum surge during pool upgrades (e.g. \"10%\" or \"1\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"upgradeMaxUnavailable":{"name":"upgradeMaxUnavailable","type":"\u0007","is_mandatory":true,"title":"Maximum unavailable nodes during pool upgrades (e.g. \"5%\" or \"1\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"upgradeNodeSoakDurationInMinutes":{"name":"upgradeNodeSoakDurationInMinutes","type":"\u0005","is_mandatory":true,"title":"Soak duration in minutes between draining a node and reimaging it during upgrades","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vmSize":{"name":"vmSize","type":"\u0007","is_mandatory":true,"title":"Size of the node VMs","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vmType":{"name":"vmType","type":"\u0007","is_mandatory":true,"title":"Pool VM type (\"VirtualMachineScaleSets\", \"AvailabilitySet\", or \"VirtualMachines\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vnetSubnetId":{"name":"vnetSubnetId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the subnet the pool nodes are joined to (empty when AKS auto-creates the VNet)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workloadRuntime":{"name":"workloadRuntime","type":"\u0007","is_mandatory":true,"title":"Workload runtime (\"OCIContainer\", \"WasmWasi\", or \"KataMshvVmIsolation\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Kubernetes Service cluster node pool (agent pool)","private":true,"min_provider_version":"13.10.2","defaults":"name mode vmSize count","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.apiManagementService":{"id":"azure.subscription.apiManagementService","name":"azure.subscription.apiManagementService","fields":{"service":{"name":"service","type":"\u001bazure.subscription.apiManagementService.service","title":"Azure API Management service instance","desc":"Multi-tenant API gateway that fronts backend APIs with authentication, rate limiting, request and response transforms, and a developer portal. The service's network and transport posture is queryable here: the virtual-network integration mode (None, External, or Internal), public network access state, and the gateway TLS and cipher policy encoded in `customProperties` and surfaced as the `tls10Enabled`, `ssl30Enabled`, and `tripleDesEnabled` booleans. Also exposes whether client certificates are required, the managed identity, and the private endpoint connections that reach the service.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"services":{"name":"services","type":"\u0019\u001bazure.subscription.apiManagementService.service","title":"API Management service instances","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure API Management","desc":"API Management gateway instances configured in the subscription. Each entry in `services` is a multi-tenant API gateway that fronts backend APIs, exposing its SKU, virtual-network integration mode, public network access posture, gateway TLS and cipher policy, managed identity, endpoint URLs, and private endpoint connection state.","private":true,"min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.apiManagementService.service":{"id":"azure.subscription.apiManagementService.service","name":"azure.subscription.apiManagementService.service","fields":{"backendSsl30Enabled":{"name":"backendSsl30Enabled","type":"\u0004","is_mandatory":true,"title":"Whether SSL 3.0 is enabled for gateway connections to backend services (null when the service does not report the setting)","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"backendTls10Enabled":{"name":"backendTls10Enabled","type":"\u0004","is_mandatory":true,"title":"Whether TLS 1.0 is enabled for gateway connections to backend services (null when the service does not report the setting)","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"backendTls11Enabled":{"name":"backendTls11Enabled","type":"\u0004","is_mandatory":true,"title":"Whether TLS 1.1 is enabled for gateway connections to backend services (null when the service does not report the setting)","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Service creation time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"customProperties":{"name":"customProperties","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Custom properties controlling gateway TLS protocol / cipher policy","desc":"Keys like `Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10` map to \"True\"/\"False\" string values.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"developerPortalStatus":{"name":"developerPortalStatus","type":"\u0007","is_mandatory":true,"title":"Developer portal status (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"developerPortalUrl":{"name":"developerPortalUrl","type":"\u0007","is_mandatory":true,"title":"Developer portal endpoint URL","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableGateway":{"name":"disableGateway","type":"\u0004","is_mandatory":true,"title":"Whether the gateway is disabled in the master region (multi-region deployments only)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableClientCertificate":{"name":"enableClientCertificate","type":"\u0004","is_mandatory":true,"title":"Whether clients are required to present a TLS certificate on every request (Consumption SKU only)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"gatewayRegionalUrl":{"name":"gatewayRegionalUrl","type":"\u0007","is_mandatory":true,"title":"Gateway URL in the default region (set on multi-region deployments)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"gatewayUrl":{"name":"gatewayUrl","type":"\u0007","is_mandatory":true,"title":"Gateway URL clients use to call APIs hosted on the service","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"http2Enabled":{"name":"http2Enabled","type":"\u0004","is_mandatory":true,"title":"Whether HTTP/2 is enabled on the gateway (null when the service does not report the setting)","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID of the API Management service","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityType":{"name":"identityType","type":"\u0007","is_mandatory":true,"title":"Identity type (\"None\", \"SystemAssigned\", \"UserAssigned\", \"SystemAssigned, UserAssigned\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"legacyPortalStatus":{"name":"legacyPortalStatus","type":"\u0007","is_mandatory":true,"title":"Legacy portal status (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Resource location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managementApiUrl":{"name":"managementApiUrl","type":"\u0007","is_mandatory":true,"title":"Management API endpoint URL","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Service name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"natGatewayState":{"name":"natGatewayState","type":"\u0007","is_mandatory":true,"title":"NAT gateway state (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"notificationSenderEmail":{"name":"notificationSenderEmail","type":"\u0007","is_mandatory":true,"title":"Notification sender email address","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"outboundPublicIpAddresses":{"name":"outboundPublicIpAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Outbound public IPv4 prefixes associated with NAT Gateway-deployed services (Premium SKU on stv2)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"platformVersion":{"name":"platformVersion","type":"\u0007","is_mandatory":true,"title":"Compute platform version running the service (e.g. \"stv2\", \"stv1\", \"mtv1\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"portalUrl":{"name":"portalUrl","type":"\u0007","is_mandatory":true,"title":"Publisher portal endpoint URL (legacy portal)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the system-assigned managed identity","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnectionCount":{"name":"privateEndpointConnectionCount","type":"\u0005","is_mandatory":true,"title":"Number of private endpoint connections to the service","desc":"Deprecated in favor of `privateEndpointConnections`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections to the service","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateIpAddresses":{"name":"privateIpAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Private load-balanced IPv4 addresses of the service in its primary region when deployed in an Internal VNet","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state (\"Created\", \"Activating\", \"Succeeded\", \"Updating\", \"Failed\", \"Stopped\", \"Terminating\", \"TerminationFailed\", \"Deleted\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddress":{"name":"publicIpAddress","type":"\u001bazure.subscription.networkService.ipAddress","title":"Public IP address attached to the service (null when not configured)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddresses":{"name":"publicIpAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Public load-balanced IPv4 addresses of the service in its primary region (Basic / Standard / Premium / Isolated SKUs)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publisherEmail":{"name":"publisherEmail","type":"\u0007","is_mandatory":true,"title":"Publisher email address used as the From address for notifications","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publisherName":{"name":"publisherName","type":"\u0007","is_mandatory":true,"title":"Publisher display name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scmUrl":{"name":"scmUrl","type":"\u0007","is_mandatory":true,"title":"SCM (source-control management) endpoint URL","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuCapacity":{"name":"skuCapacity","type":"\u0005","is_mandatory":true,"title":"Number of deployed units of the SKU","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"SKU name (\"Developer\", \"Basic\", \"Standard\", \"Premium\", \"Consumption\", \"BasicV2\", \"StandardV2\", \"PremiumV2\", \"Isolated\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ssl30Enabled":{"name":"ssl30Enabled","type":"\u0004","is_mandatory":true,"title":"Whether SSL 3.0 is enabled for client connections to the gateway (null when the service does not report the setting)","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemAssignedIdentity":{"name":"systemAssignedIdentity","type":"\u001bazure.subscription.managedIdentity","title":"System-assigned managed identity of the service; null when no system-assigned identity is enabled","desc":"Resolves the system-assigned identity so its role assignments, and their role definitions and permissions, can be traversed, completing the resource-to-privilege leg of an attack path.","min_provider_version":"13.26.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"targetProvisioningState":{"name":"targetProvisioningState","type":"\u0007","is_mandatory":true,"title":"Target provisioning state for any in-flight long-running operation (empty when none)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Tenant ID of the system-assigned managed identity","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tls10Enabled":{"name":"tls10Enabled","type":"\u0004","is_mandatory":true,"title":"Whether TLS 1.0 is enabled for client connections to the gateway (null when the service does not report the setting)","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tls11Enabled":{"name":"tls11Enabled","type":"\u0004","is_mandatory":true,"title":"Whether TLS 1.1 is enabled for client connections to the gateway (null when the service does not report the setting)","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tripleDesEnabled":{"name":"tripleDesEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the 3DES (TLS_RSA_WITH_3DES_EDE_CBC_SHA) cipher is enabled on the gateway (null when the service does not report the setting)","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities associated with the service","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkType":{"name":"virtualNetworkType","type":"\u0007","is_mandatory":true,"title":"Virtual network integration mode (\"None\", \"External\", or \"Internal\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"Availability zones the service is spread across","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure API Management service instance","desc":"Multi-tenant API gateway that fronts backend APIs with authentication, rate limiting, request and response transforms, and a developer portal. The service's network and transport posture is queryable here: the virtual-network integration mode (None, External, or Internal), public network access state, and the gateway TLS and cipher policy encoded in `customProperties` and surfaced as the `tls10Enabled`, `ssl30Enabled`, and `tripleDesEnabled` booleans. Also exposes whether client certificates are required, the managed identity, and the private endpoint connections that reach the service.","min_provider_version":"13.10.2","defaults":"name location skuName provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.appConfigurationService":{"id":"azure.subscription.appConfigurationService","name":"azure.subscription.appConfigurationService","fields":{"configurationStore":{"name":"configurationStore","type":"\u001bazure.subscription.appConfigurationService.configurationStore","title":"App Configuration store","desc":"Single App Configuration store, the managed key-value service that holds application settings and feature flags. `publicNetworkAccess` confirms whether the store is reachable from the public internet, `disableLocalAuth` whether access-key authentication is turned off in favor of Microsoft Entra ID, `cmkKeyIdentifier` the customer-managed key encrypting the store (empty when Microsoft-managed keys are used), `softDeleteRetentionInDays` and `enablePurgeProtection` the data-recovery guarantees, and `endpoint` the data-plane URL.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"configurationStores":{"name":"configurationStores","type":"\u0019\u001bazure.subscription.appConfigurationService.configurationStore","title":"App Configuration stores in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"App Configuration","desc":"App Configuration stores in the subscription, each centralizing application settings and feature flags. That content routinely includes references to secrets, so this namespace is the entry point for auditing per-store public-network exposure, customer-managed-key encryption, and authentication posture.","private":true,"min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.appConfigurationService.configurationStore":{"id":"azure.subscription.appConfigurationService.configurationStore","name":"azure.subscription.appConfigurationService.configurationStore","fields":{"cmkIdentityClientId":{"name":"cmkIdentityClientId","type":"\u0007","is_mandatory":true,"title":"Client ID of the user-assigned identity used to access the customer-managed key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeyIdentifier":{"name":"cmkKeyIdentifier","type":"\u0007","is_mandatory":true,"title":"Key Vault key identifier of the customer-managed key encrypting the store; empty when Microsoft-managed keys are used","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createMode":{"name":"createMode","type":"\u0007","is_mandatory":true,"title":"Creation mode of the store (\"Default\" or \"Recover\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the configuration store was created","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultKeyValueRevisionRetentionPeriodInSeconds":{"name":"defaultKeyValueRevisionRetentionPeriodInSeconds","type":"\u0005","is_mandatory":true,"title":"Default retention period (seconds) for revisions of every key-value, controlling how far back point-in-time queries can read","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether access-key (local) authentication is disabled, leaving Microsoft Entra ID as the only method","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablePurgeProtection":{"name":"enablePurgeProtection","type":"\u0004","is_mandatory":true,"title":"Whether purge protection is enabled, preventing permanent deletion during the soft-delete retention period","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpoint":{"name":"endpoint","type":"\u0007","is_mandatory":true,"title":"The data-plane endpoint where the configuration store API is reachable","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Configuration store resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity configuration","desc":"Keys: `type` (None, SystemAssigned, UserAssigned, or \"SystemAssigned, UserAssigned\"), `userAssignedIdentities`, `principalId`, and `tenantId`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Configuration store location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Configuration store name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections to the configuration store","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the store","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether the store is reachable from the public internet (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"SKU details (name: free or standard)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"softDeleteRetentionInDays":{"name":"softDeleteRetentionInDays","type":"\u0005","is_mandatory":true,"title":"Number of days a soft-deleted store is retained before permanent deletion","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Configuration store tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"App Configuration store","desc":"Single App Configuration store, the managed key-value service that holds application settings and feature flags. `publicNetworkAccess` confirms whether the store is reachable from the public internet, `disableLocalAuth` whether access-key authentication is turned off in favor of Microsoft Entra ID, `cmkKeyIdentifier` the customer-managed key encrypting the store (empty when Microsoft-managed keys are used), `softDeleteRetentionInDays` and `enablePurgeProtection` the data-recovery guarantees, and `endpoint` the data-plane URL.","min_provider_version":"13.11.3","defaults":"id name location publicNetworkAccess","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.authorizationService":{"id":"azure.subscription.authorizationService","name":"azure.subscription.authorizationService","fields":{"classicAdministrator":{"name":"classicAdministrator","type":"\u001bazure.subscription.authorizationService.classicAdministrator","title":"Classic (ASM) administrator","desc":"Legacy co-administrator or service administrator grant from the classic (Azure Service Management) deployment model. These grants predate role-based access control and carry broad subscription-wide access, so on a hardened subscription the count should normally be zero. Select by the administrator's resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"classicAdministrators":{"name":"classicAdministrators","type":"\u0019\u001bazure.subscription.authorizationService.classicAdministrator","title":"Classic (ASM) co-administrators: legacy admin grants that should normally be zero","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"denyAssignment":{"name":"denyAssignment","type":"\u001bazure.subscription.authorizationService.denyAssignment","title":"Deny assignment in an Azure subscription","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"denyAssignments":{"name":"denyAssignments","type":"\u0019\u001bazure.subscription.authorizationService.denyAssignment","title":"Deny assignments: read-only deny rules that block actions even for owners (e.g., managed-app deny on resources)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedIdentities":{"name":"managedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"Managed identities","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleAssignment":{"name":"roleAssignment","type":"\u001bazure.subscription.authorizationService.roleAssignment","title":"Azure role assignment","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"roleAssignmentSchedule":{"name":"roleAssignmentSchedule","type":"\u001bazure.subscription.authorizationService.roleAssignmentSchedule","title":"Azure PIM role assignment schedule","desc":"A Privileged Identity Management active assignment: a role currently granted to a principal at a scope, whether permanent, time-bound, or activated from an eligibility. Surfaces the principal, role, scope, assignment window, and whether the grant is assigned or activated. Select by the schedule's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"roleAssignmentSchedules":{"name":"roleAssignmentSchedules","type":"\u0019\u001bazure.subscription.authorizationService.roleAssignmentSchedule","title":"PIM role assignment schedules: currently active (including time-bound) privileged role assignments","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleAssignments":{"name":"roleAssignments","type":"\u0019\u001bazure.subscription.authorizationService.roleAssignment","title":"Role assignments","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleDefinition":{"name":"roleDefinition","type":"\u001bazure.subscription.authorizationService.roleDefinition","title":"Azure role definition","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"roleEligibilitySchedule":{"name":"roleEligibilitySchedule","type":"\u001bazure.subscription.authorizationService.roleEligibilitySchedule","title":"Azure PIM role eligibility schedule","desc":"A Privileged Identity Management eligibility: a principal that can activate a role at a scope, rather than holding it permanently. Surfaces the eligible principal, the role, the scope, the eligibility window, and the activation membership type. Select by the schedule's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"roleEligibilitySchedules":{"name":"roleEligibilitySchedules","type":"\u0019\u001bazure.subscription.authorizationService.roleEligibilitySchedule","title":"PIM role eligibility schedules: who is eligible to activate which privileged role","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleManagementPolicies":{"name":"roleManagementPolicies","type":"\u0019\u001bazure.subscription.authorizationService.roleManagementPolicy","title":"PIM role management policies: the rules governing how privileged roles are activated and assigned","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleManagementPolicy":{"name":"roleManagementPolicy","type":"\u001bazure.subscription.authorizationService.roleManagementPolicy","title":"Azure PIM role management policy","desc":"A Privileged Identity Management policy governing how a role is activated and assigned at a scope: whether activation requires approval, multi-factor authentication, justification, or a ticket, how long an activation lasts, and who is notified. The behavior is expressed through the policy `rules`. Select by the policy's Azure resource ID. Audit these to confirm privileged roles are gated rather than freely self-activated.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"roles":{"name":"roles","type":"\u0019\u001bazure.subscription.authorizationService.roleDefinition","title":"Role definitions for the Azure subscription","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure IAM service","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.authorizationService.classicAdministrator":{"id":"azure.subscription.authorizationService.classicAdministrator","name":"azure.subscription.authorizationService.classicAdministrator","fields":{"emailAddress":{"name":"emailAddress","type":"\u0007","is_mandatory":true,"title":"Email of the classic administrator","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Classic administrator ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name (typically the email)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Role granted (\"ServiceAdministrator\", \"CoAdministrator\", \"AccountAdministrator\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Classic (ASM) administrator","desc":"Legacy co-administrator or service administrator grant from the classic (Azure Service Management) deployment model. These grants predate role-based access control and carry broad subscription-wide access, so on a hardened subscription the count should normally be zero. Select by the administrator's resource ID.","private":true,"min_provider_version":"13.5.1","defaults":"emailAddress role","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.authorizationService.denyAssignment":{"id":"azure.subscription.authorizationService.denyAssignment","name":"azure.subscription.authorizationService.denyAssignment","fields":{"denyAssignmentName":{"name":"denyAssignmentName","type":"\u0007","is_mandatory":true,"title":"Display name shown in the portal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the deny assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"doNotApplyToChildScopes":{"name":"doNotApplyToChildScopes","type":"\u0004","is_mandatory":true,"title":"Whether the deny rule does not apply to child scopes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"excludePrincipals":{"name":"excludePrincipals","type":"\u0019\n","is_mandatory":true,"title":"Principals excluded from the deny","desc":"Each entry has keys `id`, `type`, `displayName`, and `email`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Deny assignment ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isSystemProtected":{"name":"isSystemProtected","type":"\u0004","is_mandatory":true,"title":"Whether the deny rule is system-protected (cannot be removed by users)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Deny assignment name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"permissions":{"name":"permissions","type":"\u0019\n","is_mandatory":true,"title":"Denied permissions","desc":"Each entry has keys `actions`, `dataActions`, `notActions`, `notDataActions`, `condition`, and `conditionVersion`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principals":{"name":"principals","type":"\u0019\n","is_mandatory":true,"title":"Principals subject to the deny","desc":"Each entry has keys `id`, `type`, `displayName`, and `email`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope of the deny assignment (subscription/resource group/resource)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Deny assignment in an Azure subscription","private":true,"min_provider_version":"13.5.1","defaults":"name doNotApplyToChildScopes type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.authorizationService.roleAssignment":{"id":"azure.subscription.authorizationService.roleAssignment","name":"azure.subscription.authorizationService.roleAssignment","fields":{"condition":{"name":"condition","type":"\u0007","is_mandatory":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalType":{"name":"principalType","type":"\u0007","is_mandatory":true,"title":"Type of the assigned principal (\"User\", \"Group\", \"ServicePrincipal\", \"ForeignGroup\", or \"Device\")","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"role":{"name":"role","type":"\u001bazure.subscription.authorizationService.roleDefinition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Principal type of the assignment","desc":"Deprecated in favor of `principalType`, which carries the same value under a correctly descriptive name (this field is named `type` but holds the principal type, not the ARM resource type).","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure role assignment","private":true,"min_provider_version":"11.2.1","defaults":"principalId principalType role.name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.authorizationService.roleAssignmentSchedule":{"id":"azure.subscription.authorizationService.roleAssignmentSchedule","name":"azure.subscription.authorizationService.roleAssignmentSchedule","fields":{"assignmentType":{"name":"assignmentType","type":"\u0007","is_mandatory":true,"title":"How the role was granted (Assigned for a standing assignment, Activated from an eligibility)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"condition":{"name":"condition","type":"\u0007","is_mandatory":true,"title":"ABAC condition limiting the assignment, if any","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endDateTime":{"name":"endDateTime","type":"\t","is_mandatory":true,"title":"When the assignment window ends; null for a permanent assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Assignment schedule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"memberType":{"name":"memberType","type":"\u0007","is_mandatory":true,"title":"Membership type of the assignment (Inherited, Direct, Group)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Assignment schedule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalDisplayName":{"name":"principalDisplayName","type":"\u0007","is_mandatory":true,"title":"Display name of the assigned principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID (user, group, or service principal) holding the role","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalType":{"name":"principalType","type":"\u0007","is_mandatory":true,"title":"Type of the assigned principal (User, Group, ServicePrincipal)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleDefinition":{"name":"roleDefinition","type":"\u001bazure.subscription.authorizationService.roleDefinition","title":"Role granted to the principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleDefinitionName":{"name":"roleDefinitionName","type":"\u0007","is_mandatory":true,"title":"Display name of the assigned role","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope the assignment applies to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"startDateTime":{"name":"startDateTime","type":"\t","is_mandatory":true,"title":"When the assignment window starts","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the assignment schedule","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure PIM role assignment schedule","desc":"A Privileged Identity Management active assignment: a role currently granted to a principal at a scope, whether permanent, time-bound, or activated from an eligibility. Surfaces the principal, role, scope, assignment window, and whether the grant is assigned or activated. Select by the schedule's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"principalDisplayName roleDefinitionName assignmentType status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.authorizationService.roleDefinition":{"id":"azure.subscription.authorizationService.roleDefinition","name":"azure.subscription.authorizationService.roleDefinition","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the role definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the role definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the role definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"permission":{"name":"permission","type":"\u001bazure.subscription.authorizationService.roleDefinition.permission","title":"Azure role definition permission","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"permissions":{"name":"permissions","type":"\u0019\u001bazure.subscription.authorizationService.roleDefinition.permission","title":"Permissions that are attached to the role definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"Scopes for which the role definition applies","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Role type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure role definition","private":true,"min_provider_version":"11.4.28","defaults":"name type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.authorizationService.roleDefinition.permission":{"id":"azure.subscription.authorizationService.roleDefinition.permission","name":"azure.subscription.authorizationService.roleDefinition.permission","fields":{"allowedActions":{"name":"allowedActions","type":"\u0019\u0007","is_mandatory":true,"title":"List of allowed actions that are attached to the permission","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"allowedDataActions":{"name":"allowedDataActions","type":"\u0019\u0007","is_mandatory":true,"title":"List of allowed data actions that are attached to the permission","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deniedActions":{"name":"deniedActions","type":"\u0019\u0007","is_mandatory":true,"title":"List of denied actions that are attached to the permission","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deniedDataActions":{"name":"deniedDataActions","type":"\u0019\u0007","is_mandatory":true,"title":"List of denied data actions that are attached to the permission","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the permission","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure role definition permission","private":true,"min_provider_version":"11.4.28","defaults":"allowedActions deniedActions","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.authorizationService.roleEligibilitySchedule":{"id":"azure.subscription.authorizationService.roleEligibilitySchedule","name":"azure.subscription.authorizationService.roleEligibilitySchedule","fields":{"condition":{"name":"condition","type":"\u0007","is_mandatory":true,"title":"ABAC condition limiting the eligibility, if any","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endDateTime":{"name":"endDateTime","type":"\t","is_mandatory":true,"title":"When the eligibility window ends; null for permanent eligibility","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Eligibility schedule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"memberType":{"name":"memberType","type":"\u0007","is_mandatory":true,"title":"Membership type of the eligibility (Inherited, Direct, Group)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Eligibility schedule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalDisplayName":{"name":"principalDisplayName","type":"\u0007","is_mandatory":true,"title":"Display name of the eligible principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID (user, group, or service principal) eligible for the role","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalType":{"name":"principalType","type":"\u0007","is_mandatory":true,"title":"Type of the eligible principal (User, Group, ServicePrincipal)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleDefinition":{"name":"roleDefinition","type":"\u001bazure.subscription.authorizationService.roleDefinition","title":"Role the principal is eligible to activate","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleDefinitionName":{"name":"roleDefinitionName","type":"\u0007","is_mandatory":true,"title":"Display name of the role the principal is eligible for","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope the eligibility applies to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"startDateTime":{"name":"startDateTime","type":"\t","is_mandatory":true,"title":"When the eligibility window starts","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the eligibility schedule","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure PIM role eligibility schedule","desc":"A Privileged Identity Management eligibility: a principal that can activate a role at a scope, rather than holding it permanently. Surfaces the eligible principal, the role, the scope, the eligibility window, and the activation membership type. Select by the schedule's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"principalDisplayName roleDefinitionName status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.authorizationService.roleManagementPolicy":{"id":"azure.subscription.authorizationService.roleManagementPolicy","name":"azure.subscription.authorizationService.roleManagementPolicy","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Policy display name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isOrganizationDefault":{"name":"isOrganizationDefault","type":"\u0004","is_mandatory":true,"title":"Whether this is the organization's default policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedBy":{"name":"lastModifiedBy","type":"\n","is_mandatory":true,"title":"Principal that last modified the policy","desc":"Keys: `id`, `displayName`, `email`, and `type`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"When the policy was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rule":{"name":"rule","type":"\u001bazure.subscription.authorizationService.roleManagementPolicy.rule","title":"PIM role management policy rule","desc":"A single rule within a role management policy, identified by `ruleType`. Which fields carry values depends on that type: an enablement rule populates `enabledRules` (Justification, MultiFactorAuthentication, Ticketing) to say what activation demands; an expiration rule populates `isExpirationRequired` and `maximumDuration`; an approval rule populates `approvalSetting`; an authentication context rule populates `isEnabled` and `claimValue`; a notification rule populates the notification fields. The `target` describes which caller, level, and operations the rule governs. Select by the rule's `id`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"rules":{"name":"rules","type":"\u0019\u001bazure.subscription.authorizationService.roleManagementPolicy.rule","title":"Rules governing activation and assignment (approval, enablement, expiration, notification, authentication context)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope the policy applies to","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure PIM role management policy","desc":"A Privileged Identity Management policy governing how a role is activated and assigned at a scope: whether activation requires approval, multi-factor authentication, justification, or a ticket, how long an activation lasts, and who is notified. The behavior is expressed through the policy `rules`. Select by the policy's Azure resource ID. Audit these to confirm privileged roles are gated rather than freely self-activated.","private":true,"min_provider_version":"13.32.1","defaults":"displayName scope isOrganizationDefault","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.authorizationService.roleManagementPolicy.rule":{"id":"azure.subscription.authorizationService.roleManagementPolicy.rule","name":"azure.subscription.authorizationService.roleManagementPolicy.rule","fields":{"approvalSetting":{"name":"approvalSetting","type":"\n","is_mandatory":true,"title":"Approval rule: approval settings","desc":"Keys: `approvalMode`, `isApprovalRequired`, `isApprovalRequiredForExtension`, `isRequestorJustificationRequired`, and `approvalStages` (each stage listing its approvers).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"claimValue":{"name":"claimValue","type":"\u0007","is_mandatory":true,"title":"Authentication context rule: the required claim value","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabledRules":{"name":"enabledRules","type":"\u0019\u0007","is_mandatory":true,"title":"Enablement rule: activation requirements enabled on the role","desc":"Any of Justification, MultiFactorAuthentication, or Ticketing. Empty on rule types other than the enablement rule.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule ID (unique within the policy, e.g. \"Enablement_Admin_Eligibility\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isDefaultRecipientsEnabled":{"name":"isDefaultRecipientsEnabled","type":"\u0004","is_mandatory":true,"title":"Notification rule: whether default recipients also receive the notification","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Authentication context rule: whether the rule is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isExpirationRequired":{"name":"isExpirationRequired","type":"\u0004","is_mandatory":true,"title":"Expiration rule: whether an expiration is required on the assignment or activation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maximumDuration":{"name":"maximumDuration","type":"\u0007","is_mandatory":true,"title":"Expiration rule: maximum duration (ISO 8601 duration) of an activation or assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"notificationLevel":{"name":"notificationLevel","type":"\u0007","is_mandatory":true,"title":"Notification rule: notification level (None, Critical, All)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"notificationRecipients":{"name":"notificationRecipients","type":"\u0019\u0007","is_mandatory":true,"title":"Notification rule: explicit notification recipients","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"notificationType":{"name":"notificationType","type":"\u0007","is_mandatory":true,"title":"Notification rule: delivery mechanism (e.g. Email)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"recipientType":{"name":"recipientType","type":"\u0007","is_mandatory":true,"title":"Notification rule: recipient type (Requestor, Approver, Admin)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ruleType":{"name":"ruleType","type":"\u0007","is_mandatory":true,"title":"Rule type","desc":"One of RoleManagementPolicyApprovalRule, RoleManagementPolicyAuthenticationContextRule, RoleManagementPolicyEnablementRule, RoleManagementPolicyExpirationRule, or RoleManagementPolicyNotificationRule.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"target":{"name":"target","type":"\n","is_mandatory":true,"title":"What the rule governs","desc":"Keys: `caller`, `level`, `operations`, `targetObjects`, `inheritableSettings`, and `enforcedSettings`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"PIM role management policy rule","desc":"A single rule within a role management policy, identified by `ruleType`. Which fields carry values depends on that type: an enablement rule populates `enabledRules` (Justification, MultiFactorAuthentication, Ticketing) to say what activation demands; an expiration rule populates `isExpirationRequired` and `maximumDuration`; an approval rule populates `approvalSetting`; an authentication context rule populates `isEnabled` and `claimValue`; a notification rule populates the notification fields. The `target` describes which caller, level, and operations the rule governs. Select by the rule's `id`.","private":true,"min_provider_version":"13.32.1","defaults":"id ruleType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.automationService":{"id":"azure.subscription.automationService","name":"azure.subscription.automationService","fields":{"account":{"name":"account","type":"\u001bazure.subscription.automationService.account","title":"Azure Automation account","desc":"Single Azure Automation account, the container for runbooks, DSC configurations, and shared assets. `publicNetworkAccess` reports internet exposure, `disableLocalAuth` reports whether key-based authentication is disabled in favor of Microsoft Entra ID, and `cmkKeySource`, `cmkKeyName`, and `cmkKeyVaultUri` describe customer-managed-key encryption. The `variables`, `credentials`, and `certificates` collections expose the secrets the account stores, for example unencrypted variables or expiring or exportable certificates.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"accounts":{"name":"accounts","type":"\u0019\u001bazure.subscription.automationService.account","title":"Azure Automation accounts in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Automation","desc":"Entry point for the Azure Automation accounts in the subscription, available through `accounts`. Automation accounts host runbooks, DSC configurations, and shared assets (variables, credentials, and certificates), so this is the starting point for auditing how a subscription automates operations and what secrets that automation stores.","private":true,"min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.automationService.account":{"id":"azure.subscription.automationService.account","name":"azure.subscription.automationService.account","fields":{"certificate":{"name":"certificate","type":"\u001bazure.subscription.automationService.account.certificate","title":"Azure Automation account certificate","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"certificates":{"name":"certificates","type":"\u0019\u001bazure.subscription.automationService.account.certificate","title":"Certificates stored in the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeyName":{"name":"cmkKeyName","type":"\u0007","is_mandatory":true,"title":"Name of the customer-managed Key Vault key encrypting the account; empty for platform-managed keys","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeySource":{"name":"cmkKeySource","type":"\u0007","is_mandatory":true,"title":"Encryption key source (\"Microsoft.Keyvault\" for customer-managed keys; \"Microsoft.Automation\" for platform-managed)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeyVaultUri":{"name":"cmkKeyVaultUri","type":"\u0007","is_mandatory":true,"title":"Key Vault URI holding the customer-managed encryption key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the account was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"credential":{"name":"credential","type":"\u001bazure.subscription.automationService.account.credential","title":"Azure Automation account credential","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"credentials":{"name":"credentials","type":"\u0019\u001bazure.subscription.automationService.account.credential","title":"Credentials stored in the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether key-based (local) authentication is disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Account resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity configuration","desc":"Keys: `type` (one of \"None\", \"SystemAssigned\", \"UserAssigned\", or \"SystemAssigned, UserAssigned\"), `userAssignedIdentities` (map keyed by user-assigned identity resource ID), `principalId`, and `tenantId`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedTime":{"name":"lastModifiedTime","type":"\t","is_mandatory":true,"title":"When the account was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Account location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Account name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0004","is_mandatory":true,"title":"Whether the account is reachable from the public internet","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"SKU","desc":"Pricing tier of the account. Keys: `name` (either \"Free\" or \"Basic\"), `capacity`, and `family`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Account lifecycle state (\"Ok\", \"Unavailable\", \"Suspended\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Account tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"variable":{"name":"variable","type":"\u001bazure.subscription.automationService.account.variable","title":"Azure Automation account variable","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"variables":{"name":"variables","type":"\u0019\u001bazure.subscription.automationService.account.variable","title":"Variables stored in the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Automation account","desc":"Single Azure Automation account, the container for runbooks, DSC configurations, and shared assets. `publicNetworkAccess` reports internet exposure, `disableLocalAuth` reports whether key-based authentication is disabled in favor of Microsoft Entra ID, and `cmkKeySource`, `cmkKeyName`, and `cmkKeyVaultUri` describe customer-managed-key encryption. The `variables`, `credentials`, and `certificates` collections expose the secrets the account stores, for example unencrypted variables or expiring or exportable certificates.","min_provider_version":"13.16.2","defaults":"id name location publicNetworkAccess","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.automationService.account.certificate":{"id":"azure.subscription.automationService.account.certificate","name":"azure.subscription.automationService.account.certificate","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the certificate was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Certificate description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expiryTime":{"name":"expiryTime","type":"\t","is_mandatory":true,"title":"When the certificate expires","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Certificate resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isExportable":{"name":"isExportable","type":"\u0004","is_mandatory":true,"title":"Whether the certificate's private key can be exported","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Certificate name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"thumbprint":{"name":"thumbprint","type":"\u0007","is_mandatory":true,"title":"Certificate thumbprint","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Automation account certificate","private":true,"min_provider_version":"13.16.2","defaults":"name expiryTime isExportable","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.automationService.account.credential":{"id":"azure.subscription.automationService.account.credential","name":"azure.subscription.automationService.account.credential","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the credential was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Credential description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Credential resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedTime":{"name":"lastModifiedTime","type":"\t","is_mandatory":true,"title":"When the credential was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Credential name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userName":{"name":"userName","type":"\u0007","is_mandatory":true,"title":"User name stored by the credential","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Automation account credential","private":true,"min_provider_version":"13.16.2","defaults":"name userName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.automationService.account.variable":{"id":"azure.subscription.automationService.account.variable","name":"azure.subscription.automationService.account.variable","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the variable was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Variable description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Variable resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isEncrypted":{"name":"isEncrypted","type":"\u0004","is_mandatory":true,"title":"Whether the variable value is stored encrypted; a false result means the value is readable in plaintext","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedTime":{"name":"lastModifiedTime","type":"\t","is_mandatory":true,"title":"When the variable was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Variable name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Automation account variable","private":true,"min_provider_version":"13.16.2","defaults":"name isEncrypted","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.batchService":{"id":"azure.subscription.batchService","name":"azure.subscription.batchService","fields":{"account":{"name":"account","type":"\u001bazure.subscription.batchService.account","title":"Azure Batch account","desc":"Resource-pool and job-scheduling container for high-performance and parallel compute workloads. Audit an account for its public network access state, allowed authentication modes, the pool allocation mode (BatchService or UserSubscription), customer-managed-key encryption, linked auto-storage account, and the compute pools deployed under it. The account is selected by its ARM resource id.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"accounts":{"name":"accounts","type":"\u0019\u001bazure.subscription.batchService.account","title":"Batch accounts in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Batch","private":true,"min_provider_version":"11.4.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.batchService.account":{"id":"azure.subscription.batchService.account","name":"azure.subscription.batchService.account","fields":{"accountEndpoint":{"name":"accountEndpoint","type":"\u0007","is_mandatory":true,"title":"Batch account endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"activeJobAndJobScheduleQuota":{"name":"activeJobAndJobScheduleQuota","type":"\u0005","is_mandatory":true,"title":"Batch account active job and job schedule quota","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"allowedAuthenticationModes":{"name":"allowedAuthenticationModes","type":"\u0019\u0007","is_mandatory":true,"title":"Batch account allowed authentication modes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"autoStorage":{"name":"autoStorage","type":"\n","is_mandatory":true,"title":"Batch account auto storage settings","desc":"Deprecated in favor of autoStorageAccount.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"autoStorageAccount":{"name":"autoStorageAccount","type":"\u001bazure.subscription.storageService.account","title":"Storage account used for auto-storage by the Batch account","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dedicatedCoreQuota":{"name":"dedicatedCoreQuota","type":"\u0005","is_mandatory":true,"title":"Batch account dedicated core quota","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dedicatedCoreQuotaPerVmFamily":{"name":"dedicatedCoreQuotaPerVmFamily","type":"\u0019\n","is_mandatory":true,"title":"Dedicated core quota per VM family","desc":"One entry per virtual machine family. Keys: `name` (the VM family) and `coreQuota` (the dedicated core limit granted to that family).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dedicatedCoreQuotaPerVmFamilyEnforced":{"name":"dedicatedCoreQuotaPerVmFamilyEnforced","type":"\u0004","is_mandatory":true,"title":"Whether dedicated core quota per VM family is enforced","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettings":{"name":"diagnosticSettings","type":"\u0019\u001bazure.subscription.monitorService.diagnosticsetting","title":"Batch account diagnostic settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettingsCategories":{"name":"diagnosticSettingsCategories","type":"\u0019\u001bazure.subscription.monitorService.diagnosticSettingsCategory","title":"Diagnostic settings categories the Batch account can emit (available log and metric categories)","min_provider_version":"13.30.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryption":{"name":"encryption","type":"\n","is_mandatory":true,"title":"Batch account encryption settings","desc":"Deprecated in favor of encryptionKey.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"encryptionKey":{"name":"encryptionKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used to encrypt Batch account data with a customer-managed key","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Batch account ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Raw identity block for the Batch account","desc":"Deprecated in favor of principalId and userAssignedIdentities.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"keyVault":{"name":"keyVault","type":"\u001bazure.subscription.keyVaultService.vault","title":"Key Vault associated with the Batch account for user-subscription pool allocation","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultReference":{"name":"keyVaultReference","type":"\n","is_mandatory":true,"title":"Batch account key vault reference","desc":"Deprecated in favor of keyVault.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Batch account location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lowPriorityCoreQuota":{"name":"lowPriorityCoreQuota","type":"\u0005","is_mandatory":true,"title":"Batch account low priority core quota","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Batch account name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkProfile":{"name":"networkProfile","type":"\n","is_mandatory":true,"title":"Network access profile","desc":"Endpoint access rules for the account. Keys: `accountAccess` (data plane API) and `nodeManagementAccess` (compute-node management), each with `defaultAction` (Allow or Deny) and `ipRules` (a list of {action, value} allowed source ranges).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodeManagementEndpoint":{"name":"nodeManagementEndpoint","type":"\u0007","is_mandatory":true,"title":"Batch account node management endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pool":{"name":"pool","type":"\u001bazure.subscription.batchService.account.pool","title":"Azure Batch pool","desc":"Compute pool inside an Azure Batch account, holding the VM size and image, deployment configuration, scale settings (fixed or auto), per-node start tasks, network configuration, and the disk-encryption and confidential-computing security posture of its nodes. Audit a pool for whether customer-managed disk encryption is enabled, its host endpoint protection mode, and its provisioning state.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"poolAllocationMode":{"name":"poolAllocationMode","type":"\u0007","is_mandatory":true,"title":"Batch account pool allocation mode","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"poolQuota":{"name":"poolQuota","type":"\u0005","is_mandatory":true,"title":"Batch account pool quota","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pools":{"name":"pools","type":"\u0019\u001bazure.subscription.batchService.account.pool","title":"Batch account pools","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the account's system-assigned managed identity; empty when only user-assigned identities are used","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\n","is_mandatory":true,"title":"Private endpoint connections","desc":"One entry per private endpoint connection. Keys: `id`, `name`, `type`, `etag`, and `properties` (with `groupIds`, `privateEndpoint`, `privateLinkServiceConnectionState`, and `provisioningState`).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw account property bag","desc":"Full ARM property object for the account. Most values are also exposed as flattened fields (poolAllocationMode, publicNetworkAccess, the core-quota fields, and the encryption and auto-storage settings); prefer those for audits.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Batch account provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Batch account public network access level","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Batch account tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Batch account type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities attached to the Batch account","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Batch account","desc":"Resource-pool and job-scheduling container for high-performance and parallel compute workloads. Audit an account for its public network access state, allowed authentication modes, the pool allocation mode (BatchService or UserSubscription), customer-managed-key encryption, linked auto-storage account, and the compute pools deployed under it. The account is selected by its ARM resource id.","min_provider_version":"11.4.0","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.batchService.account.pool":{"id":"azure.subscription.batchService.account.pool","name":"azure.subscription.batchService.account.pool","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the pool was created","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deploymentConfiguration":{"name":"deploymentConfiguration","type":"\n","is_mandatory":true,"title":"Node deployment configuration","desc":"Key: `virtualMachineConfiguration`, the VM-based node setup that is also exposed directly as virtualMachineConfiguration.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskCustomerManagedKeyEnabled":{"name":"diskCustomerManagedKeyEnabled","type":"\u0004","is_mandatory":true,"title":"Whether customer-managed keys are used for disk encryption","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskEncryptionTargets":{"name":"diskEncryptionTargets","type":"\u0019\u0007","is_mandatory":true,"title":"Disk encryption targets (\"OsDisk\", \"TemporaryDisk\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Pool etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostEndpointProtectionMode":{"name":"hostEndpointProtectionMode","type":"\u0007","is_mandatory":true,"title":"Host endpoint protection mode for IMDS: \"Audit\" or \"Enforce\"","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Pool resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity configuration","desc":"Keys: `type` (None or UserAssigned) and `userAssignedIdentities` (a map of identity resource id to {clientId, principalId}).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Pool name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Pool configuration settings including scale, network, and task scheduling options","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Pool provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"proxyAgentEnabled":{"name":"proxyAgentEnabled","type":"\u0004","is_mandatory":true,"title":"Whether proxy agent is enabled on pool VMs","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityEncryptionType":{"name":"securityEncryptionType","type":"\u0007","is_mandatory":true,"title":"Encryption applied to the pool's OS disk for confidential computing","desc":"One of VMGuestStateOnly (only the VM guest state is encrypted) or DiskWithVMGuestState (the full OS disk and the guest state are encrypted). Null when the pool does not use a confidential or trusted-launch VM.","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityType":{"name":"securityType","type":"\u0007","is_mandatory":true,"title":"Security type of the pool's virtual machines","desc":"One of confidentialVM or trustedLaunch. Null when the pool uses standard VMs with no additional platform security profile.","min_provider_version":"13.33.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Pool resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualMachineConfiguration":{"name":"virtualMachineConfiguration","type":"\n","is_mandatory":true,"title":"Virtual machine node configuration","desc":"VM-based node setup. Keys include `imageReference` (publisher, offer, sku, version), `nodeAgentSkuId`, `diskEncryptionConfiguration`, `securityProfile`, `osDisk`, and `dataDisks`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vmSize":{"name":"vmSize","type":"\u0007","is_mandatory":true,"title":"Pool virtual machine size","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Batch pool","desc":"Compute pool inside an Azure Batch account, holding the VM size and image, deployment configuration, scale settings (fixed or auto), per-node start tasks, network configuration, and the disk-encryption and confidential-computing security posture of its nodes. Audit a pool for whether customer-managed disk encryption is enabled, its host endpoint protection mode, and its provisioning state.","min_provider_version":"11.4.0","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cacheService":{"id":"azure.subscription.cacheService","name":"azure.subscription.cacheService","fields":{"redis":{"name":"redis","type":"\u0019\u001bazure.subscription.cacheService.redisInstance","title":"List of redis caches","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"redisInstance":{"name":"redisInstance","type":"\u001bazure.subscription.cacheService.redisInstance","title":"Azure Cache for Redis instance","desc":"Managed Redis cache deployment and its exposure and hardening posture. Covers the pricing tier and SKU, Redis version, and the settings that determine reachability and transport security: publicNetworkAccess, the enableNonSslPort flag that opens the plaintext 6379 port, minimumTlsVersion, and the VNet injection or private-endpoint placement. redisConfiguration carries persistence and authentication settings, and the identity fields expose the cache's managed identity. Premium and Enterprise tiers add clustering (shardCount) and replicas.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cache for Redis","private":true,"min_provider_version":"11.4.4","defaults":"subscriptionId","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cacheService.redisInstance":{"id":"azure.subscription.cacheService.redisInstance","name":"azure.subscription.cacheService.redisInstance","fields":{"enableNonSslPort":{"name":"enableNonSslPort","type":"\u0004","is_mandatory":true,"title":"Specifies whether the non-ssl Redis server port (6379) is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionKey":{"name":"encryptionKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used for customer-managed encryption","desc":"Deprecated in favor of the Redis Enterprise resources. Always null: customer-managed key encryption is not available on Azure Cache for Redis, only on Redis Enterprise / Azure Managed Redis, and the Redis management API exposes no encryption model on this resource.","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"firewallRule":{"name":"firewallRule","type":"\u001bazure.subscription.cacheService.redisInstance.firewallRule","title":"Azure Cache for Redis firewall rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"firewallRules":{"name":"firewallRules","type":"\u0019\u001bazure.subscription.cacheService.redisInstance.firewallRule","title":"Firewall rules for the Redis cache","min_provider_version":"11.4.32","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostName":{"name":"hostName","type":"\u0007","is_mandatory":true,"title":"Redis host name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the Redis cache","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity assignment","desc":"Managed identity block keyed by `type` (None, SystemAssigned, UserAssigned, or \"SystemAssigned, UserAssigned\"), `principalId` and `tenantId` of the system-assigned identity, and `userAssignedIdentities`. The system-assigned principal is also available as principalId, and the attached user-assigned identities as userAssignedIdentities.","min_provider_version":"11.4.32","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Location of the Redis cache","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minimumTlsVersion":{"name":"minimumTlsVersion","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version required by the Redis cache","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the Redis cache","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"patchSchedule":{"name":"patchSchedule","type":"\u001bazure.subscription.cacheService.redisInstance.patchSchedule","title":"Azure Cache for Redis patch schedule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"patchSchedules":{"name":"patchSchedules","type":"\u0019\u001bazure.subscription.cacheService.redisInstance.patchSchedule","title":"Patch schedules for the Redis cache","min_provider_version":"11.4.32","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Redis port (non-SSL)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the cache's system-assigned managed identity; empty when no system-assigned identity is enabled","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnection":{"name":"privateEndpointConnection","type":"\u001bazure.subscription.cacheService.redisInstance.privateEndpointConnection","title":"Azure Cache for Redis private endpoint connection","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.cacheService.redisInstance.privateEndpointConnection","title":"Private endpoint connections for the Redis cache","min_provider_version":"11.4.32","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw Redis cache resource","desc":"Unmodified Azure Resource Manager representation of the cache, keyed by the ARM property names (`id`, `name`, `location`, `properties`, `sku`, `identity`, `zones`, `tags`). Individual values are also surfaced as their own fields on this resource; prefer those (for example redisVersion, minimumTlsVersion) over reading this bag.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state with possible values Creating, Deleting, Failed, Succeeded, Updating","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"publicNetworkAccess possible values are \"Enabled\" and \"Disabled\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"redisConfiguration":{"name":"redisConfiguration","type":"\n","is_mandatory":true,"title":"Redis configuration settings","desc":"Server-side settings keyed by their ARM configuration names. Security and durability relevant keys include `authnotrequired` (when set, password auth is disabled), `aad-enabled` (Entra ID authentication), `maxmemory-policy` (eviction strategy), `rdb-backup-enabled` and `aof-backup-enabled` with their `rdb-storage-connection-string` / `aof-storage-connection-string-0` / `aof-storage-connection-string-1` persistence targets, and `preferred-data-persistence-auth-method` (SAS or ManagedIdentity).","min_provider_version":"11.4.32","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"redisVersion":{"name":"redisVersion","type":"\u0007","is_mandatory":true,"title":"Redis version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicasPerMaster":{"name":"replicasPerMaster","type":"\u0005","is_mandatory":true,"title":"Number of replicas per master","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicasPerPrimary":{"name":"replicasPerPrimary","type":"\u0005","is_mandatory":true,"title":"Number of replicas per primary","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"shardCount":{"name":"shardCount","type":"\u0005","is_mandatory":true,"title":"Number of shards (Premium Cluster Cache only)","min_provider_version":"11.4.32","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"Cache SKU","desc":"Pricing tier and size, keyed by `name` (Basic, Standard, or Premium), `family` (C for Basic/Standard, P for Premium), and `capacity` (the size number within the family).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslPort":{"name":"sslPort","type":"\u0005","is_mandatory":true,"title":"Redis SSL port","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"staticIp":{"name":"staticIp","type":"\u0007","is_mandatory":true,"title":"Static IP address (when deployed in a VNet)","min_provider_version":"11.4.32","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet the cache is injected into; null when the cache is not VNet-injected","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnetId":{"name":"subnetId","type":"\u0007","is_mandatory":true,"title":"Subnet ID for VNet-injected caches","min_provider_version":"11.4.32","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Tags of redis cache","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type of the Redis cache","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities attached to the cache","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"Availability zones for the cache","min_provider_version":"11.4.32","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cache for Redis instance","desc":"Managed Redis cache deployment and its exposure and hardening posture. Covers the pricing tier and SKU, Redis version, and the settings that determine reachability and transport security: publicNetworkAccess, the enableNonSslPort flag that opens the plaintext 6379 port, minimumTlsVersion, and the VNet injection or private-endpoint placement. redisConfiguration carries persistence and authentication settings, and the identity fields expose the cache's managed identity. Premium and Enterprise tiers add clustering (shardCount) and replicas.","min_provider_version":"11.4.4","defaults":"id hostName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cacheService.redisInstance.firewallRule":{"id":"azure.subscription.cacheService.redisInstance.firewallRule","name":"azure.subscription.cacheService.redisInstance.firewallRule","fields":{"endIpAddress":{"name":"endIpAddress","type":"\u0007","is_mandatory":true,"title":"Highest IP address in the range","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Firewall rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Firewall rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"startIpAddress":{"name":"startIpAddress","type":"\u0007","is_mandatory":true,"title":"Lowest IP address in the range","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Firewall rule type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cache for Redis firewall rule","private":true,"min_provider_version":"11.4.32","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cacheService.redisInstance.patchSchedule":{"id":"azure.subscription.cacheService.redisInstance.patchSchedule","name":"azure.subscription.cacheService.redisInstance.patchSchedule","fields":{"entries":{"name":"entries","type":"\u0019\n","is_mandatory":true,"title":"List of schedule entries (dayOfWeek, startHourUtc, maintenanceWindow)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Patch schedule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Patch schedule location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Patch schedule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cache for Redis patch schedule","private":true,"min_provider_version":"11.4.32","defaults":"name entries","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cacheService.redisInstance.privateEndpointConnection":{"id":"azure.subscription.cacheService.redisInstance.privateEndpointConnection","name":"azure.subscription.cacheService.redisInstance.privateEndpointConnection","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Reason for approval/rejection of the connection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"groupIds":{"name":"groupIds","type":"\u0019\u0007","is_mandatory":true,"title":"Private link group IDs the connection targets (for example \"redisCache\")","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Private endpoint connection ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Private endpoint connection name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpoint":{"name":"privateEndpoint","type":"\u001bazure.subscription.networkService.privateEndpoint","title":"Associated private endpoint","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointId":{"name":"privateEndpointId","type":"\u0007","is_mandatory":true,"title":"Raw private endpoint resource ID","desc":"Deprecated in favor of `privateEndpoint()`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state. Possible values: \"Succeeded\", \"Creating\", \"Deleting\", \"Failed\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Connection status (Approved, Pending, Rejected)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Private endpoint connection type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cache for Redis private endpoint connection","private":true,"min_provider_version":"11.4.32","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService":{"id":"azure.subscription.cloudDefenderService","name":"azure.subscription.cloudDefenderService","fields":{"alert":{"name":"alert","type":"\u001bazure.subscription.cloudDefenderService.alert","title":"Microsoft Defender for Cloud security alert","desc":"A threat detection raised by Microsoft Defender for Cloud describing suspicious or malicious activity observed against a resource. Reports the alert severity and status, the compromised entity, the kill-chain intent, the time window of the activity, and manual remediation steps. Audit active alerts to find in-progress or unresolved threats in the subscription.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"alertSuppressionRule":{"name":"alertSuppressionRule","type":"\u001bazure.subscription.cloudDefenderService.alertSuppressionRule","title":"Microsoft Defender for Cloud alert suppression rule","desc":"A rule that automatically dismisses matching security alerts. Useful for auditing detection blind spots: a broad or non-expiring suppression rule can hide real alerts. Surfaces the suppressed alert type, the rule state and reason, its expiration, and the conditions narrowing which alerts it matches. Select by the rule's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"alertSuppressionRules":{"name":"alertSuppressionRules","type":"\u0019\u001bazure.subscription.cloudDefenderService.alertSuppressionRule","title":"Alert suppression rules (which alerts are auto-dismissed, a potential detection blind spot)","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"alerts":{"name":"alerts","type":"\u0019\u001bazure.subscription.cloudDefenderService.alert","title":"Active security alerts raised by Microsoft Defender for Cloud","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"apiCollection":{"name":"apiCollection","type":"\u001bazure.subscription.cloudDefenderService.apiCollection","title":"Microsoft Defender for APIs collection","desc":"An API collection (typically an Azure API Management API) onboarded to Microsoft Defender for APIs. Surfaces the endpoint-exposure counts Defender computes for the collection: how many endpoints are unauthenticated, reachable from outside the organization, or expose sensitive data, alongside the total and inactive endpoint counts and the assigned sensitivity label. Audit these to find internet-facing or unauthenticated API surface carrying sensitive data. Select by the collection's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"apiCollections":{"name":"apiCollections","type":"\u0019\u001bazure.subscription.cloudDefenderService.apiCollection","title":"API collections onboarded to Microsoft Defender for APIs","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"assessment":{"name":"assessment","type":"\u001bazure.subscription.cloudDefenderService.assessment","title":"Microsoft Defender for Cloud security assessment","desc":"A security recommendation evaluated against a resource, reporting whether the resource is healthy, unhealthy, or not applicable, together with its severity, Defender CSPM risk level, affected security categories, associated MITRE ATT\u0026CK tactics and techniques, and remediation guidance. Audit unhealthy assessments to find the misconfigurations and exposures Microsoft Defender for Cloud has flagged, and drill into subAssessments for the per-CVE or per-check detail behind a finding.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"assessments":{"name":"assessments","type":"\u0019\u001bazure.subscription.cloudDefenderService.assessment","title":"Security assessments (recommendations) and their health status","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defenderCSPM":{"name":"defenderCSPM","type":"\u001bazure.subscription.cloudDefenderService.defenderCSPM","title":"Microsoft Defender Cloud Security Posture Management (CSPM) configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defenderForApis":{"name":"defenderForApis","type":"\u001bazure.subscription.cloudDefenderService.defenderForApis","title":"Microsoft Defender for APIs configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defenderForAppServices":{"name":"defenderForAppServices","type":"\n","title":"Microsoft Defender for App Service configuration","desc":"Deprecated in favor of `forAppServices`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"defenderForContainers":{"name":"defenderForContainers","type":"\n","title":"Defender for Containers components configuration","desc":"Deprecated in favor of `forContainers`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"defenderForCosmosDb":{"name":"defenderForCosmosDb","type":"\n","title":"Microsoft Defender for Azure Cosmos DB configuration","desc":"Deprecated in favor of `forCosmosDb`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"defenderForKeyVaults":{"name":"defenderForKeyVaults","type":"\n","title":"Microsoft Defender for Key Vault configuration","desc":"Deprecated in favor of `forKeyVaults`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"defenderForOpenSourceDatabases":{"name":"defenderForOpenSourceDatabases","type":"\n","title":"Microsoft Defender for open-source relational databases configuration","desc":"Deprecated in favor of `forOpenSourceDatabases`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"defenderForResourceManager":{"name":"defenderForResourceManager","type":"\n","title":"Microsoft Defender for Resource Manager configuration","desc":"Deprecated in favor of `forResourceManager`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"defenderForServers":{"name":"defenderForServers","type":"\n","title":"List of Defender for Servers components and whether they are enabled","desc":"Deprecated in favor of `forServers`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"defenderForSqlDatabases":{"name":"defenderForSqlDatabases","type":"\n","title":"Microsoft Defender for Azure SQL Databases configuration","desc":"Deprecated in favor of `forSqlDatabases`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"defenderForSqlServersOnMachines":{"name":"defenderForSqlServersOnMachines","type":"\n","title":"Microsoft Defender for SQL servers on machines configuration","desc":"Deprecated in favor of `forSqlServersOnMachines`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"defenderForStorageAccounts":{"name":"defenderForStorageAccounts","type":"\n","title":"Microsoft Defender for Storage Accounts configuration","desc":"Deprecated in favor of `forStorageAccounts`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"forAppServices":{"name":"forAppServices","type":"\u001bazure.subscription.cloudDefenderService.defenderForAppServices","title":"Microsoft Defender for App Service configuration","min_provider_version":"11.6.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"forContainers":{"name":"forContainers","type":"\u001bazure.subscription.cloudDefenderService.defenderForContainers","title":"Defender for Containers components configuration","min_provider_version":"11.6.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"forCosmosDb":{"name":"forCosmosDb","type":"\u001bazure.subscription.cloudDefenderService.defenderForCosmosDb","title":"Microsoft Defender for Azure Cosmos DB configuration","min_provider_version":"11.6.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"forKeyVaults":{"name":"forKeyVaults","type":"\u001bazure.subscription.cloudDefenderService.defenderForKeyVaults","title":"Microsoft Defender for Key Vault configuration","min_provider_version":"11.6.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"forOpenSourceDatabases":{"name":"forOpenSourceDatabases","type":"\u001bazure.subscription.cloudDefenderService.defenderForOpenSourceDatabases","title":"Microsoft Defender for open-source relational databases configuration","min_provider_version":"11.6.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"forResourceManager":{"name":"forResourceManager","type":"\u001bazure.subscription.cloudDefenderService.defenderForResourceManager","title":"Microsoft Defender for Resource Manager configuration","min_provider_version":"11.6.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"forServers":{"name":"forServers","type":"\u001bazure.subscription.cloudDefenderService.defenderForServers","title":"List of Defender for Servers components and whether they are enabled","min_provider_version":"11.6.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"forSqlDatabases":{"name":"forSqlDatabases","type":"\u001bazure.subscription.cloudDefenderService.defenderForSqlDatabases","title":"Microsoft Defender for Azure SQL Databases configuration","min_provider_version":"11.6.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"forSqlServersOnMachines":{"name":"forSqlServersOnMachines","type":"\u001bazure.subscription.cloudDefenderService.defenderForSqlServersOnMachines","title":"Microsoft Defender for SQL servers on machines configuration","min_provider_version":"11.6.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"forStorageAccounts":{"name":"forStorageAccounts","type":"\u001bazure.subscription.cloudDefenderService.defenderForStorageAccounts","title":"Microsoft Defender for Storage Accounts configuration","min_provider_version":"11.6.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"jitNetworkAccessPolicies":{"name":"jitNetworkAccessPolicies","type":"\u0019\u001bazure.subscription.cloudDefenderService.jitNetworkAccessPolicy","title":"Just-in-time network access policies (on-demand, time-bound VM port access)","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"jitNetworkAccessPolicy":{"name":"jitNetworkAccessPolicy","type":"\u001bazure.subscription.cloudDefenderService.jitNetworkAccessPolicy","title":"Microsoft Defender for Cloud just-in-time network access policy","desc":"A just-in-time (JIT) VM access policy: instead of leaving management ports open, access is requested on demand and granted for a limited time. Surfaces the governed virtual machines and, per VM, the ports the policy controls and their maximum access duration. Select by the policy's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"monitoringAgentAutoProvision":{"name":"monitoringAgentAutoProvision","type":"\u0004","title":"Whether the monitoring agent is automatically provisioned on new VMs","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"regulatoryComplianceControl":{"name":"regulatoryComplianceControl","type":"\u001bazure.subscription.cloudDefenderService.regulatoryComplianceControl","title":"Microsoft Defender regulatory compliance control","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"regulatoryComplianceStandard":{"name":"regulatoryComplianceStandard","type":"\u001bazure.subscription.cloudDefenderService.regulatoryComplianceStandard","title":"Microsoft Defender regulatory compliance standard","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"regulatoryComplianceStandards":{"name":"regulatoryComplianceStandards","type":"\u0019\u001bazure.subscription.cloudDefenderService.regulatoryComplianceStandard","title":"Regulatory compliance standards","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secureScore":{"name":"secureScore","type":"\u001bazure.subscription.cloudDefenderService.secureScore","title":"Microsoft Defender secure score","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"secureScoreControl":{"name":"secureScoreControl","type":"\u001bazure.subscription.cloudDefenderService.secureScoreControl","title":"Microsoft Defender secure score control","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"secureScoreControls":{"name":"secureScoreControls","type":"\u0019\u001bazure.subscription.cloudDefenderService.secureScoreControl","title":"Secure score controls with details","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secureScores":{"name":"secureScores","type":"\u0019\u001bazure.subscription.cloudDefenderService.secureScore","title":"Secure scores for the subscription","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityContact":{"name":"securityContact","type":"\u001bazure.subscription.cloudDefenderService.securityContact","title":"Microsoft Defender for Cloud security contact","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"securityContacts":{"name":"securityContacts","type":"\u0019\u001bazure.subscription.cloudDefenderService.securityContact","title":"List of configured security contacts","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"settings":{"name":"settings","type":"\u001bazure.subscription.cloudDefenderService.settings","title":"Microsoft Defender for Cloud security settings","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"settingsMCAS":{"name":"settingsMCAS","type":"\u001bazure.subscription.cloudDefenderService.settings","title":"Settings for MCAS","min_provider_version":"11.3.31","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"settingsSentinel":{"name":"settingsSentinel","type":"\u001bazure.subscription.cloudDefenderService.settings","title":"Settings for Sentinel","min_provider_version":"11.3.31","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"settingsWDATP":{"name":"settingsWDATP","type":"\u001bazure.subscription.cloudDefenderService.settings","title":"Settings for WDATP","min_provider_version":"11.3.31","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workspaceSetting":{"name":"workspaceSetting","type":"\u001bazure.subscription.cloudDefenderService.workspaceSetting","title":"Microsoft Defender for Cloud workspace setting","desc":"The Log Analytics workspace that a scope's security data is sent to. Surfaces the scope the setting applies to and the target workspace. Select by the setting's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"workspaceSettings":{"name":"workspaceSettings","type":"\u0019\u001bazure.subscription.cloudDefenderService.workspaceSetting","title":"Workspace settings (where the subscription's security data is stored)","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Cloud","desc":"Microsoft Defender for Cloud posture and threat protection for the subscription. Reports which Defender plans (servers, containers, storage, databases, key vaults, App Service, Resource Manager, APIs, and CSPM) are enabled and at what pricing tier, alongside security assessments, active alerts, secure scores, regulatory compliance results, just-in-time VM access policies, alert suppression rules, workspace settings, and security contacts. Audit it to confirm the intended protections are turned on and to review the subscription's overall security posture.","private":true,"min_provider_version":"9.0.1","defaults":"defenderForServers.enabled defenderForContainers.enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.alert":{"id":"azure.subscription.cloudDefenderService.alert","name":"azure.subscription.cloudDefenderService.alert","fields":{"alertType":{"name":"alertType","type":"\u0007","is_mandatory":true,"title":"Type identifier of the alert","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"compromisedEntity":{"name":"compromisedEntity","type":"\u0007","is_mandatory":true,"title":"Display name of the resource most related to the alert","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the alert","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Human-readable name of the alert","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endTime":{"name":"endTime","type":"\t","is_mandatory":true,"title":"Time the alert activity ended","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Alert resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"intent":{"name":"intent","type":"\u0007","is_mandatory":true,"title":"Kill-chain intent behind the alert (e.g. Execution, Exfiltration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Alert name (a globally unique identifier)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"remediationSteps":{"name":"remediationSteps","type":"\u0019\u0007","is_mandatory":true,"title":"Manual action steps to remediate the alert","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceIdentifiers":{"name":"resourceIdentifiers","type":"\u0019\n","is_mandatory":true,"title":"Identifiers of the resources the alert is related to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Severity of the alert (Informational, Low, Medium, High)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"startTime":{"name":"startTime","type":"\t","is_mandatory":true,"title":"Time the alert activity started","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the alert (Active, InProgress, Resolved, Dismissed)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeGenerated":{"name":"timeGenerated","type":"\t","is_mandatory":true,"title":"Time the alert was generated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vendorName":{"name":"vendorName","type":"\u0007","is_mandatory":true,"title":"Name of the vendor that raised the alert","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Cloud security alert","desc":"A threat detection raised by Microsoft Defender for Cloud describing suspicious or malicious activity observed against a resource. Reports the alert severity and status, the compromised entity, the kill-chain intent, the time window of the activity, and manual remediation steps. Audit active alerts to find in-progress or unresolved threats in the subscription.","private":true,"min_provider_version":"13.11.3","defaults":"displayName severity status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.alertSuppressionRule":{"id":"azure.subscription.cloudDefenderService.alertSuppressionRule","name":"azure.subscription.cloudDefenderService.alertSuppressionRule","fields":{"alertType":{"name":"alertType","type":"\u0007","is_mandatory":true,"title":"Alert type the rule suppresses; \"*\" suppresses all types","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Free-text comment on the rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expirationDate":{"name":"expirationDate","type":"\t","is_mandatory":true,"title":"When the rule expires; null for no expiration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Suppression rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModified":{"name":"lastModified","type":"\t","is_mandatory":true,"title":"When the rule was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Suppression rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"reason":{"name":"reason","type":"\u0007","is_mandatory":true,"title":"Reason the alert is dismissed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"State of the rule (Enabled, Disabled, Expired)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"suppressionScope":{"name":"suppressionScope","type":"\u0019\n","is_mandatory":true,"title":"Conditions narrowing which alerts are suppressed","desc":"Each entry carries the alert entity field and its match values; all conditions must hold for an alert to be suppressed.","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Cloud alert suppression rule","desc":"A rule that automatically dismisses matching security alerts. Useful for auditing detection blind spots: a broad or non-expiring suppression rule can hide real alerts. Surfaces the suppressed alert type, the rule state and reason, its expiration, and the conditions narrowing which alerts it matches. Select by the rule's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"name alertType state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.apiCollection":{"id":"azure.subscription.cloudDefenderService.apiCollection","name":"azure.subscription.cloudDefenderService.apiCollection","fields":{"apiManagement":{"name":"apiManagement","type":"\u001bazure.subscription.apiManagementService.service","title":"API Management service the collection was discovered through","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"baseUrl":{"name":"baseUrl","type":"\u0007","is_mandatory":true,"title":"Base URL of the API collection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name of the API collection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Collection resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"numberOfApiEndpoints":{"name":"numberOfApiEndpoints","type":"\u0005","is_mandatory":true,"title":"Total number of API endpoints in the collection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"numberOfApiEndpointsWithSensitiveDataExposed":{"name":"numberOfApiEndpointsWithSensitiveDataExposed","type":"\u0005","is_mandatory":true,"title":"Number of endpoints that expose sensitive data","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"numberOfExternalApiEndpoints":{"name":"numberOfExternalApiEndpoints","type":"\u0005","is_mandatory":true,"title":"Number of endpoints reachable from outside the organization","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"numberOfInactiveApiEndpoints":{"name":"numberOfInactiveApiEndpoints","type":"\u0005","is_mandatory":true,"title":"Number of endpoints that have received no traffic in the last 30 days","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"numberOfUnauthenticatedApiEndpoints":{"name":"numberOfUnauthenticatedApiEndpoints","type":"\u0005","is_mandatory":true,"title":"Number of endpoints that do not require authentication","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sensitivityLabel":{"name":"sensitivityLabel","type":"\u0007","is_mandatory":true,"title":"Sensitivity label assigned to the collection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for APIs collection","desc":"An API collection (typically an Azure API Management API) onboarded to Microsoft Defender for APIs. Surfaces the endpoint-exposure counts Defender computes for the collection: how many endpoints are unauthenticated, reachable from outside the organization, or expose sensitive data, alongside the total and inactive endpoint counts and the assigned sensitivity label. Audit these to find internet-facing or unauthenticated API surface carrying sensitive data. Select by the collection's Azure resource ID.","private":true,"min_provider_version":"13.32.1","defaults":"displayName numberOfUnauthenticatedApiEndpoints numberOfApiEndpointsWithSensitiveDataExposed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.assessment":{"id":"azure.subscription.cloudDefenderService.assessment","name":"azure.subscription.cloudDefenderService.assessment","fields":{"additionalData":{"name":"additionalData","type":"\n","is_mandatory":true,"title":"Additional data describing the assessment result","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"assessmentType":{"name":"assessmentType","type":"\u0007","is_mandatory":true,"title":"Origin of the assessment definition","desc":"One of BuiltIn, BuiltInPolicy, Custom, CustomPolicy, CustomerManaged, DynamicBuiltIn, ManualBuiltIn, ManualBuiltInPolicy, ManualCustomPolicy, VerifiedPartner, or Unknown.","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"categories":{"name":"categories","type":"\u0019\u0007","is_mandatory":true,"title":"Security domains the assessment covers","desc":"Values drawn from Compute, Networking, Data, IdentityAndAccess, IoT, Container, and AppServices.","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of what the assessment evaluates","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Human-readable name of the assessment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"firstEvaluationDate":{"name":"firstEvaluationDate","type":"\t","is_mandatory":true,"title":"When the assessment was created and first evaluated","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Assessment resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"implementationEffort":{"name":"implementationEffort","type":"\u0007","is_mandatory":true,"title":"Effort required to remediate the finding","desc":"One of Low, Moderate, or High.","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Assessment name (a globally unique identifier)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"preview":{"name":"preview","type":"\u0004","is_mandatory":true,"title":"Whether the assessment is in preview status","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"remediationDescription":{"name":"remediationDescription","type":"\u0007","is_mandatory":true,"title":"Guidance describing how to remediate the finding","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceId":{"name":"resourceId","type":"\u0007","is_mandatory":true,"title":"ARM ID of the resource the assessment was run against","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"riskAttackPathReferences":{"name":"riskAttackPathReferences","type":"\u0019\u0007","is_mandatory":true,"title":"Attack-path identifiers this finding participates in","desc":"References into the Defender attack-path graph; the same paths are surfaced in the Microsoft Defender for Cloud portal.","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"riskAttackPaths":{"name":"riskAttackPaths","type":"\u0019\n","is_mandatory":true,"title":"Attack-path graphs the finding contributes to","desc":"Each entry is one attack path with shape `{id, nodes, edges}`: `nodes` are `{id, labels}` (the resources along the path) and `edges` are `{id, sourceId, targetId}` (the directed connections between nodes). Populated only when the subscription has a Defender CSPM plan enabled.","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"riskFactors":{"name":"riskFactors","type":"\u0019\u0007","is_mandatory":true,"title":"Contributing factors that raise the risk level","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"riskIsContextual":{"name":"riskIsContextual","type":"\u0004","is_mandatory":true,"title":"Whether the risk is contextual rather than static","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"riskLevel":{"name":"riskLevel","type":"\u0007","is_mandatory":true,"title":"Risk level of the assessment finding","desc":"Defender CSPM risk-based prioritization. One of Critical, High, Medium, Low, or None. Empty when the subscription has no Defender CSPM plan enabled, since risk prioritization is a CSPM feature.","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Severity of the assessment (Low, Medium, High)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Health status of the assessment (Healthy, Unhealthy, NotApplicable)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"statusCause":{"name":"statusCause","type":"\u0007","is_mandatory":true,"title":"Programmatic code for the cause of the assessment result","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"statusChangeDate":{"name":"statusChangeDate","type":"\t","is_mandatory":true,"title":"When the assessment status last changed","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"statusDescription":{"name":"statusDescription","type":"\u0007","is_mandatory":true,"title":"Human-readable description of the assessment result","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subAssessment":{"name":"subAssessment","type":"\u001bazure.subscription.cloudDefenderService.assessment.subAssessment","title":"Microsoft Defender for Cloud sub-assessment","desc":"A detailed finding underlying a security assessment, such as a single CVE from a vulnerability scan or one failed configuration check. Surfaces the finding's status and severity, its category and remediation guidance, the assessed resource details, and finding-specific additional data. Select by the sub-assessment's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subAssessments":{"name":"subAssessments","type":"\u0019\u001bazure.subscription.cloudDefenderService.assessment.subAssessment","title":"Detailed sub-findings underlying the assessment (per-CVE, per-misconfiguration)","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tactics":{"name":"tactics","type":"\u0019\u0007","is_mandatory":true,"title":"MITRE ATT\u0026CK tactics associated with the assessment","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"techniques":{"name":"techniques","type":"\u0019\u0007","is_mandatory":true,"title":"MITRE ATT\u0026CK techniques associated with the assessment","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"threats":{"name":"threats","type":"\u0019\u0007","is_mandatory":true,"title":"Threat outcomes the assessment guards against","desc":"One or more of accountBreach, dataExfiltration, dataSpillage, denialOfService, elevationOfPrivilege, maliciousInsider, missingCoverage, and threatResistance.","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userImpact":{"name":"userImpact","type":"\u0007","is_mandatory":true,"title":"User impact of remediating the finding","desc":"One of Low, Moderate, or High.","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Cloud security assessment","desc":"A security recommendation evaluated against a resource, reporting whether the resource is healthy, unhealthy, or not applicable, together with its severity, Defender CSPM risk level, affected security categories, associated MITRE ATT\u0026CK tactics and techniques, and remediation guidance. Audit unhealthy assessments to find the misconfigurations and exposures Microsoft Defender for Cloud has flagged, and drill into subAssessments for the per-CVE or per-check detail behind a finding.","private":true,"min_provider_version":"13.11.3","defaults":"displayName status severity riskLevel","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.assessment.subAssessment":{"id":"azure.subscription.cloudDefenderService.assessment.subAssessment","name":"azure.subscription.cloudDefenderService.assessment.subAssessment","fields":{"additionalData":{"name":"additionalData","type":"\n","is_mandatory":true,"title":"Finding-specific details; shape varies by type (SQL, container image, server vulnerability)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Category of the finding","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the finding","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Human-readable name of the finding","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Sub-assessment resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"impact":{"name":"impact","type":"\u0007","is_mandatory":true,"title":"Description of the impact of the finding","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Sub-assessment name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"remediation":{"name":"remediation","type":"\u0007","is_mandatory":true,"title":"Guidance on how to remediate the finding","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceDetails":{"name":"resourceDetails","type":"\n","is_mandatory":true,"title":"Details of the assessed resource; shape varies by source (Azure, OnPremise, container registry)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Severity of the finding (Low, Medium, High)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status code of the finding (Healthy, Unhealthy, NotApplicable)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"statusCause":{"name":"statusCause","type":"\u0007","is_mandatory":true,"title":"Programmatic code for the cause of the status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"statusDescription":{"name":"statusDescription","type":"\u0007","is_mandatory":true,"title":"Human-readable description of the status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeGenerated":{"name":"timeGenerated","type":"\t","is_mandatory":true,"title":"When the finding was generated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vulnerabilityId":{"name":"vulnerabilityId","type":"\u0007","is_mandatory":true,"title":"Finding identifier, such as a CVE, when applicable","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Cloud sub-assessment","desc":"A detailed finding underlying a security assessment, such as a single CVE from a vulnerability scan or one failed configuration check. Surfaces the finding's status and severity, its category and remediation guidance, the assessed resource details, and finding-specific additional data. Select by the sub-assessment's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"displayName status severity","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderCSPM":{"id":"azure.subscription.cloudDefenderService.defenderCSPM","name":"azure.subscription.cloudDefenderService.defenderCSPM","fields":{"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the pricing plan is deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Defender CSPM is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablementTime":{"name":"enablementTime","type":"\t","is_mandatory":true,"title":"When the pricing tier was last set to Standard","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enforce":{"name":"enforce","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is enforced on child scopes","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"extension":{"name":"extension","type":"\u001bazure.subscription.cloudDefenderService.defenderCSPM.extension","title":"Microsoft Defender CSPM extension","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"extensions":{"name":"extensions","type":"\u0019\u001bazure.subscription.cloudDefenderService.defenderCSPM.extension","title":"Extensions configured for Defender CSPM","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"freeTrialRemainingTime":{"name":"freeTrialRemainingTime","type":"\u0007","is_mandatory":true,"title":"ISO 8601 duration of the free trial remaining","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is inherited from a parent scope","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inheritedFrom":{"name":"inheritedFrom","type":"\u0007","is_mandatory":true,"title":"ID of the parent scope from which the configuration is inherited","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier (Free or Standard)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacedBy":{"name":"replacedBy","type":"\u0019\u0007","is_mandatory":true,"title":"List of plan IDs that replace this plan if deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourcesCoverageStatus":{"name":"resourcesCoverageStatus","type":"\u0007","is_mandatory":true,"title":"Coverage status of resources under this plan (FullyCovered, NotCovered, PartiallyCovered)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subPlan":{"name":"subPlan","type":"\u0007","is_mandatory":true,"title":"Sub-plan selected for the pricing tier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender Cloud Security Posture Management (CSPM)","private":true,"min_provider_version":"11.4.21","defaults":"enabled pricingTier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderCSPM.extension":{"id":"azure.subscription.cloudDefenderService.defenderCSPM.extension","name":"azure.subscription.cloudDefenderService.defenderCSPM.extension","fields":{"additionalProperties":{"name":"additionalProperties","type":"\n","is_mandatory":true,"title":"Additional extension properties","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the extension is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Extension name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"operationStatusCode":{"name":"operationStatusCode","type":"\u0007","is_mandatory":true,"title":"Status code of the enablement/disablement operation (Succeeded or Failed)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"operationStatusMessage":{"name":"operationStatusMessage","type":"\u0007","is_mandatory":true,"title":"Status message of the enablement/disablement operation","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender CSPM extension","private":true,"min_provider_version":"11.4.21","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderForApis":{"id":"azure.subscription.cloudDefenderService.defenderForApis","name":"azure.subscription.cloudDefenderService.defenderForApis","fields":{"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the pricing plan is deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Defender for APIs is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablementTime":{"name":"enablementTime","type":"\t","is_mandatory":true,"title":"When the pricing tier was last set to Standard","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enforce":{"name":"enforce","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is enforced on child scopes","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"freeTrialRemainingTime":{"name":"freeTrialRemainingTime","type":"\u0007","is_mandatory":true,"title":"ISO 8601 duration of the free trial remaining","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is inherited from a parent scope","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inheritedFrom":{"name":"inheritedFrom","type":"\u0007","is_mandatory":true,"title":"ID of the parent scope from which the configuration is inherited","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier (Free or Standard)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacedBy":{"name":"replacedBy","type":"\u0019\u0007","is_mandatory":true,"title":"List of plan IDs that replace this plan if deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourcesCoverageStatus":{"name":"resourcesCoverageStatus","type":"\u0007","is_mandatory":true,"title":"Coverage status of resources under this plan (FullyCovered, NotCovered, PartiallyCovered)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subPlan":{"name":"subPlan","type":"\u0007","is_mandatory":true,"title":"Sub-plan selected for the pricing tier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for APIs","private":true,"min_provider_version":"11.4.21","defaults":"enabled pricingTier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderForAppServices":{"id":"azure.subscription.cloudDefenderService.defenderForAppServices","name":"azure.subscription.cloudDefenderService.defenderForAppServices","fields":{"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the pricing plan is deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Defender for App Service is enabled","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablementTime":{"name":"enablementTime","type":"\t","is_mandatory":true,"title":"When the pricing tier was last set to Standard","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enforce":{"name":"enforce","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is enforced on child scopes","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"freeTrialRemainingTime":{"name":"freeTrialRemainingTime","type":"\u0007","is_mandatory":true,"title":"ISO 8601 duration of the free trial remaining","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is inherited from a parent scope","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inheritedFrom":{"name":"inheritedFrom","type":"\u0007","is_mandatory":true,"title":"ID of the parent scope from which the configuration is inherited","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier (Free or Standard)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacedBy":{"name":"replacedBy","type":"\u0019\u0007","is_mandatory":true,"title":"List of plan IDs that replace this plan if deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourcesCoverageStatus":{"name":"resourcesCoverageStatus","type":"\u0007","is_mandatory":true,"title":"Coverage status of resources under this plan (FullyCovered, NotCovered, PartiallyCovered)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subPlan":{"name":"subPlan","type":"\u0007","is_mandatory":true,"title":"Sub-plan selected for the pricing tier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for App Service","private":true,"min_provider_version":"11.1.0","defaults":"enabled pricingTier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderForContainers":{"id":"azure.subscription.cloudDefenderService.defenderForContainers","name":"azure.subscription.cloudDefenderService.defenderForContainers","fields":{"azurePolicyForKubernetes":{"name":"azurePolicyForKubernetes","type":"\u0004","is_mandatory":true,"title":"Whether Azure Policy for Kubernetes is enabled","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defenderDaemonSet":{"name":"defenderDaemonSet","type":"\u0004","is_mandatory":true,"title":"Whether the Defender DaemonSet is deployed","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the pricing plan is deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Defender for Containers is enabled","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablementTime":{"name":"enablementTime","type":"\t","is_mandatory":true,"title":"When the pricing tier was last set to Standard","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enforce":{"name":"enforce","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is enforced on child scopes","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"extension":{"name":"extension","type":"\u001bazure.subscription.cloudDefenderService.defenderForContainers.extension","title":"Microsoft Defender for Containers extension","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"extensions":{"name":"extensions","type":"\u0019\u001bazure.subscription.cloudDefenderService.defenderForContainers.extension","title":"Extensions configured for Defender for Containers","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"freeTrialRemainingTime":{"name":"freeTrialRemainingTime","type":"\u0007","is_mandatory":true,"title":"ISO 8601 duration of the free trial remaining","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is inherited from a parent scope","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inheritedFrom":{"name":"inheritedFrom","type":"\u0007","is_mandatory":true,"title":"ID of the parent scope from which the configuration is inherited","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier (Free or Standard)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacedBy":{"name":"replacedBy","type":"\u0019\u0007","is_mandatory":true,"title":"List of plan IDs that replace this plan if deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourcesCoverageStatus":{"name":"resourcesCoverageStatus","type":"\u0007","is_mandatory":true,"title":"Coverage status of resources under this plan (FullyCovered, NotCovered, PartiallyCovered)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subPlan":{"name":"subPlan","type":"\u0007","is_mandatory":true,"title":"Sub-plan selected for the pricing tier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Containers","private":true,"min_provider_version":"9.0.1","defaults":"enabled pricingTier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderForContainers.extension":{"id":"azure.subscription.cloudDefenderService.defenderForContainers.extension","name":"azure.subscription.cloudDefenderService.defenderForContainers.extension","fields":{"additionalProperties":{"name":"additionalProperties","type":"\n","is_mandatory":true,"title":"Additional extension properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the extension is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Extension name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"operationStatusCode":{"name":"operationStatusCode","type":"\u0007","is_mandatory":true,"title":"Status code of the enablement/disablement operation (Succeeded or Failed)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"operationStatusMessage":{"name":"operationStatusMessage","type":"\u0007","is_mandatory":true,"title":"Status message of the enablement/disablement operation","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Containers extension","private":true,"min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderForCosmosDb":{"id":"azure.subscription.cloudDefenderService.defenderForCosmosDb","name":"azure.subscription.cloudDefenderService.defenderForCosmosDb","fields":{"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the pricing plan is deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Defender for Azure Cosmos DB is enabled","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablementTime":{"name":"enablementTime","type":"\t","is_mandatory":true,"title":"When the pricing tier was last set to Standard","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enforce":{"name":"enforce","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is enforced on child scopes","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"freeTrialRemainingTime":{"name":"freeTrialRemainingTime","type":"\u0007","is_mandatory":true,"title":"ISO 8601 duration of the free trial remaining","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is inherited from a parent scope","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inheritedFrom":{"name":"inheritedFrom","type":"\u0007","is_mandatory":true,"title":"ID of the parent scope from which the configuration is inherited","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier (Free or Standard)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacedBy":{"name":"replacedBy","type":"\u0019\u0007","is_mandatory":true,"title":"List of plan IDs that replace this plan if deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourcesCoverageStatus":{"name":"resourcesCoverageStatus","type":"\u0007","is_mandatory":true,"title":"Coverage status of resources under this plan (FullyCovered, NotCovered, PartiallyCovered)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subPlan":{"name":"subPlan","type":"\u0007","is_mandatory":true,"title":"Sub-plan selected for the pricing tier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Azure Cosmos DB","private":true,"min_provider_version":"11.1.0","defaults":"enabled pricingTier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderForKeyVaults":{"id":"azure.subscription.cloudDefenderService.defenderForKeyVaults","name":"azure.subscription.cloudDefenderService.defenderForKeyVaults","fields":{"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the pricing plan is deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Defender for Key Vault is enabled","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablementTime":{"name":"enablementTime","type":"\t","is_mandatory":true,"title":"When the pricing tier was last set to Standard","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enforce":{"name":"enforce","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is enforced on child scopes","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"freeTrialRemainingTime":{"name":"freeTrialRemainingTime","type":"\u0007","is_mandatory":true,"title":"ISO 8601 duration of the free trial remaining","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is inherited from a parent scope","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inheritedFrom":{"name":"inheritedFrom","type":"\u0007","is_mandatory":true,"title":"ID of the parent scope from which the configuration is inherited","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier (Free or Standard)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacedBy":{"name":"replacedBy","type":"\u0019\u0007","is_mandatory":true,"title":"List of plan IDs that replace this plan if deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourcesCoverageStatus":{"name":"resourcesCoverageStatus","type":"\u0007","is_mandatory":true,"title":"Coverage status of resources under this plan (FullyCovered, NotCovered, PartiallyCovered)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subPlan":{"name":"subPlan","type":"\u0007","is_mandatory":true,"title":"Sub-plan selected for the pricing tier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Key Vault","private":true,"min_provider_version":"11.1.0","defaults":"enabled pricingTier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderForOpenSourceDatabases":{"id":"azure.subscription.cloudDefenderService.defenderForOpenSourceDatabases","name":"azure.subscription.cloudDefenderService.defenderForOpenSourceDatabases","fields":{"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the pricing plan is deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Defender for open-source relational databases is enabled","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablementTime":{"name":"enablementTime","type":"\t","is_mandatory":true,"title":"When the pricing tier was last set to Standard","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enforce":{"name":"enforce","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is enforced on child scopes","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"freeTrialRemainingTime":{"name":"freeTrialRemainingTime","type":"\u0007","is_mandatory":true,"title":"ISO 8601 duration of the free trial remaining","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is inherited from a parent scope","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inheritedFrom":{"name":"inheritedFrom","type":"\u0007","is_mandatory":true,"title":"ID of the parent scope from which the configuration is inherited","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier (Free or Standard)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacedBy":{"name":"replacedBy","type":"\u0019\u0007","is_mandatory":true,"title":"List of plan IDs that replace this plan if deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourcesCoverageStatus":{"name":"resourcesCoverageStatus","type":"\u0007","is_mandatory":true,"title":"Coverage status of resources under this plan (FullyCovered, NotCovered, PartiallyCovered)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subPlan":{"name":"subPlan","type":"\u0007","is_mandatory":true,"title":"Sub-plan selected for the pricing tier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for open-source relational databases","private":true,"min_provider_version":"11.1.0","defaults":"enabled pricingTier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderForResourceManager":{"id":"azure.subscription.cloudDefenderService.defenderForResourceManager","name":"azure.subscription.cloudDefenderService.defenderForResourceManager","fields":{"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the pricing plan is deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Defender for Resource Manager is enabled","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablementTime":{"name":"enablementTime","type":"\t","is_mandatory":true,"title":"When the pricing tier was last set to Standard","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enforce":{"name":"enforce","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is enforced on child scopes","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"freeTrialRemainingTime":{"name":"freeTrialRemainingTime","type":"\u0007","is_mandatory":true,"title":"ISO 8601 duration of the free trial remaining","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is inherited from a parent scope","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inheritedFrom":{"name":"inheritedFrom","type":"\u0007","is_mandatory":true,"title":"ID of the parent scope from which the configuration is inherited","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier (Free or Standard)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacedBy":{"name":"replacedBy","type":"\u0019\u0007","is_mandatory":true,"title":"List of plan IDs that replace this plan if deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourcesCoverageStatus":{"name":"resourcesCoverageStatus","type":"\u0007","is_mandatory":true,"title":"Coverage status of resources under this plan (FullyCovered, NotCovered, PartiallyCovered)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subPlan":{"name":"subPlan","type":"\u0007","is_mandatory":true,"title":"Sub-plan selected for the pricing tier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Resource Manager","private":true,"min_provider_version":"11.1.0","defaults":"enabled pricingTier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderForServers":{"id":"azure.subscription.cloudDefenderService.defenderForServers","name":"azure.subscription.cloudDefenderService.defenderForServers","fields":{"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the pricing plan is deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Defender for Servers is enabled","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablementTime":{"name":"enablementTime","type":"\t","is_mandatory":true,"title":"When the pricing tier was last set to Standard","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enforce":{"name":"enforce","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is enforced on child scopes","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"freeTrialRemainingTime":{"name":"freeTrialRemainingTime","type":"\u0007","is_mandatory":true,"title":"ISO 8601 duration of the free trial remaining","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is inherited from a parent scope","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inheritedFrom":{"name":"inheritedFrom","type":"\u0007","is_mandatory":true,"title":"ID of the parent scope from which the configuration is inherited","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier (Free or Standard)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacedBy":{"name":"replacedBy","type":"\u0019\u0007","is_mandatory":true,"title":"List of plan IDs that replace this plan if deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourcesCoverageStatus":{"name":"resourcesCoverageStatus","type":"\u0007","is_mandatory":true,"title":"Coverage status of resources under this plan (FullyCovered, NotCovered, PartiallyCovered)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subPlan":{"name":"subPlan","type":"\u0007","is_mandatory":true,"title":"Sub-plan selected for the pricing tier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vulnerabilityManagementToolName":{"name":"vulnerabilityManagementToolName","type":"\u0007","is_mandatory":true,"title":"Name of the vulnerability management tool in use","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Servers","private":true,"min_provider_version":"9.0.1","defaults":"enabled pricingTier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderForSqlDatabases":{"id":"azure.subscription.cloudDefenderService.defenderForSqlDatabases","name":"azure.subscription.cloudDefenderService.defenderForSqlDatabases","fields":{"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the pricing plan is deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Defender for Azure SQL Databases is enabled","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablementTime":{"name":"enablementTime","type":"\t","is_mandatory":true,"title":"When the pricing tier was last set to Standard","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enforce":{"name":"enforce","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is enforced on child scopes","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"freeTrialRemainingTime":{"name":"freeTrialRemainingTime","type":"\u0007","is_mandatory":true,"title":"ISO 8601 duration of the free trial remaining","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is inherited from a parent scope","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inheritedFrom":{"name":"inheritedFrom","type":"\u0007","is_mandatory":true,"title":"ID of the parent scope from which the configuration is inherited","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier (Free or Standard)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacedBy":{"name":"replacedBy","type":"\u0019\u0007","is_mandatory":true,"title":"List of plan IDs that replace this plan if deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourcesCoverageStatus":{"name":"resourcesCoverageStatus","type":"\u0007","is_mandatory":true,"title":"Coverage status of resources under this plan (FullyCovered, NotCovered, PartiallyCovered)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subPlan":{"name":"subPlan","type":"\u0007","is_mandatory":true,"title":"Sub-plan selected for the pricing tier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Azure SQL Databases","private":true,"min_provider_version":"11.1.0","defaults":"enabled pricingTier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderForSqlServersOnMachines":{"id":"azure.subscription.cloudDefenderService.defenderForSqlServersOnMachines","name":"azure.subscription.cloudDefenderService.defenderForSqlServersOnMachines","fields":{"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the pricing plan is deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Defender for SQL servers on machines is enabled","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablementTime":{"name":"enablementTime","type":"\t","is_mandatory":true,"title":"When the pricing tier was last set to Standard","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enforce":{"name":"enforce","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is enforced on child scopes","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"freeTrialRemainingTime":{"name":"freeTrialRemainingTime","type":"\u0007","is_mandatory":true,"title":"ISO 8601 duration of the free trial remaining","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is inherited from a parent scope","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inheritedFrom":{"name":"inheritedFrom","type":"\u0007","is_mandatory":true,"title":"ID of the parent scope from which the configuration is inherited","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier (Free or Standard)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacedBy":{"name":"replacedBy","type":"\u0019\u0007","is_mandatory":true,"title":"List of plan IDs that replace this plan if deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourcesCoverageStatus":{"name":"resourcesCoverageStatus","type":"\u0007","is_mandatory":true,"title":"Coverage status of resources under this plan (FullyCovered, NotCovered, PartiallyCovered)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subPlan":{"name":"subPlan","type":"\u0007","is_mandatory":true,"title":"Sub-plan selected for the pricing tier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for SQL servers on machines","private":true,"min_provider_version":"11.1.0","defaults":"enabled pricingTier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.defenderForStorageAccounts":{"id":"azure.subscription.cloudDefenderService.defenderForStorageAccounts","name":"azure.subscription.cloudDefenderService.defenderForStorageAccounts","fields":{"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the pricing plan is deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Defender for Storage Accounts is enabled","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablementTime":{"name":"enablementTime","type":"\t","is_mandatory":true,"title":"When the pricing tier was last set to Standard","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enforce":{"name":"enforce","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is enforced on child scopes","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"freeTrialRemainingTime":{"name":"freeTrialRemainingTime","type":"\u0007","is_mandatory":true,"title":"ISO 8601 duration of the free trial remaining","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the pricing configuration is inherited from a parent scope","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inheritedFrom":{"name":"inheritedFrom","type":"\u0007","is_mandatory":true,"title":"ID of the parent scope from which the configuration is inherited","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier (Free or Standard)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacedBy":{"name":"replacedBy","type":"\u0019\u0007","is_mandatory":true,"title":"List of plan IDs that replace this plan if deprecated","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourcesCoverageStatus":{"name":"resourcesCoverageStatus","type":"\u0007","is_mandatory":true,"title":"Coverage status of resources under this plan (FullyCovered, NotCovered, PartiallyCovered)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subPlan":{"name":"subPlan","type":"\u0007","is_mandatory":true,"title":"Sub-plan selected for the pricing tier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Storage Accounts","private":true,"min_provider_version":"11.1.0","defaults":"enabled pricingTier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.jitNetworkAccessPolicy":{"id":"azure.subscription.cloudDefenderService.jitNetworkAccessPolicy","name":"azure.subscription.cloudDefenderService.jitNetworkAccessPolicy","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"JIT policy ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"JIT policy kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"JIT policy location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"JIT policy name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"JIT policy resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualMachine":{"name":"virtualMachine","type":"\u001bazure.subscription.cloudDefenderService.jitNetworkAccessPolicy.virtualMachine","title":"Just-in-time network access VM configuration","desc":"The just-in-time access rules for a single virtual machine within a JIT policy: the VM, the Azure Firewall public IP fronting it (if any), and the per-port rules controlling which ports can be opened on demand and for how long.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualMachines":{"name":"virtualMachines","type":"\u0019\u001bazure.subscription.cloudDefenderService.jitNetworkAccessPolicy.virtualMachine","title":"Virtual machines governed by the policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Cloud just-in-time network access policy","desc":"A just-in-time (JIT) VM access policy: instead of leaving management ports open, access is requested on demand and granted for a limited time. Surfaces the governed virtual machines and, per VM, the ports the policy controls and their maximum access duration. Select by the policy's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"name provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.jitNetworkAccessPolicy.virtualMachine":{"id":"azure.subscription.cloudDefenderService.jitNetworkAccessPolicy.virtualMachine","name":"azure.subscription.cloudDefenderService.jitNetworkAccessPolicy.virtualMachine","fields":{"ports":{"name":"ports","type":"\u0019\n","is_mandatory":true,"title":"Per-port just-in-time rules","desc":"Each entry carries number, protocol, maxRequestAccessDuration, and either allowedSourceAddressPrefix or allowedSourceAddressPrefixes.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddress":{"name":"publicIpAddress","type":"\u0007","is_mandatory":true,"title":"Public IP of the Azure Firewall linked to the policy for this VM; empty when none","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vm":{"name":"vm","type":"\u001bazure.subscription.computeService.vm","title":"Virtual machine the just-in-time rules apply to","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Just-in-time network access VM configuration","desc":"The just-in-time access rules for a single virtual machine within a JIT policy: the VM, the Azure Firewall public IP fronting it (if any), and the per-port rules controlling which ports can be opened on demand and for how long.","private":true,"min_provider_version":"13.25.1","defaults":"vm.name publicIpAddress","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.regulatoryComplianceControl":{"id":"azure.subscription.cloudDefenderService.regulatoryComplianceControl","name":"azure.subscription.cloudDefenderService.regulatoryComplianceControl","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Control description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"failedAssessments":{"name":"failedAssessments","type":"\u0005","is_mandatory":true,"title":"Number of failed assessments","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Regulatory compliance control ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Control name/ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"passedAssessments":{"name":"passedAssessments","type":"\u0005","is_mandatory":true,"title":"Number of passed assessments","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skippedAssessments":{"name":"skippedAssessments","type":"\u0005","is_mandatory":true,"title":"Number of skipped assessments","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Aggregative state (Passed, Failed, Skipped, Unsupported)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender regulatory compliance control","private":true,"min_provider_version":"13.3.3","defaults":"name state passedAssessments failedAssessments","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.regulatoryComplianceStandard":{"id":"azure.subscription.cloudDefenderService.regulatoryComplianceStandard","name":"azure.subscription.cloudDefenderService.regulatoryComplianceStandard","fields":{"controls":{"name":"controls","type":"\u0019\u001bazure.subscription.cloudDefenderService.regulatoryComplianceControl","title":"Controls within this standard","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"failedControls":{"name":"failedControls","type":"\u0005","is_mandatory":true,"title":"Number of failed controls","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Regulatory compliance standard ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Standard name (e.g. \"CIS Microsoft Azure Foundations Benchmark 1.4.0\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"passedControls":{"name":"passedControls","type":"\u0005","is_mandatory":true,"title":"Number of passed controls","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skippedControls":{"name":"skippedControls","type":"\u0005","is_mandatory":true,"title":"Number of skipped controls","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Aggregative state (Passed, Failed, Skipped, Unsupported)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender regulatory compliance standard","private":true,"min_provider_version":"13.3.3","defaults":"name state passedControls failedControls","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.secureScore":{"id":"azure.subscription.cloudDefenderService.secureScore","name":"azure.subscription.cloudDefenderService.secureScore","fields":{"currentScore":{"name":"currentScore","type":"\u0006","is_mandatory":true,"title":"Current score","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name of the secure score","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Secure score ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxScore":{"name":"maxScore","type":"\u0005","is_mandatory":true,"title":"Maximum possible score","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Secure score name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"percentage":{"name":"percentage","type":"\u0006","is_mandatory":true,"title":"Score as a percentage (0.0-1.0)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"weight":{"name":"weight","type":"\u0005","is_mandatory":true,"title":"Weight of the score","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender secure score","private":true,"min_provider_version":"13.3.3","defaults":"displayName currentScore maxScore percentage","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.secureScoreControl":{"id":"azure.subscription.cloudDefenderService.secureScoreControl","name":"azure.subscription.cloudDefenderService.secureScoreControl","fields":{"currentScore":{"name":"currentScore","type":"\u0006","is_mandatory":true,"title":"Current score for this control","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Control description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Control display name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"healthyResourceCount":{"name":"healthyResourceCount","type":"\u0005","is_mandatory":true,"title":"Number of healthy resources","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Secure score control ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxScore":{"name":"maxScore","type":"\u0005","is_mandatory":true,"title":"Maximum possible score for this control","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Secure score control name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"notApplicableResourceCount":{"name":"notApplicableResourceCount","type":"\u0005","is_mandatory":true,"title":"Number of not-applicable resources","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"percentage":{"name":"percentage","type":"\u0006","is_mandatory":true,"title":"Score as a percentage (0.0-1.0)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"unhealthyResourceCount":{"name":"unhealthyResourceCount","type":"\u0005","is_mandatory":true,"title":"Number of unhealthy resources","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"weight":{"name":"weight","type":"\u0005","is_mandatory":true,"title":"Weight of the control","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender secure score control","private":true,"min_provider_version":"13.3.3","defaults":"displayName currentScore maxScore","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.securityContact":{"id":"azure.subscription.cloudDefenderService.securityContact","name":"azure.subscription.cloudDefenderService.securityContact","fields":{"emails":{"name":"emails","type":"\u0019\u0007","is_mandatory":true,"title":"Emails that receive security alerts","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the security contact","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the security contact is enabled","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the security contact","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"notificationSources":{"name":"notificationSources","type":"\n","is_mandatory":true,"title":"Email notification sources and their thresholds","desc":"Keyed by source type (\"Alert\" or \"AttackPath\"). Each value carries the source type and its minimum notification threshold: minimalSeverity for Alert sources and minimalRiskLevel for AttackPath sources.","min_provider_version":"11.3.31","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"notificationsByRole":{"name":"notificationsByRole","type":"\n","is_mandatory":true,"title":"Subscription roles that receive email notifications","desc":"Carries state (\"On\" or \"Off\") and roles, the list of subscription RBAC roles whose members are notified (for example Owner, Contributor, ServiceAdmin, or AccountAdmin).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"phone":{"name":"phone","type":"\u0007","is_mandatory":true,"title":"Phone number of the security contact","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Cloud security contact","private":true,"min_provider_version":"9.0.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.settings":{"id":"azure.subscription.cloudDefenderService.settings","name":"azure.subscription.cloudDefenderService.settings","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"The settings kind (data export, alert sync, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The settings name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Setting configuration","desc":"Carries the `enabled` boolean indicating whether the data export or alert sync setting is turned on.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"The settings type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Cloud security settings","private":true,"min_provider_version":"11.3.31","defaults":"name kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cloudDefenderService.workspaceSetting":{"id":"azure.subscription.cloudDefenderService.workspaceSetting","name":"azure.subscription.cloudDefenderService.workspaceSetting","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Workspace setting ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Workspace setting name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope the setting applies to; resources under it send security data to the workspace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workspace":{"name":"workspace","type":"\u001bazure.subscription.monitorService.workspace","title":"Log Analytics workspace the security data is stored in","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Cloud workspace setting","desc":"The Log Analytics workspace that a scope's security data is sent to. Surfaces the scope the setting applies to and the target workspace. Select by the setting's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"name scope","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService":{"id":"azure.subscription.cognitiveServicesService","name":"azure.subscription.cognitiveServicesService","fields":{"account":{"name":"account","type":"\u001bazure.subscription.cognitiveServicesService.account","title":"Azure AI Services account","desc":"Single Azure AI Services account, the resource that exposes one or more AI APIs identified by `kind` (for example \"OpenAI\", \"SpeechServices\", or \"CognitiveServices\"). `publicNetworkAccess` reports whether the account is reachable from the public internet, `networkAcls` holds the IP and virtual-network firewall rules, `disableLocalAuth` reports whether API-key authentication is turned off in favor of Microsoft Entra ID, `restrictOutboundNetworkAccess` covers data-exfiltration controls, `cmkKeyName` and `cmkKeyVaultUri` describe the customer-managed key encrypting the account, and `customSubDomainName` is the subdomain required by token-based authentication and private endpoints.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"accounts":{"name":"accounts","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account","title":"Azure AI Services accounts in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure AI Services","desc":"Azure AI Services (formerly Cognitive Services) accounts in the subscription, backed by the `Microsoft.CognitiveServices` resource provider. Each account exposes AI APIs (OpenAI, Speech, Vision, Language, and others) whose prompts and responses can carry sensitive data, so this namespace is the entry point for auditing their public-network exposure, network ACLs, customer-managed-key encryption, and authentication posture. The `accounts` field holds the per-account records.","private":true,"min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account":{"id":"azure.subscription.cognitiveServicesService.account","name":"azure.subscription.cognitiveServicesService.account","fields":{"abusePenaltyAction":{"name":"abusePenaltyAction","type":"\u0007","is_mandatory":true,"title":"Content-abuse enforcement action Azure applies when responsible-AI monitoring flags the account","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"abusePenaltyExpiration":{"name":"abusePenaltyExpiration","type":"\t","is_mandatory":true,"title":"When the content-abuse penalty expires","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"abusePenaltyRateLimitPercentage":{"name":"abusePenaltyRateLimitPercentage","type":"\u0006","is_mandatory":true,"title":"Percentage the request rate is throttled to while the content-abuse penalty is in effect","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"allowedFqdnList":{"name":"allowedFqdnList","type":"\u0019\u0007","is_mandatory":true,"title":"Fully qualified domain names the account may reach when outbound access is restricted","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"capabilityHost":{"name":"capabilityHost","type":"\u001bazure.subscription.cognitiveServicesService.account.capabilityHost","title":"Capability host of an Azure AI Services account or project","desc":"Storage backing the account's or project's agents, selected by `name`. Agents keep conversation threads, uploaded files, and vector indexes somewhere, and a capability host is what points that storage at resources the tenant owns instead of Microsoft-managed defaults. `threadStorageConnections`, `storageConnections`, and `vectorStoreConnections` name the connections holding each, so the underlying Cosmos DB account, Storage account, or AI Search service can be audited as the store of the agents' conversation data. `customerSubnet` places the agents' compute in a tenant-owned subnet.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"capabilityHosts":{"name":"capabilityHosts","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.capabilityHost","title":"Capability hosts backing the account's agents","min_provider_version":"13.33.6","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkIdentityClientId":{"name":"cmkIdentityClientId","type":"\u0007","is_mandatory":true,"title":"Client ID of the managed identity used to access the customer-managed key","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeyName":{"name":"cmkKeyName","type":"\u0007","is_mandatory":true,"title":"Name of the customer-managed Key Vault key encrypting the account; empty when platform-managed keys are used","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeySource":{"name":"cmkKeySource","type":"\u0007","is_mandatory":true,"title":"Encryption key source (\"Microsoft.KeyVault\" when a customer-managed key is configured; \"Microsoft.CognitiveServices\" for platform-managed keys)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeyVaultUri":{"name":"cmkKeyVaultUri","type":"\u0007","is_mandatory":true,"title":"URI of the Key Vault holding the customer-managed key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeyVersion":{"name":"cmkKeyVersion","type":"\u0007","is_mandatory":true,"title":"Version of the customer-managed Key Vault key; empty when the account tracks the latest version automatically","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"commitmentPlanAssociations":{"name":"commitmentPlanAssociations","type":"\u0019\n","is_mandatory":true,"title":"Provisioned-throughput commitment plans associated with the account, each with its commitmentPlanId and location","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connection":{"name":"connection","type":"\u001bazure.subscription.cognitiveServicesService.account.connection","title":"Connection on an Azure AI Services account","desc":"Single account-scoped connection, the link (shared across the account's projects) used to reach an external resource, identified by `name`. `category` shows what the connection points to (for example \"AzureOpenAI\", \"CognitiveSearch\", \"Serverless\", \"ManagedOnlineEndpoint\", or \"CustomKeys\", the category used for Model Context Protocol tool servers), `target` gives the endpoint URL, `authType` how the connection authenticates, `isSharedToAll` whether every member can use it, `useWorkspaceManagedIdentity` managed-identity access, `peRequirement`/`peStatus` private-endpoint posture, and `metadata` connection-specific settings (an MCP connection records its server label and URL here).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"connections":{"name":"connections","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.connection","title":"Account-scoped connections to external resources, model providers, data sources, and tool servers","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the account was created","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"customSubDomainName":{"name":"customSubDomainName","type":"\u0007","is_mandatory":true,"title":"Custom subdomain name; required for token-based authentication and private endpoints","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defenderForAIEnabled":{"name":"defenderForAIEnabled","type":"\u0004","title":"Whether Microsoft Defender for AI threat detection is enabled on the account","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deployment":{"name":"deployment","type":"\u001bazure.subscription.cognitiveServicesService.account.deployment","title":"Model deployment on an Azure AI Services account","desc":"Single model deployment, the concrete model an application calls through the account, identified by `name` (for example `azure.subscription.cognitiveServices.accounts.where(kind == \"OpenAI\")[0].deployments.where(name == \"gpt-4o\")`). `modelName` and `modelVersion` confirm which model and version is served (and `modelFormat`/`modelPublisher` for non-OpenAI models), `versionUpgradeOption` reports whether the deployment is pinned to a version that may be retiring or set to auto-upgrade, `skuName` gives the deployment type (for example \"Standard\", \"GlobalStandard\", or \"ProvisionedManaged\") and `skuCapacity`/`currentCapacity` the provisioned throughput, `raiPolicyName` (resolved by `raiPolicy`) the content-filter policy applied to the model, `dynamicThrottlingEnabled` automatic throughput throttling, and `capabilities` the model's advertised features.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"deployments":{"name":"deployments","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.deployment","title":"Model deployments hosted on the account","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether API-key (local) authentication is disabled, leaving Microsoft Entra ID as the only method","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionScope":{"name":"encryptionScope","type":"\u001bazure.subscription.cognitiveServicesService.account.encryptionScope","title":"Encryption scope on an Azure AI Services account","desc":"Customer-managed encryption applied to a subset of the account's data rather than the whole account, selected by `name`. Where the account's own cmkKeySource governs everything it holds, an encryption scope lets one account serve data protected by different keys, so a scope's `state` and `keySource` decide whether the data inside it is customer-encrypted at all.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"encryptionScopes":{"name":"encryptionScopes","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.encryptionScope","title":"Encryption scopes configured on the account","min_provider_version":"13.33.6","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpoint":{"name":"endpoint","type":"\u0007","is_mandatory":true,"title":"The endpoint URL of the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Account resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Identity configuration (SystemAssigned, UserAssigned, principalId, tenantId)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipRules":{"name":"ipRules","type":"\u0019\u0007","is_mandatory":true,"title":"IP address or CIDR rules in the network rule set allowed to reach the account","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kind of AI service the account exposes (e.g., \"OpenAI\", \"SpeechServices\", \"CognitiveServices\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Account location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"model":{"name":"model","type":"\u001bazure.subscription.cognitiveServicesService.account.model","title":"Model in an Azure AI Services account catalog","desc":"Single model version the account can serve, selected by `name` and `version`. This is the catalog entry a deployment's modelName and modelVersion point at, and it is where the model's retirement schedule lives: `lifecycleStatus` reports whether the version is generally available, deprecating, or already deprecated, `inferenceDeprecationDate` the date inference calls against it stop working, and the replacement fields the version Azure upgrades to. `isDefaultVersion` marks the version a deployment gets when it names no version at all.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"models":{"name":"models","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.model","title":"Models the account can serve, with their retirement schedule","desc":"The catalog of models available to this account, which is what gives a deployment's modelName and modelVersion their meaning. Each entry carries its lifecycle status and the date inference on it stops working, so a deployment pinned to a version can be checked against the date that version retires.","min_provider_version":"13.33.6","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"multiRegionRoutingMethod":{"name":"multiRegionRoutingMethod","type":"\u0007","is_mandatory":true,"title":"Routing method used across the configured regions (e.g., \"Priority\", \"Weighted\", \"Performance\")","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"multiRegionSettings":{"name":"multiRegionSettings","type":"\u0019\n","is_mandatory":true,"title":"Per-region settings for multi-region deployments, each with a name, routing value, and optional customSubDomain","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Account name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkAcls":{"name":"networkAcls","type":"\n","is_mandatory":true,"title":"Network rule set: default action, IP rules, virtual-network rules, and trusted-service bypass","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkAclsBypass":{"name":"networkAclsBypass","type":"\u0007","is_mandatory":true,"title":"Trusted-service bypass for the network rule set (\"AzureServices\" or \"None\")","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkAclsDefaultAction":{"name":"networkAclsDefaultAction","type":"\u0007","is_mandatory":true,"title":"Action applied when no IP or virtual-network rule matches (\"Allow\" or \"Deny\"); \"Deny\" denies public traffic by default","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkInjection":{"name":"networkInjection","type":"\u001bazure.subscription.cognitiveServicesService.account.networkInjection","title":"Virtual-network injection of an Azure AI Services account","desc":"A single virtual-network injection setting, which places the account's agents or compute into a customer subnet. The `id` field is the injected subnet resource ID; `subnet` resolves it to the typed subnet.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"networkInjections":{"name":"networkInjections","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.networkInjection","is_mandatory":true,"title":"Virtual-network injection settings for the account's agents and compute","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections to the account","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"project":{"name":"project","type":"\u001bazure.subscription.cognitiveServicesService.account.project","title":"Azure AI Foundry project","desc":"Single Azure AI Foundry project, a workspace under an AI Services account that scopes agents, deployments, and connections for a team or application, selected by `name`. `isDefault` identifies the account's default project, `displayName` and `description` carry the human-facing labels, `endpoints` holds the project's data-plane URLs, and `connections` lists the project-scoped links to model providers, data sources, and tool (MCP) servers an agent can reach.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"projects":{"name":"projects","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.project","title":"Azure AI Foundry projects hosted on the account","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether the account is reachable from the public internet (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"raiBlocklist":{"name":"raiBlocklist","type":"\u001bazure.subscription.cognitiveServicesService.account.raiBlocklist","title":"Custom blocklist on an Azure AI Services account","desc":"Named list of words and patterns the account's content filters block, selected by `name`. A Responsible AI policy references a blocklist to extend Azure's built-in filtering with terms specific to the tenant, and `items` returns the entries the list holds.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"raiBlocklists":{"name":"raiBlocklists","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.raiBlocklist","title":"Custom word and pattern blocklists registered on the account","min_provider_version":"13.33.6","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"raiMonitorAdxStorageResourceId":{"name":"raiMonitorAdxStorageResourceId","type":"\u0007","is_mandatory":true,"title":"Azure Data Explorer resource ID where responsible-AI monitoring logs are shipped","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"raiMonitorIdentityClientId":{"name":"raiMonitorIdentityClientId","type":"\u0007","is_mandatory":true,"title":"Client ID of the managed identity used to write responsible-AI monitoring logs","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"raiPolicies":{"name":"raiPolicies","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.raiPolicy","title":"Responsible AI content-filter policies configured on the account","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"raiPolicy":{"name":"raiPolicy","type":"\u001bazure.subscription.cognitiveServicesService.account.raiPolicy","title":"Responsible AI content-filter policy on a Cognitive Services account","desc":"Responsible AI policy covering the filter mode, the content filters it enforces (per category and source), the custom blocklists it references, and the custom RAI topics it applies. Audit this to see which accounts have content filtering active, whether filters block or only warn, and at what severity threshold each category trips.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"raiTopic":{"name":"raiTopic","type":"\u001bazure.subscription.cognitiveServicesService.account.raiTopic","title":"Responsible AI custom topic on a Cognitive Services account","desc":"Custom RAI topic and its lifecycle: status, sample data location, creation/last-modified times, and a failure reason when the topic has failed to train. Topics referenced by an [[azure.subscription.cognitiveServicesService.account.raiPolicy]] add custom blocked-content detection beyond the built-in categories.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"raiTopics":{"name":"raiTopics","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.raiTopic","title":"Responsible AI custom topics registered on the account","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"restrictOutboundNetworkAccess":{"name":"restrictOutboundNetworkAccess","type":"\u0004","is_mandatory":true,"title":"Whether outbound network access is restricted to the allowed FQDN list, limiting data exfiltration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleAssignments":{"name":"roleAssignments","type":"\u0019\u001bazure.subscription.authorizationService.roleAssignment","title":"Microsoft Entra role assignments granting access to the account","desc":"The effective role assignments at the account scope, including those inherited from the resource group, subscription, and management-group ancestors. Combined with disableLocalAuth (API-key authentication), this answers who can call and administer the account through Entra RBAC (for example who holds Cognitive Services User or Cognitive Services Contributor).","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"SKU details (e.g., name \"S0\", \"F0\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storedCompletionsDisabled":{"name":"storedCompletionsDisabled","type":"\u0004","is_mandatory":true,"title":"Whether stored completions (request/response logging used for fine-tuning and evaluation) are disabled","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Account tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userOwnedStorage":{"name":"userOwnedStorage","type":"\u001bazure.subscription.cognitiveServicesService.account.userOwnedStorage","title":"Customer-owned storage attached to an Azure AI Services account","desc":"A storage account the AI service persists data into (uploads, batch inputs, fine-tuning data). The `id` field is the storage account resource ID; `storageAccount` resolves it to the typed storage account.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"userOwnedStorageAccounts":{"name":"userOwnedStorageAccounts","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.userOwnedStorage","is_mandatory":true,"title":"Customer-owned storage accounts where the service persists data","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkRule":{"name":"virtualNetworkRule","type":"\u001bazure.subscription.cognitiveServicesService.account.virtualNetworkRule","title":"Virtual-network rule of an Azure AI Services account","desc":"A single virtual-network rule from the account's network rule set, allowing traffic from one subnet. The `id` field is the subnet resource ID; `subnet` resolves it to the typed subnet so its address space and service endpoints can be audited.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualNetworkRules":{"name":"virtualNetworkRules","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.virtualNetworkRule","is_mandatory":true,"title":"Virtual-network rules in the network rule set, each allowing a subnet to reach the account","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure AI Services account","desc":"Single Azure AI Services account, the resource that exposes one or more AI APIs identified by `kind` (for example \"OpenAI\", \"SpeechServices\", or \"CognitiveServices\"). `publicNetworkAccess` reports whether the account is reachable from the public internet, `networkAcls` holds the IP and virtual-network firewall rules, `disableLocalAuth` reports whether API-key authentication is turned off in favor of Microsoft Entra ID, `restrictOutboundNetworkAccess` covers data-exfiltration controls, `cmkKeyName` and `cmkKeyVaultUri` describe the customer-managed key encrypting the account, and `customSubDomainName` is the subdomain required by token-based authentication and private endpoints.","min_provider_version":"13.11.3","defaults":"id name location kind publicNetworkAccess","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.capabilityHost":{"id":"azure.subscription.cognitiveServicesService.account.capabilityHost","name":"azure.subscription.cognitiveServicesService.account.capabilityHost","fields":{"aiServicesConnections":{"name":"aiServicesConnections","type":"\u0019\u0007","is_mandatory":true,"title":"Connections to the AI Services accounts the agents call models on","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"customerSubnet":{"name":"customerSubnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet the agents' compute is injected into","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"customerSubnetId":{"name":"customerSubnetId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the subnet the agents' compute is injected into","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the capability host","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Capability host resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"What the capability host serves","desc":"\"Agents\" is the only kind currently defined.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Capability host name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the capability host","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageConnections":{"name":"storageConnections","type":"\u0019\u0007","is_mandatory":true,"title":"Connections holding files the agents read and write","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Capability host tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"threadStorageConnections":{"name":"threadStorageConnections","type":"\u0019\u0007","is_mandatory":true,"title":"Connections holding the agents' conversation threads","desc":"Each entry names a connection on the account or project, typically to a Cosmos DB account. Empty when threads stay in Microsoft-managed storage.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vectorStoreConnections":{"name":"vectorStoreConnections","type":"\u0019\u0007","is_mandatory":true,"title":"Connections holding the agents' vector indexes, typically to an AI Search service","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Capability host of an Azure AI Services account or project","desc":"Storage backing the account's or project's agents, selected by `name`. Agents keep conversation threads, uploaded files, and vector indexes somewhere, and a capability host is what points that storage at resources the tenant owns instead of Microsoft-managed defaults. `threadStorageConnections`, `storageConnections`, and `vectorStoreConnections` name the connections holding each, so the underlying Cosmos DB account, Storage account, or AI Search service can be audited as the store of the agents' conversation data. `customerSubnet` places the agents' compute in a tenant-owned subnet.","private":true,"min_provider_version":"13.33.6","defaults":"name kind provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.connection":{"id":"azure.subscription.cognitiveServicesService.account.connection","name":"azure.subscription.cognitiveServicesService.account.connection","fields":{"authType":{"name":"authType","type":"\u0007","is_mandatory":true,"title":"Authentication type","desc":"One of \"AAD\", \"ApiKey\", \"AccessKey\", \"AccountKey\", \"CustomKeys\", \"ManagedIdentity\", \"None\", \"OAuth2\", \"PAT\", \"SAS\", \"ServicePrincipal\", or \"UsernamePassword\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"What the connection points to","desc":"Examples include \"AzureOpenAI\", \"OpenAI\", \"Serverless\", \"ManagedOnlineEndpoint\", \"CognitiveSearch\", \"CognitiveService\", \"ApiKey\", and \"CustomKeys\" (the category used for Model Context Protocol tool servers).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"error":{"name":"error","type":"\u0007","is_mandatory":true,"title":"Error message when the connection is in a failed state; empty when healthy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expiryTime":{"name":"expiryTime","type":"\t","is_mandatory":true,"title":"When the connection's credentials expire (null when they do not expire)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"Connection grouping by category (\"Azure\", \"AzureAI\", \"Database\", \"File\", \"GenericProtocol\", \"NoSQL\", or \"ServicesAndApps\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connection resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isSharedToAll":{"name":"isSharedToAll","type":"\u0004","is_mandatory":true,"title":"Whether the connection is shared with every member of the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Connection-specific metadata; for MCP connections this carries the server label and URL","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peRequirement":{"name":"peRequirement","type":"\u0007","is_mandatory":true,"title":"Private-endpoint requirement (\"Required\", \"NotRequired\", or \"NotApplicable\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peStatus":{"name":"peStatus","type":"\u0007","is_mandatory":true,"title":"Private-endpoint status (\"Active\", \"Inactive\", or \"NotApplicable\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"Endpoint URL the connection targets","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"useWorkspaceManagedIdentity":{"name":"useWorkspaceManagedIdentity","type":"\u0004","is_mandatory":true,"title":"Whether the connection authenticates using the workspace managed identity","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Connection on an Azure AI Services account","desc":"Single account-scoped connection, the link (shared across the account's projects) used to reach an external resource, identified by `name`. `category` shows what the connection points to (for example \"AzureOpenAI\", \"CognitiveSearch\", \"Serverless\", \"ManagedOnlineEndpoint\", or \"CustomKeys\", the category used for Model Context Protocol tool servers), `target` gives the endpoint URL, `authType` how the connection authenticates, `isSharedToAll` whether every member can use it, `useWorkspaceManagedIdentity` managed-identity access, `peRequirement`/`peStatus` private-endpoint posture, and `metadata` connection-specific settings (an MCP connection records its server label and URL here).","private":true,"min_provider_version":"13.15.2","defaults":"name category authType target","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.deployment":{"id":"azure.subscription.cognitiveServicesService.account.deployment","name":"azure.subscription.cognitiveServicesService.account.deployment","fields":{"capabilities":{"name":"capabilities","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Advertised model capabilities, keyed by capability name (e.g., \"chatCompletion\", \"jsonObjectResponse\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"currentCapacity":{"name":"currentCapacity","type":"\u0005","is_mandatory":true,"title":"Currently active capacity, which may differ from skuCapacity shortly after a capacity change","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dynamicThrottlingEnabled":{"name":"dynamicThrottlingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether dynamic throttling is enabled, letting the service smooth bursts above the provisioned rate","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Deployment resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"model":{"name":"model","type":"\u001bazure.subscription.cognitiveServicesService.account.model","title":"Catalog entry for the model version the deployment serves","desc":"Resolves modelName and modelVersion against the account's model catalog, which is where the retirement schedule for the served version lives. When modelVersion is empty the deployment tracks the model's default version and this resolves to that version. Null when the served model is not in the account's catalog, as with a fine-tuned or custom deployment.","min_provider_version":"13.33.6","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"modelFormat":{"name":"modelFormat","type":"\u0007","is_mandatory":true,"title":"Model family format (e.g., \"OpenAI\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"modelName":{"name":"modelName","type":"\u0007","is_mandatory":true,"title":"Model name being served (e.g., \"gpt-4o\", \"text-embedding-3-large\", \"dall-e-3\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"modelPublisher":{"name":"modelPublisher","type":"\u0007","is_mandatory":true,"title":"Model publisher; empty for first-party Azure OpenAI models","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"modelSource":{"name":"modelSource","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the source model for fine-tuned or custom deployments; empty for catalog models","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"modelVersion":{"name":"modelVersion","type":"\u0007","is_mandatory":true,"title":"Model version being served (e.g., \"2024-11-20\"); empty when the account uses the model's default version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Deployment name, used by clients as the model identifier in API calls","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the deployment (e.g., \"Succeeded\", \"Creating\", \"Failed\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"raiPolicy":{"name":"raiPolicy","type":"\u001bazure.subscription.cognitiveServicesService.account.raiPolicy","title":"Responsible AI content-filter policy applied to the deployment (null when none is attached)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"raiPolicyName":{"name":"raiPolicyName","type":"\u0007","is_mandatory":true,"title":"Name of the Responsible AI content-filter policy applied to the deployment; empty when none is attached","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuCapacity":{"name":"skuCapacity","type":"\u0005","is_mandatory":true,"title":"Provisioned capacity for the deployment (throughput units for Standard SKUs, PTUs for provisioned SKUs)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"Deployment type controlling how capacity is allocated and billed","desc":"Common values include \"Standard\", \"GlobalStandard\", \"DataZoneStandard\", \"ProvisionedManaged\", and \"GlobalProvisionedManaged\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Deployment tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"versionUpgradeOption":{"name":"versionUpgradeOption","type":"\u0007","is_mandatory":true,"title":"Version upgrade behavior","desc":"One of \"NoAutoUpgrade\" (pinned to modelVersion), \"OnceCurrentVersionExpired\" (upgrades only when the version retires), or \"OnceNewDefaultVersionAvailable\" (auto-upgrades to each new default).","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Model deployment on an Azure AI Services account","desc":"Single model deployment, the concrete model an application calls through the account, identified by `name` (for example `azure.subscription.cognitiveServices.accounts.where(kind == \"OpenAI\")[0].deployments.where(name == \"gpt-4o\")`). `modelName` and `modelVersion` confirm which model and version is served (and `modelFormat`/`modelPublisher` for non-OpenAI models), `versionUpgradeOption` reports whether the deployment is pinned to a version that may be retiring or set to auto-upgrade, `skuName` gives the deployment type (for example \"Standard\", \"GlobalStandard\", or \"ProvisionedManaged\") and `skuCapacity`/`currentCapacity` the provisioned throughput, `raiPolicyName` (resolved by `raiPolicy`) the content-filter policy applied to the model, `dynamicThrottlingEnabled` automatic throughput throttling, and `capabilities` the model's advertised features.","min_provider_version":"13.15.2","defaults":"name modelName modelVersion skuName versionUpgradeOption","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.encryptionScope":{"id":"azure.subscription.cognitiveServicesService.account.encryptionScope","name":"azure.subscription.cognitiveServicesService.account.encryptionScope","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"ETag used for concurrency control on updates","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Encryption scope resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyIdentityClientId":{"name":"keyIdentityClientId","type":"\u0007","is_mandatory":true,"title":"Client ID of the managed identity used to reach the customer-managed key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keySource":{"name":"keySource","type":"\u0007","is_mandatory":true,"title":"Encryption key source","desc":"\"Microsoft.KeyVault\" when a customer-managed key protects the scope, \"Microsoft.CognitiveServices\" for platform-managed keys.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultKeyName":{"name":"keyVaultKeyName","type":"\u0007","is_mandatory":true,"title":"Name of the customer-managed Key Vault key protecting the scope","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultKeyVersion":{"name":"keyVaultKeyVersion","type":"\u0007","is_mandatory":true,"title":"Version of the customer-managed key; empty when the scope tracks the latest version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultUri":{"name":"keyVaultUri","type":"\u0007","is_mandatory":true,"title":"URI of the Key Vault holding the customer-managed key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Scope name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the scope","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Whether the scope is active","desc":"One of \"Enabled\" or \"Disabled\". A disabled scope leaves the data it covers on the account's own encryption settings.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Scope tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Encryption scope on an Azure AI Services account","desc":"Customer-managed encryption applied to a subset of the account's data rather than the whole account, selected by `name`. Where the account's own cmkKeySource governs everything it holds, an encryption scope lets one account serve data protected by different keys, so a scope's `state` and `keySource` decide whether the data inside it is customer-encrypted at all.","private":true,"min_provider_version":"13.33.6","defaults":"name state keySource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.model":{"id":"azure.subscription.cognitiveServicesService.account.model","name":"azure.subscription.cognitiveServicesService.account.model","fields":{"capabilities":{"name":"capabilities","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Advertised model capabilities, keyed by capability name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"catalogAssetId":{"name":"catalogAssetId","type":"\u0007","is_mandatory":true,"title":"Identifier of the model in the Azure AI model catalog","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deprecationStatus":{"name":"deprecationStatus","type":"\u0007","is_mandatory":true,"title":"How firm the published retirement date is","desc":"One of \"Planned\" or \"Tentative\". Empty when no retirement is scheduled.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fineTuneDeprecationDate":{"name":"fineTuneDeprecationDate","type":"\t","is_mandatory":true,"title":"Date fine-tuning on this version stops being accepted","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"finetuneCapabilities":{"name":"finetuneCapabilities","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Capabilities available when fine-tuning the model","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"format":{"name":"format","type":"\u0007","is_mandatory":true,"title":"Model family format (e.g., \"OpenAI\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inferenceDeprecationDate":{"name":"inferenceDeprecationDate","type":"\t","is_mandatory":true,"title":"Date inference requests against this version stop being served","desc":"Null when no inference retirement date is published. A deployment pinned to this version with versionUpgradeOption \"NoAutoUpgrade\" stops working on this date rather than moving to the replacement.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isDefaultVersion":{"name":"isDefaultVersion","type":"\u0004","is_mandatory":true,"title":"Whether this is the version a deployment serves when it names no version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lifecycleStatus":{"name":"lifecycleStatus","type":"\u0007","is_mandatory":true,"title":"Lifecycle status of the version","desc":"One of \"GenerallyAvailable\", \"Deprecating\" (a retirement date is set), or \"Deprecated\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxCapacity":{"name":"maxCapacity","type":"\u0005","is_mandatory":true,"title":"Maximum capacity a single deployment of this version may provision","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Model name (e.g., \"gpt-4o\", \"text-embedding-3-large\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publisher":{"name":"publisher","type":"\u0007","is_mandatory":true,"title":"Model publisher; empty for first-party Azure OpenAI models","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacementAutoUpgradeStartDate":{"name":"replacementAutoUpgradeStartDate","type":"\t","is_mandatory":true,"title":"Date Azure begins auto-upgrading deployments of this version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacementModelName":{"name":"replacementModelName","type":"\u0007","is_mandatory":true,"title":"Name of the model version Azure upgrades this version to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacementModelVersion":{"name":"replacementModelVersion","type":"\u0007","is_mandatory":true,"title":"Version Azure upgrades this version to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacementUpgradeOnExpiryLeadTimeDays":{"name":"replacementUpgradeOnExpiryLeadTimeDays","type":"\u0005","is_mandatory":true,"title":"Days before expiry that Azure upgrades a deployment set to upgrade on expiry","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skus":{"name":"skus","type":"\u0019\n","is_mandatory":true,"title":"Deployment SKUs the version can be served on","desc":"Each entry carries the SKU `name`, its `usageName`, the `capacity` configuration (minimum, maximum, step, and default), the `rateLimits` enforced on it, and a `deprecationDate` when that SKU is retiring independently of the model.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Model version (e.g., \"2024-11-20\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Model in an Azure AI Services account catalog","desc":"Single model version the account can serve, selected by `name` and `version`. This is the catalog entry a deployment's modelName and modelVersion point at, and it is where the model's retirement schedule lives: `lifecycleStatus` reports whether the version is generally available, deprecating, or already deprecated, `inferenceDeprecationDate` the date inference calls against it stop working, and the replacement fields the version Azure upgrades to. `isDefaultVersion` marks the version a deployment gets when it names no version at all.","private":true,"min_provider_version":"13.33.6","defaults":"name version lifecycleStatus inferenceDeprecationDate","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.networkInjection":{"id":"azure.subscription.cognitiveServicesService.account.networkInjection","name":"azure.subscription.cognitiveServicesService.account.networkInjection","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID of the subnet injected into the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scenario":{"name":"scenario","type":"\u0007","is_mandatory":true,"title":"Injection scenario (for example \"agent\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet injected into the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"useMicrosoftManagedNetwork":{"name":"useMicrosoftManagedNetwork","type":"\u0004","is_mandatory":true,"title":"Whether the Microsoft-managed network is used instead of the injected subnet","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Virtual-network injection of an Azure AI Services account","desc":"A single virtual-network injection setting, which places the account's agents or compute into a customer subnet. The `id` field is the injected subnet resource ID; `subnet` resolves it to the typed subnet.","private":true,"min_provider_version":"13.31.1","defaults":"id scenario","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.project":{"id":"azure.subscription.cognitiveServicesService.account.project","name":"azure.subscription.cognitiveServicesService.account.project","fields":{"capabilityHosts":{"name":"capabilityHosts","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.capabilityHost","title":"Capability hosts backing the project's agents","min_provider_version":"13.33.6","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connection":{"name":"connection","type":"\u001bazure.subscription.cognitiveServicesService.account.project.connection","title":"Connection on an Azure AI Foundry project","desc":"Single project-scoped connection, the link an agent or application uses to reach an external resource, identified by `name`. `category` shows what the connection points to (for example \"AzureOpenAI\", \"CognitiveSearch\", \"Serverless\", \"ManagedOnlineEndpoint\", or \"CustomKeys\", the category used for Model Context Protocol tool servers), `target` gives the endpoint URL, `authType` how the connection authenticates, `isSharedToAll` whether every member can use it, `useWorkspaceManagedIdentity` managed-identity access, `peRequirement`/`peStatus` private-endpoint posture, and `metadata` connection-specific settings (an MCP connection records its server label and URL here).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"connections":{"name":"connections","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.project.connection","title":"Project-scoped connections to external resources, model providers, data sources, and tool servers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Project description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Human-facing display name of the project","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpoints":{"name":"endpoints","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Data-plane endpoint URLs for the project, keyed by endpoint name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Project resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Identity configuration (SystemAssigned, UserAssigned, principalId, tenantId)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether this is the account's default project","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Project location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Project name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the project (e.g., \"Succeeded\", \"Creating\", \"Failed\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Project tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure AI Foundry project","desc":"Single Azure AI Foundry project, a workspace under an AI Services account that scopes agents, deployments, and connections for a team or application, selected by `name`. `isDefault` identifies the account's default project, `displayName` and `description` carry the human-facing labels, `endpoints` holds the project's data-plane URLs, and `connections` lists the project-scoped links to model providers, data sources, and tool (MCP) servers an agent can reach.","min_provider_version":"13.15.2","defaults":"name displayName isDefault provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.project.connection":{"id":"azure.subscription.cognitiveServicesService.account.project.connection","name":"azure.subscription.cognitiveServicesService.account.project.connection","fields":{"authType":{"name":"authType","type":"\u0007","is_mandatory":true,"title":"Authentication type","desc":"One of \"AAD\", \"ApiKey\", \"AccessKey\", \"AccountKey\", \"CustomKeys\", \"ManagedIdentity\", \"None\", \"OAuth2\", \"PAT\", \"SAS\", \"ServicePrincipal\", or \"UsernamePassword\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"What the connection points to","desc":"Examples include \"AzureOpenAI\", \"OpenAI\", \"Serverless\", \"ManagedOnlineEndpoint\", \"CognitiveSearch\", \"CognitiveService\", \"ApiKey\", and \"CustomKeys\" (the category used for Model Context Protocol tool servers).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"error":{"name":"error","type":"\u0007","is_mandatory":true,"title":"Error message when the connection is in a failed state; empty when healthy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expiryTime":{"name":"expiryTime","type":"\t","is_mandatory":true,"title":"When the connection's credentials expire (null when they do not expire)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"Connection grouping by category (\"Azure\", \"AzureAI\", \"Database\", \"File\", \"GenericProtocol\", \"NoSQL\", or \"ServicesAndApps\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connection resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isSharedToAll":{"name":"isSharedToAll","type":"\u0004","is_mandatory":true,"title":"Whether the connection is shared with every member of the project","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Connection-specific metadata; for MCP connections this carries the server label and URL","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peRequirement":{"name":"peRequirement","type":"\u0007","is_mandatory":true,"title":"Private-endpoint requirement (\"Required\", \"NotRequired\", or \"NotApplicable\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peStatus":{"name":"peStatus","type":"\u0007","is_mandatory":true,"title":"Private-endpoint status (\"Active\", \"Inactive\", or \"NotApplicable\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"Endpoint URL the connection targets","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"useWorkspaceManagedIdentity":{"name":"useWorkspaceManagedIdentity","type":"\u0004","is_mandatory":true,"title":"Whether the connection authenticates using the workspace managed identity","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Connection on an Azure AI Foundry project","desc":"Single project-scoped connection, the link an agent or application uses to reach an external resource, identified by `name`. `category` shows what the connection points to (for example \"AzureOpenAI\", \"CognitiveSearch\", \"Serverless\", \"ManagedOnlineEndpoint\", or \"CustomKeys\", the category used for Model Context Protocol tool servers), `target` gives the endpoint URL, `authType` how the connection authenticates, `isSharedToAll` whether every member can use it, `useWorkspaceManagedIdentity` managed-identity access, `peRequirement`/`peStatus` private-endpoint posture, and `metadata` connection-specific settings (an MCP connection records its server label and URL here).","private":true,"min_provider_version":"13.15.2","defaults":"name category authType target","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.raiBlocklist":{"id":"azure.subscription.cognitiveServicesService.account.raiBlocklist","name":"azure.subscription.cognitiveServicesService.account.raiBlocklist","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the blocklist","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"ETag used for concurrency control on updates","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Blocklist resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"item":{"name":"item","type":"\u001bazure.subscription.cognitiveServicesService.account.raiBlocklist.item","title":"Entry in an Azure AI Services account blocklist","desc":"Single blocked term, selected by `name`. `pattern` is the term itself and `isRegex` reports whether it is matched as a regular expression rather than a literal string.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"items":{"name":"items","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.raiBlocklist.item","title":"Words and patterns the blocklist holds","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Blocklist name, used as the selection key and referenced by policies","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Blocklist tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Custom blocklist on an Azure AI Services account","desc":"Named list of words and patterns the account's content filters block, selected by `name`. A Responsible AI policy references a blocklist to extend Azure's built-in filtering with terms specific to the tenant, and `items` returns the entries the list holds.","private":true,"min_provider_version":"13.33.6","defaults":"name description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.raiBlocklist.item":{"id":"azure.subscription.cognitiveServicesService.account.raiBlocklist.item","name":"azure.subscription.cognitiveServicesService.account.raiBlocklist.item","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Blocklist item resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isRegex":{"name":"isRegex","type":"\u0004","is_mandatory":true,"title":"Whether the pattern is matched as a regular expression","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Item name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pattern":{"name":"pattern","type":"\u0007","is_mandatory":true,"title":"Word or regular expression the filter blocks","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Entry in an Azure AI Services account blocklist","desc":"Single blocked term, selected by `name`. `pattern` is the term itself and `isRegex` reports whether it is matched as a regular expression rather than a literal string.","private":true,"min_provider_version":"13.33.6","defaults":"name pattern isRegex","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.raiPolicy":{"id":"azure.subscription.cognitiveServicesService.account.raiPolicy","name":"azure.subscription.cognitiveServicesService.account.raiPolicy","fields":{"basePolicyName":{"name":"basePolicyName","type":"\u0007","is_mandatory":true,"title":"Base policy this one inherits from; empty when not inheriting","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"contentFilter":{"name":"contentFilter","type":"\u001bazure.subscription.cognitiveServicesService.account.raiPolicy.contentFilter","title":"Content filter on a Responsible AI policy","desc":"Single content-filter rule keyed by content category and source. Each rule describes which severity threshold trips the filter, whether the filter is active, and whether matches block the request or only flag it. Audit queries typically scope by (name, source) to confirm coverage of sensitive categories.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"contentFilters":{"name":"contentFilters","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.raiPolicy.contentFilter","is_mandatory":true,"title":"Content filters configured on the policy, one per (category × source)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"customBlocklists":{"name":"customBlocklists","type":"\u0019\n","is_mandatory":true,"title":"Custom blocklist references. Each entry has {blocklistName, source, blocking}.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"customTopics":{"name":"customTopics","type":"\u0019\u001bazure.subscription.cognitiveServicesService.account.raiPolicy.topicRef","is_mandatory":true,"title":"Custom RAI topic references attached to the policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Filter mode: \"Default\", \"Deferred\", \"Blocking\", or \"Asynchronous_filter\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyType":{"name":"policyType","type":"\u0007","is_mandatory":true,"title":"Policy type: \"UserManaged\" or \"SystemManaged\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"topicRef":{"name":"topicRef","type":"\u001bazure.subscription.cognitiveServicesService.account.raiPolicy.topicRef","title":"Custom RAI topic reference on a Responsible AI policy","desc":"Link between a policy and a custom topic registered on the same account. Carries the per-attachment scalars (source the topic applies to, whether matches block) and resolves to the underlying [[azure.subscription.cognitiveServicesService.account.raiTopic]].","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true}},"title":"Responsible AI content-filter policy on a Cognitive Services account","desc":"Responsible AI policy covering the filter mode, the content filters it enforces (per category and source), the custom blocklists it references, and the custom RAI topics it applies. Audit this to see which accounts have content filtering active, whether filters block or only warn, and at what severity threshold each category trips.","private":true,"min_provider_version":"13.12.2","defaults":"name mode policyType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.raiPolicy.contentFilter":{"id":"azure.subscription.cognitiveServicesService.account.raiPolicy.contentFilter","name":"azure.subscription.cognitiveServicesService.account.raiPolicy.contentFilter","fields":{"blocking":{"name":"blocking","type":"\u0004","is_mandatory":true,"title":"Whether matches block the request; when false, matches are only flagged","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the filter is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Content category name (e.g., \"Hate\", \"Sexual\", \"Violence\", \"Selfharm\", \"Jailbreak\", \"ProtectedMaterialText\", \"ProtectedMaterialCode\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"severityThreshold":{"name":"severityThreshold","type":"\u0007","is_mandatory":true,"title":"Severity level at which the filter trips (\"Low\", \"Medium\", or \"High\"); empty when not set","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Where the filter applies: \"Prompt\" (user input) or \"Completion\" (model output)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Content filter on a Responsible AI policy","desc":"Single content-filter rule keyed by content category and source. Each rule describes which severity threshold trips the filter, whether the filter is active, and whether matches block the request or only flag it. Audit queries typically scope by (name, source) to confirm coverage of sensitive categories.","private":true,"min_provider_version":"13.12.2","defaults":"name source enabled blocking severityThreshold","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.raiPolicy.topicRef":{"id":"azure.subscription.cognitiveServicesService.account.raiPolicy.topicRef","name":"azure.subscription.cognitiveServicesService.account.raiPolicy.topicRef","fields":{"blocking":{"name":"blocking","type":"\u0004","is_mandatory":true,"title":"Whether matches block the request","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Where the topic filter applies: \"Prompt\" or \"Completion\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"topic":{"name":"topic","type":"\u001bazure.subscription.cognitiveServicesService.account.raiTopic","title":"The referenced custom topic on the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"topicName":{"name":"topicName","type":"\u0007","is_mandatory":true,"title":"Name of the custom topic","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Custom RAI topic reference on a Responsible AI policy","desc":"Link between a policy and a custom topic registered on the same account. Carries the per-attachment scalars (source the topic applies to, whether matches block) and resolves to the underlying [[azure.subscription.cognitiveServicesService.account.raiTopic]].","private":true,"min_provider_version":"13.12.2","defaults":"topicName source blocking","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.raiTopic":{"id":"azure.subscription.cognitiveServicesService.account.raiTopic","name":"azure.subscription.cognitiveServicesService.account.raiTopic","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the topic was created","desc":"Deprecated in favor of creationTime.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the topic was created","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the custom topic","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"failedReason":{"name":"failedReason","type":"\u0007","is_mandatory":true,"title":"Reason the topic is in a failed state; empty when not failed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedAt":{"name":"lastModifiedAt","type":"\t","is_mandatory":true,"title":"When the topic was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sampleBlobUrl":{"name":"sampleBlobUrl","type":"\u0007","is_mandatory":true,"title":"URL of the sample blob used to train the topic","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Lifecycle status of the topic (e.g., \"Succeeded\", \"Failed\", \"Running\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"topicId":{"name":"topicId","type":"\u0007","is_mandatory":true,"title":"Stable identifier of the custom topic","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"topicName":{"name":"topicName","type":"\u0007","is_mandatory":true,"title":"Custom topic name (the policy-facing identifier)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Responsible AI custom topic on a Cognitive Services account","desc":"Custom RAI topic and its lifecycle: status, sample data location, creation/last-modified times, and a failure reason when the topic has failed to train. Topics referenced by an [[azure.subscription.cognitiveServicesService.account.raiPolicy]] add custom blocked-content detection beyond the built-in categories.","private":true,"min_provider_version":"13.12.2","defaults":"name status topicName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.userOwnedStorage":{"id":"azure.subscription.cognitiveServicesService.account.userOwnedStorage","name":"azure.subscription.cognitiveServicesService.account.userOwnedStorage","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID of the customer-owned storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityClientId":{"name":"identityClientId","type":"\u0007","is_mandatory":true,"title":"Client ID of the managed identity used to access the storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAccount":{"name":"storageAccount","type":"\u001bazure.subscription.storageService.account","title":"Storage account where the service persists data","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Customer-owned storage attached to an Azure AI Services account","desc":"A storage account the AI service persists data into (uploads, batch inputs, fine-tuning data). The `id` field is the storage account resource ID; `storageAccount` resolves it to the typed storage account.","private":true,"min_provider_version":"13.31.1","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cognitiveServicesService.account.virtualNetworkRule":{"id":"azure.subscription.cognitiveServicesService.account.virtualNetworkRule","name":"azure.subscription.cognitiveServicesService.account.virtualNetworkRule","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID of the subnet allowed to reach the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ignoreMissingVnetServiceEndpoint":{"name":"ignoreMissingVnetServiceEndpoint","type":"\u0004","is_mandatory":true,"title":"Whether a missing virtual-network service endpoint is ignored","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"State of the virtual-network rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet allowed to reach the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Virtual-network rule of an Azure AI Services account","desc":"A single virtual-network rule from the account's network rule set, allowing traffic from one subnet. The `id` field is the subnet resource ID; `subnet` resolves it to the typed subnet so its address space and service endpoints can be audited.","private":true,"min_provider_version":"13.31.1","defaults":"id state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService":{"id":"azure.subscription.computeService","name":"azure.subscription.computeService","fields":{"dedicatedHost":{"name":"dedicatedHost","type":"\u001bazure.subscription.computeService.dedicatedHost","title":"Azure Dedicated Host","desc":"Physical server reserved for a single tenant inside an Azure Dedicated Host Group. Surfaces the SKU, fault domain, license type, host's auto-replace-on-failure setting, the VMs currently placed on the host, the `instanceView` reporting allocation status and capacity, and the platform-fault-domain assignment.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"dedicatedHostGroup":{"name":"dedicatedHostGroup","type":"\u001bazure.subscription.computeService.dedicatedHostGroup","title":"Azure Dedicated Host Group","desc":"Single-tenant placement scope for Azure Dedicated Hosts. Surfaces the platform-fault-domain count, the supported availability zones, the `supportAutomaticPlacement` flag, and any ultraSSD support exposed by the group. The `hosts` collection lists the individual physical servers reserved through this group.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"dedicatedHostGroups":{"name":"dedicatedHostGroups","type":"\u0019\u001bazure.subscription.computeService.dedicatedHostGroup","title":"All dedicated host groups under a subscription","min_provider_version":"13.7.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disk":{"name":"disk","type":"\u001bazure.subscription.computeService.disk","title":"Azure managed disk","desc":"Managed disk attached to a VM, scale set, or available for attachment. Surfaces the disk SKU and tier, OS type, disk size and IOPS, the disk state (Unattached, Attached, Reserved, ActiveSAS, ReadyToUpload, ActiveUpload), encryption settings (platform-managed, customer-managed via diskEncryptionSet, or double-encryption), network access policy, public network access, the source from which the disk was created, and any attached VM.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"diskAccess":{"name":"diskAccess","type":"\u001bazure.subscription.computeService.diskAccess","title":"Azure disk access resource","desc":"Private-endpoint configuration that managed disks and snapshots can be exported and imported through. Surfaces the `provisioningState`, the `extendedLocation` if the resource lives in an Azure Edge Zone, and the time the access was created and last modified. Disks reference a disk-access by ARM ID through their `networkAccessPolicy` to keep export/import traffic off the public internet.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"diskAccesses":{"name":"diskAccesses","type":"\u0019\u001bazure.subscription.computeService.diskAccess","title":"All disk access resources under a subscription","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskEncryptionSet":{"name":"diskEncryptionSet","type":"\u001bazure.subscription.computeService.diskEncryptionSet","title":"Azure disk encryption set","desc":"Customer-managed key configuration that managed disks and snapshots reference for envelope encryption. Surfaces the `encryptionType` (EncryptionAtRestWithCustomerKey, EncryptionAtRestWithPlatformAndCustomerKeys, or ConfidentialVmEncryptedWithCustomerKey), the active and rotation-to Key Vault key URLs, the system or user-assigned identity used to access the vault, the auto-key-rotation flag, and the federated client ID when one is configured.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"diskEncryptionSets":{"name":"diskEncryptionSets","type":"\u0019\u001bazure.subscription.computeService.diskEncryptionSet","title":"All disk encryption sets under a subscription","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disks":{"name":"disks","type":"\u0019\u001bazure.subscription.computeService.disk","title":"All the disks under a subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"galleries":{"name":"galleries","type":"\u0019\u001bazure.subscription.computeService.gallery","title":"All Compute Galleries (Shared Image Galleries) under a subscription","min_provider_version":"13.7.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"gallery":{"name":"gallery","type":"\u001bazure.subscription.computeService.gallery","title":"Azure Compute Gallery","desc":"Compute Gallery (formerly Shared Image Gallery), the versioned image-distribution scope inside a subscription. Surfaces the gallery description, identifier, the `sharingProfile` (private, community, or groups), the soft-delete state, and the image definitions in the gallery so audits can traverse from gallery to image definition to image version.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"hybridMachine":{"name":"hybridMachine","type":"\u001bazure.subscription.computeService.hybridMachine","title":"Azure Arc-enabled server","desc":"Azure Arc-enabled server (Microsoft.HybridCompute/machines), an on-premises or other-cloud machine projected into Azure for management. Surfaces the agent status (Connected, Disconnected, Expired), agent version, OS name and version, last status check, machine identity, attached extensions, private link scope, and the `cloudMetadata` describing the underlying environment when the machine is hosted on AWS, GCP, VMware, or another cloud.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"hybridMachines":{"name":"hybridMachines","type":"\u0019\u001bazure.subscription.computeService.hybridMachine","title":"All Azure Arc-enabled servers (Microsoft.HybridCompute/machines) under a subscription","min_provider_version":"13.10.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"image":{"name":"image","type":"\u001bazure.subscription.computeService.image","title":"Azure managed image","desc":"Custom VM image stored as a single Azure resource. Surfaces the storage profile (OS disk and data disks), the `hyperVGeneration` (V1 or V2), the source virtual machine the image was generalized from, and the provisioning state. Compute Galleries are the preferred mechanism for versioned image distribution; managed images remain useful for single-resource captures.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"images":{"name":"images","type":"\u0019\u001bazure.subscription.computeService.image","title":"All managed images under a subscription","min_provider_version":"13.7.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"proximityPlacementGroup":{"name":"proximityPlacementGroup","type":"\u001bazure.subscription.computeService.proximityPlacementGroup","title":"Azure Proximity Placement Group","desc":"Co-location scope for Azure compute resources. Surfaces the placement-group type (Standard or Ultra), the supported availability zones, the colocation status, and the lists of VMs, virtual-machine scale sets, and availability sets currently bound to the group so they share low-latency network locality.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"proximityPlacementGroups":{"name":"proximityPlacementGroups","type":"\u0019\u001bazure.subscription.computeService.proximityPlacementGroup","title":"All proximity placement groups under a subscription","min_provider_version":"13.7.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"snapshot":{"name":"snapshot","type":"\u001bazure.subscription.computeService.snapshot","title":"Azure managed disk snapshot","desc":"Point-in-time snapshot of an Azure managed disk. Surfaces the snapshot SKU and tier, OS type, allocated and used size, the `diskState`, the source resource the snapshot was created from, the `incremental` flag (incremental vs full), encryption settings (platform-managed, customer-managed via diskEncryptionSet, or confidential-VM encryption), the network access policy, public network access, the immutability policy protecting it from modification or deletion, and any active SAS export for downloading the underlying VHD.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"snapshots":{"name":"snapshots","type":"\u0019\u001bazure.subscription.computeService.snapshot","title":"All managed disk snapshots under a subscription","min_provider_version":"13.7.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vm":{"name":"vm","type":"\u001bazure.subscription.computeService.vm","title":"Azure virtual machine","desc":"Virtual machine and the security-relevant configuration around it: the VM size, OS profile, storage profile (OS and data disks), network profile and attached network interfaces, identity assignments, applied tags, the availability/zone/proximity-placement-group placement, the boot diagnostics and security profile (TrustedLaunch / ConfidentialVM, SecureBoot, vTPM), the extensions installed on the VM, OS patching state, and the deployed extensions for ASC, Defender, and guest configuration.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"vmScaleSet":{"name":"vmScaleSet","type":"\u001bazure.subscription.computeService.vmScaleSet","title":"Azure Virtual Machine Scale Set","desc":"Virtual Machine Scale Set, the abstraction Azure uses to deploy and manage a group of identical VMs. Surfaces the `orchestrationMode` (Uniform or Flexible), the SKU and capacity, the network and OS profiles applied to instances, upgrade policy (Manual, Automatic, Rolling), automatic-OS-upgrade and rolling upgrade policy, the spot priority and eviction settings, identity assignments, the VM-extension profile, the platform-fault-domain count, and the per-instance `instances` currently provisioned.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"vmScaleSets":{"name":"vmScaleSets","type":"\u0019\u001bazure.subscription.computeService.vmScaleSet","title":"All Virtual Machine Scale Sets under a subscription","min_provider_version":"13.7.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vms":{"name":"vms","type":"\u0019\u001bazure.subscription.computeService.vm","title":"All compute instances under a subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Compute","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.dedicatedHost":{"id":"azure.subscription.computeService.dedicatedHost","name":"azure.subscription.computeService.dedicatedHost","fields":{"autoReplaceOnFailure":{"name":"autoReplaceOnFailure","type":"\u0004","is_mandatory":true,"title":"Whether Azure should replace the host on failure","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostId":{"name":"hostId","type":"\u0007","is_mandatory":true,"title":"Unique ID generated by Azure for the host","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Dedicated host ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"instanceView":{"name":"instanceView","type":"\n","is_mandatory":true,"title":"Instance view (host availability + assets)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"licenseType":{"name":"licenseType","type":"\u0007","is_mandatory":true,"title":"License type (None, WindowsServerHybrid, WindowsServerPerpetual)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Dedicated host location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Dedicated host name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"platformFaultDomain":{"name":"platformFaultDomain","type":"\u0005","is_mandatory":true,"title":"The fault domain of the host within its group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Unmodeled resource properties returned by the Azure API","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningTime":{"name":"provisioningTime","type":"\t","is_mandatory":true,"title":"When the host was first provisioned","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"Dedicated host SKU (name, tier, family)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Dedicated host tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeCreated":{"name":"timeCreated","type":"\t","is_mandatory":true,"title":"When the host was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Dedicated host resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Dedicated Host","desc":"Physical server reserved for a single tenant inside an Azure Dedicated Host Group. Surfaces the SKU, fault domain, license type, host's auto-replace-on-failure setting, the VMs currently placed on the host, the `instanceView` reporting allocation status and capacity, and the platform-fault-domain assignment.","min_provider_version":"13.7.1","defaults":"name sku.name provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.dedicatedHostGroup":{"id":"azure.subscription.computeService.dedicatedHostGroup","name":"azure.subscription.computeService.dedicatedHostGroup","fields":{"additionalCapabilities":{"name":"additionalCapabilities","type":"\n","is_mandatory":true,"title":"Additional capabilities (e.g. UltraSSDEnabled)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hosts":{"name":"hosts","type":"\u0019\u001bazure.subscription.computeService.dedicatedHost","title":"Dedicated hosts in this group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Dedicated host group ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"instanceView":{"name":"instanceView","type":"\n","is_mandatory":true,"title":"Instance view (status of hosts in the group)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Dedicated host group location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Dedicated host group name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"platformFaultDomainCount":{"name":"platformFaultDomainCount","type":"\u0005","is_mandatory":true,"title":"Number of fault domains used by the host group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Unmodeled resource properties returned by the Azure API","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"supportAutomaticPlacement":{"name":"supportAutomaticPlacement","type":"\u0004","is_mandatory":true,"title":"Whether the group supports automatic placement of VMs and scale set instances","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Dedicated host group tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Dedicated host group resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"Availability zones for the dedicated host group (single zone supported)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Dedicated Host Group","desc":"Single-tenant placement scope for Azure Dedicated Hosts. Surfaces the platform-fault-domain count, the supported availability zones, the `supportAutomaticPlacement` flag, and any ultraSSD support exposed by the group. The `hosts` collection lists the individual physical servers reserved through this group.","min_provider_version":"13.7.1","defaults":"name location platformFaultDomainCount","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.disk":{"id":"azure.subscription.computeService.disk","name":"azure.subscription.computeService.disk","fields":{"availabilityPolicy":{"name":"availabilityPolicy","type":"\n","is_mandatory":true,"title":"Behavior when the disk experiences slow I/O (AutomaticReattach)","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"burstingEnabled":{"name":"burstingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether on-demand bursting is enabled for the disk","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataAccessAuthMode":{"name":"dataAccessAuthMode","type":"\u0007","is_mandatory":true,"title":"Data access authentication mode (AzureActiveDirectory, None)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskAccessId":{"name":"diskAccessId","type":"\u0007","is_mandatory":true,"title":"ARM ID of the DiskAccess resource for private endpoint access","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskEncryptionSet":{"name":"diskEncryptionSet","type":"\u001bazure.subscription.computeService.diskEncryptionSet","title":"Disk encryption set used for customer-managed key encryption","min_provider_version":"13.7.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskEncryptionSetId":{"name":"diskEncryptionSetId","type":"\u0007","is_mandatory":true,"title":"ID of the disk encryption set used for customer-managed key encryption","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskIopsReadOnly":{"name":"diskIopsReadOnly","type":"\u0005","is_mandatory":true,"title":"Number of IOPS allowed for read-only operations on shared disks","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskIopsReadWrite":{"name":"diskIopsReadWrite","type":"\u0005","is_mandatory":true,"title":"Number of IOPS allowed for read/write operations","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskMbpsReadOnly":{"name":"diskMbpsReadOnly","type":"\u0005","is_mandatory":true,"title":"Bandwidth in MB/s allowed for read-only operations on shared disks","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskMbpsReadWrite":{"name":"diskMbpsReadWrite","type":"\u0005","is_mandatory":true,"title":"Bandwidth in MB/s allowed for read/write operations","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskSizeBytes":{"name":"diskSizeBytes","type":"\u0005","is_mandatory":true,"title":"Exact size of the disk in bytes","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskState":{"name":"diskState","type":"\u0007","is_mandatory":true,"title":"Current state of the disk (Unattached, Attached, Reserved, ActiveSAS, ReadyToUpload, ActiveUpload, ActiveSASFrozen)","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionSettingsEnabled":{"name":"encryptionSettingsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Azure Disk Encryption (ADE) is enabled on the disk","desc":"True when guest-based encryption settings (BitLocker / dm-crypt, keyed through Key Vault) are configured on the disk. This is independent of `encryptionType`, which describes server-side encryption at rest with a platform or customer-managed key.","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionType":{"name":"encryptionType","type":"\u0007","is_mandatory":true,"title":"Disk encryption type (EncryptionAtRestWithPlatformKey, EncryptionAtRestWithCustomerKey, EncryptionAtRestWithPlatformAndCustomerKeys)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hyperVGeneration":{"name":"hyperVGeneration","type":"\u0007","is_mandatory":true,"title":"Hyper-V generation of the disk (V1, V2)","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Disk resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Disk resource location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedBy":{"name":"managedBy","type":"\u0007","is_mandatory":true,"title":"A relative URI containing the ID of the VM that has the disk attached","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedByExtended":{"name":"managedByExtended","type":"\u0019\u0007","is_mandatory":true,"title":"List of relative URIs containing the IDs of the VMs that have the disk attached","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxShares":{"name":"maxShares","type":"\u0005","is_mandatory":true,"title":"Maximum number of VMs that can attach to the disk concurrently","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Disk resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkAccessPolicy":{"name":"networkAccessPolicy","type":"\u0007","is_mandatory":true,"title":"Disk network access policy (AllowAll, AllowPrivate, DenyAll)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Disk resource properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the disk","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether public network access is enabled for the disk","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"The disk SKU name and tier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"supportsHibernation":{"name":"supportsHibernation","type":"\u0004","is_mandatory":true,"title":"Whether the disk supports hibernation","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemData":{"name":"systemData","type":"\n","is_mandatory":true,"title":"Azure Resource Manager system metadata","desc":"Deprecated in favor of systemMetadata, which exposes createdBy, createdByType, createdAt, lastModifiedBy, lastModifiedByType, and lastModifiedAt as typed fields.","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Disk resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tier":{"name":"tier","type":"\u0007","is_mandatory":true,"title":"Performance tier of the disk (P4, P6, P10, P15, P20, P30, P40, P50, P60, P70, P80)","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeCreated":{"name":"timeCreated","type":"\t","is_mandatory":true,"title":"When the disk was created","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Disk resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"uniqueId":{"name":"uniqueId","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the disk (128-bit GUID)","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"The logical zone list for disk","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure managed disk","desc":"Managed disk attached to a VM, scale set, or available for attachment. Surfaces the disk SKU and tier, OS type, disk size and IOPS, the disk state (Unattached, Attached, Reserved, ActiveSAS, ReadyToUpload, ActiveUpload), encryption settings (platform-managed, customer-managed via diskEncryptionSet, or double-encryption), network access policy, public network access, the source from which the disk was created, and any attached VM.","min_provider_version":"9.0.1","defaults":"name location properties.osType properties.diskSizeGB properties.diskState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.diskAccess":{"id":"azure.subscription.computeService.diskAccess","name":"azure.subscription.computeService.diskAccess","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Disk access ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Disk access location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Disk access name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Disk access tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeCreated":{"name":"timeCreated","type":"\t","is_mandatory":true,"title":"When the disk access was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Disk access type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure disk access resource","desc":"Private-endpoint configuration that managed disks and snapshots can be exported and imported through. Surfaces the `provisioningState`, the `extendedLocation` if the resource lives in an Azure Edge Zone, and the time the access was created and last modified. Disks reference a disk-access by ARM ID through their `networkAccessPolicy` to keep export/import traffic off the public internet.","min_provider_version":"13.3.3","defaults":"name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.diskEncryptionSet":{"id":"azure.subscription.computeService.diskEncryptionSet","name":"azure.subscription.computeService.diskEncryptionSet","fields":{"activeKeySourceVaultId":{"name":"activeKeySourceVaultId","type":"\u0007","is_mandatory":true,"title":"Active key source vault ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"activeKeyUrl":{"name":"activeKeyUrl","type":"\u0007","is_mandatory":true,"title":"Active key vault key URL","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionType":{"name":"encryptionType","type":"\u0007","is_mandatory":true,"title":"Encryption type (EncryptionAtRestWithCustomerKey, EncryptionAtRestWithPlatformAndCustomerKeys, ConfidentialVmEncryptedWithCustomerKey)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Disk encryption set ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Identity configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastKeyRotationTimestamp":{"name":"lastKeyRotationTimestamp","type":"\t","is_mandatory":true,"title":"Last key rotation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Disk encryption set location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Disk encryption set name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rotationToLatestKeyVersionEnabled":{"name":"rotationToLatestKeyVersionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether auto key rotation to latest key version is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Disk encryption set tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Disk encryption set type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure disk encryption set","desc":"Customer-managed key configuration that managed disks and snapshots reference for envelope encryption. Surfaces the `encryptionType` (EncryptionAtRestWithCustomerKey, EncryptionAtRestWithPlatformAndCustomerKeys, or ConfidentialVmEncryptedWithCustomerKey), the active and rotation-to Key Vault key URLs, the system or user-assigned identity used to access the vault, the auto-key-rotation flag, and the federated client ID when one is configured.","min_provider_version":"13.3.3","defaults":"name location encryptionType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.gallery":{"id":"azure.subscription.computeService.gallery","name":"azure.subscription.computeService.gallery","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Gallery description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Gallery ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"image":{"name":"image","type":"\u001bazure.subscription.computeService.gallery.image","title":"Azure Compute Gallery image definition","desc":"Versioned VM image definition inside a Compute Gallery. Surfaces the OS type (Linux or Windows), OS state (Generalized vs Specialized), `hyperVGeneration` (V1 or V2), architecture, supported VM features, the publisher/offer/SKU identifiers, end-of-life date, recommended VM configuration, and the versions published under the definition.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"images":{"name":"images","type":"\u0019\u001bazure.subscription.computeService.gallery.image","title":"Image definitions in this gallery","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Gallery location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Gallery name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Unmodeled resource properties returned by the Azure API","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sharingProfile":{"name":"sharingProfile","type":"\n","is_mandatory":true,"title":"Sharing profile (Private, Groups, or Community)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sharingStatus":{"name":"sharingStatus","type":"\n","is_mandatory":true,"title":"Sharing status (replication state across regions)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"softDeletePolicy":{"name":"softDeletePolicy","type":"\n","is_mandatory":true,"title":"Soft-delete policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Gallery tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Gallery resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"uniqueName":{"name":"uniqueName","type":"\u0007","is_mandatory":true,"title":"Unique gallery name (used in URLs)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Compute Gallery","desc":"Compute Gallery (formerly Shared Image Gallery), the versioned image-distribution scope inside a subscription. Surfaces the gallery description, identifier, the `sharingProfile` (private, community, or groups), the soft-delete state, and the image definitions in the gallery so audits can traverse from gallery to image definition to image version.","min_provider_version":"13.7.1","defaults":"name location description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.gallery.image":{"id":"azure.subscription.computeService.gallery.image","name":"azure.subscription.computeService.gallery.image","fields":{"architecture":{"name":"architecture","type":"\u0007","is_mandatory":true,"title":"Architecture (x64, Arm64)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the image definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disallowed":{"name":"disallowed","type":"\n","is_mandatory":true,"title":"Disallowed properties (disk types)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endOfLifeDate":{"name":"endOfLifeDate","type":"\t","is_mandatory":true,"title":"End-of-life date for this image definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"eula":{"name":"eula","type":"\u0007","is_mandatory":true,"title":"EULA","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"features":{"name":"features","type":"\u0019\n","is_mandatory":true,"title":"Image features (e.g. TrustedLaunch)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hyperVGeneration":{"name":"hyperVGeneration","type":"\u0007","is_mandatory":true,"title":"Hyper-V generation (V1, V2)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Image definition ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identifier":{"name":"identifier","type":"\n","is_mandatory":true,"title":"Image identifier (publisher, offer, sku)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Image definition location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Image definition name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osState":{"name":"osState","type":"\u0007","is_mandatory":true,"title":"OS state (Generalized, Specialized)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osType":{"name":"osType","type":"\u0007","is_mandatory":true,"title":"OS type (Linux, Windows)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privacyStatementUri":{"name":"privacyStatementUri","type":"\u0007","is_mandatory":true,"title":"Privacy statement URI","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Unmodeled resource properties returned by the Azure API","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"purchasePlan":{"name":"purchasePlan","type":"\n","is_mandatory":true,"title":"Marketplace plan info","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"recommended":{"name":"recommended","type":"\n","is_mandatory":true,"title":"Recommended hardware (vCPUs, memory)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"releaseNoteUri":{"name":"releaseNoteUri","type":"\u0007","is_mandatory":true,"title":"Release notes URI","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Image definition tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Image definition resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u001bazure.subscription.computeService.gallery.image.version","title":"Azure Compute Gallery image version","desc":"Concrete versioned image inside a Compute Gallery image definition. Surfaces the storage profile (OS disk image, data disk images, and the source the version was created from), the publishing-profile target regions and replication options, the safety profile, end-of-life date, and the version's replication status.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"versions":{"name":"versions","type":"\u0019\u001bazure.subscription.computeService.gallery.image.version","title":"Image versions in this image definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Compute Gallery image definition","desc":"Versioned VM image definition inside a Compute Gallery. Surfaces the OS type (Linux or Windows), OS state (Generalized vs Specialized), `hyperVGeneration` (V1 or V2), architecture, supported VM features, the publisher/offer/SKU identifiers, end-of-life date, recommended VM configuration, and the versions published under the definition.","min_provider_version":"13.7.1","defaults":"name osType osState hyperVGeneration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.gallery.image.version":{"id":"azure.subscription.computeService.gallery.image.version","name":"azure.subscription.computeService.gallery.image.version","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Image version ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Image version location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Image version name (semver, e.g. 1.0.0)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Unmodeled resource properties returned by the Azure API","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publishingProfile":{"name":"publishingProfile","type":"\n","is_mandatory":true,"title":"Publishing profile (replication, target regions, end-of-life)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicationStatus":{"name":"replicationStatus","type":"\n","is_mandatory":true,"title":"Replication status across regions","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"safetyProfile":{"name":"safetyProfile","type":"\n","is_mandatory":true,"title":"Safety profile (allowDeletion, blockDeletion, reportedForPolicyViolation)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityProfile":{"name":"securityProfile","type":"\n","is_mandatory":true,"title":"Security profile (UEFI settings)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageProfile":{"name":"storageProfile","type":"\n","is_mandatory":true,"title":"Storage profile (source, OS disk image, data disk images)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Image version tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Image version resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Compute Gallery image version","desc":"Concrete versioned image inside a Compute Gallery image definition. Surfaces the storage profile (OS disk image, data disk images, and the source the version was created from), the publishing-profile target regions and replication options, the safety profile, end-of-life date, and the version's replication status.","min_provider_version":"13.7.1","defaults":"name location provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.hybridMachine":{"id":"azure.subscription.computeService.hybridMachine","name":"azure.subscription.computeService.hybridMachine","fields":{"adFqdn":{"name":"adFqdn","type":"\u0007","is_mandatory":true,"title":"AD fully qualified display name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"agentVersion":{"name":"agentVersion","type":"\u0007","is_mandatory":true,"title":"Connected Machine agent version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cloudMetadata":{"name":"cloudMetadata","type":"\n","is_mandatory":true,"title":"Detected cloud environment metadata (Azure/GCP/AWS/OCI provider, account, region) when applicable","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"detectedProperties":{"name":"detectedProperties","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Detected agent-reported properties (azureResourceId, manufacturer, model, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Azure-side display name for the machine","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dnsFqdn":{"name":"dnsFqdn","type":"\u0007","is_mandatory":true,"title":"DNS-resolvable FQDN","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"domainName":{"name":"domainName","type":"\u0007","is_mandatory":true,"title":"AD domain the machine is joined to (Windows only)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"extension":{"name":"extension","type":"\u001bazure.subscription.computeService.hybridMachine.extension","title":"Extension installed on an Azure Arc-enabled server (Microsoft.HybridCompute/machines/extensions)","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"extensions":{"name":"extensions","type":"\u0019\u001bazure.subscription.computeService.hybridMachine.extension","title":"Installed Arc machine extensions","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastStatusChange":{"name":"lastStatusChange","type":"\t","is_mandatory":true,"title":"Last time the Arc agent reported in","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"licenseProfile":{"name":"licenseProfile","type":"\n","is_mandatory":true,"title":"Windows license / ESU attestation profile","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"machineFqdn":{"name":"machineFqdn","type":"\u0007","is_mandatory":true,"title":"Hybrid machine FQDN","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Machine name (Azure resource name)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osEdition":{"name":"osEdition","type":"\u0007","is_mandatory":true,"title":"OS edition (e.g. \"Datacenter\", \"Standard\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osName":{"name":"osName","type":"\u0007","is_mandatory":true,"title":"OS name reported by the agent (e.g. \"windows\", \"linux\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osSku":{"name":"osSku","type":"\u0007","is_mandatory":true,"title":"OS product SKU (e.g. \"Windows Server 2019 Datacenter\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osType":{"name":"osType","type":"\u0007","is_mandatory":true,"title":"OS type as Azure classifies it (\"Windows\" / \"Linux\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osVersion":{"name":"osVersion","type":"\u0007","is_mandatory":true,"title":"OS version reported by the agent","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"parentClusterResourceId":{"name":"parentClusterResourceId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the parent Azure HCI cluster, if any","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateLinkScopeResourceId":{"name":"privateLinkScopeResourceId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the private link scope this machine is assigned to, if any","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw HybridCompute machine properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the ARM resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Connection status of the Arc agent. Possible values: \"Connected\", \"Disconnected\", \"Error\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemData":{"name":"systemData","type":"\n","is_mandatory":true,"title":"Azure Resource Manager system metadata","desc":"Deprecated in favor of systemMetadata, which exposes createdBy, createdByType, createdAt, lastModifiedBy, lastModifiedByType, and lastModifiedAt as typed fields.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"ARM resource type (Microsoft.HybridCompute/machines)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vmId":{"name":"vmId","type":"\u0007","is_mandatory":true,"title":"Hybrid machine unique ID (Arc-assigned)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vmUuid":{"name":"vmUuid","type":"\u0007","is_mandatory":true,"title":"Arc Machine's unique SMBIOS UUID","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Arc-enabled server","desc":"Azure Arc-enabled server (Microsoft.HybridCompute/machines), an on-premises or other-cloud machine projected into Azure for management. Surfaces the agent status (Connected, Disconnected, Expired), agent version, OS name and version, last status check, machine identity, attached extensions, private link scope, and the `cloudMetadata` describing the underlying environment when the machine is hosted on AWS, GCP, VMware, or another cloud.","min_provider_version":"13.10.0","defaults":"name location osName osVersion status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.hybridMachine.extension":{"id":"azure.subscription.computeService.hybridMachine.extension","name":"azure.subscription.computeService.hybridMachine.extension","fields":{"autoUpgradeMinorVersion":{"name":"autoUpgradeMinorVersion","type":"\u0004","is_mandatory":true,"title":"Whether the extension uses a newer minor version if one is available at deployment time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableAutomaticUpgrade":{"name":"enableAutomaticUpgrade","type":"\u0004","is_mandatory":true,"title":"Whether the platform automatically upgrades the extension to a newer version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"extensionType":{"name":"extensionType","type":"\u0007","is_mandatory":true,"title":"Extension type (e.g. \"AzureMonitorLinuxAgent\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"forceUpdateTag":{"name":"forceUpdateTag","type":"\u0007","is_mandatory":true,"title":"Tag used to trigger a re-run of the extension handler even when settings are unchanged","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"instanceView":{"name":"instanceView","type":"\n","is_mandatory":true,"title":"Latest extension instance view reported by the handler (status code, level, display status, message)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Geo-location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Extension name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the extension","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publisher":{"name":"publisher","type":"\u0007","is_mandatory":true,"title":"Extension handler publisher (e.g. \"Microsoft.Azure.Monitor\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"settings":{"name":"settings","type":"\n","is_mandatory":true,"title":"Public JSON settings passed to the extension handler","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemData":{"name":"systemData","type":"\n","is_mandatory":true,"title":"Azure Resource Manager system metadata","desc":"Deprecated in favor of systemMetadata, which exposes createdBy, createdByType, createdAt, lastModifiedBy, lastModifiedByType, and lastModifiedAt as typed fields.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"ARM resource type (Microsoft.HybridCompute/machines/extensions)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"typeHandlerVersion":{"name":"typeHandlerVersion","type":"\u0007","is_mandatory":true,"title":"Version of the extension handler","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Extension installed on an Azure Arc-enabled server (Microsoft.HybridCompute/machines/extensions)","private":true,"min_provider_version":"13.10.1","defaults":"name extensionType publisher provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.image":{"id":"azure.subscription.computeService.image","name":"azure.subscription.computeService.image","fields":{"hyperVGeneration":{"name":"hyperVGeneration","type":"\u0007","is_mandatory":true,"title":"Hyper-V generation (V1, V2)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Image ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Image location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Image name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Unmodeled resource properties returned by the Azure API","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceVirtualMachine":{"name":"sourceVirtualMachine","type":"\u001bazure.subscription.computeService.vm","title":"Virtual machine this image was generalized and captured from","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceVirtualMachineId":{"name":"sourceVirtualMachineId","type":"\u0007","is_mandatory":true,"title":"Source VM ARM ID this image was captured from","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageProfile":{"name":"storageProfile","type":"\n","is_mandatory":true,"title":"Storage profile (OS disk + data disks)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Image tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Image resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure managed image","desc":"Custom VM image stored as a single Azure resource. Surfaces the storage profile (OS disk and data disks), the `hyperVGeneration` (V1 or V2), the source virtual machine the image was generalized from, and the provisioning state. Compute Galleries are the preferred mechanism for versioned image distribution; managed images remain useful for single-resource captures.","min_provider_version":"13.7.1","defaults":"name location hyperVGeneration provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.proximityPlacementGroup":{"id":"azure.subscription.computeService.proximityPlacementGroup","name":"azure.subscription.computeService.proximityPlacementGroup","fields":{"availabilitySetIds":{"name":"availabilitySetIds","type":"\u0019\u0007","is_mandatory":true,"title":"ARM IDs of availability sets in this group (references)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Proximity placement group ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"intent":{"name":"intent","type":"\n","is_mandatory":true,"title":"Intent (e.g. supported VM sizes)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Proximity placement group location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Proximity placement group name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Unmodeled resource properties returned by the Azure API","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"proximityPlacementGroupType":{"name":"proximityPlacementGroupType","type":"\u0007","is_mandatory":true,"title":"Group type: Standard (latency-sensitive) or Ultra (lowest-latency)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Proximity placement group tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Proximity placement group resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualMachineIds":{"name":"virtualMachineIds","type":"\u0019\u0007","is_mandatory":true,"title":"ARM IDs of VMs in this group (references)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualMachineScaleSetIds":{"name":"virtualMachineScaleSetIds","type":"\u0019\u0007","is_mandatory":true,"title":"ARM IDs of VMSS in this group (references)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"Availability zones (Ultra type only, Standard does not support zones)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Proximity Placement Group","desc":"Co-location scope for Azure compute resources. Surfaces the placement-group type (Standard or Ultra), the supported availability zones, the colocation status, and the lists of VMs, virtual-machine scale sets, and availability sets currently bound to the group so they share low-latency network locality.","min_provider_version":"13.7.1","defaults":"name location proximityPlacementGroupType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.snapshot":{"id":"azure.subscription.computeService.snapshot","name":"azure.subscription.computeService.snapshot","fields":{"creationData":{"name":"creationData","type":"\n","is_mandatory":true,"title":"Disk creation source information (createOption, sourceResourceId, sourceUri, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataAccessAuthMode":{"name":"dataAccessAuthMode","type":"\u0007","is_mandatory":true,"title":"Data access authentication mode (AzureActiveDirectory, None)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskAccessId":{"name":"diskAccessId","type":"\u0007","is_mandatory":true,"title":"ARM ID of the DiskAccess resource for private endpoint access","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskEncryptionSet":{"name":"diskEncryptionSet","type":"\u001bazure.subscription.computeService.diskEncryptionSet","title":"Disk encryption set used for customer-managed key encryption","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskSizeBytes":{"name":"diskSizeBytes","type":"\u0005","is_mandatory":true,"title":"Exact size of the snapshot in bytes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskState":{"name":"diskState","type":"\u0007","is_mandatory":true,"title":"Current state of the snapshot (Unattached, Attached, Reserved, ActiveSAS, ReadyToUpload, ActiveUpload, ActiveSASFrozen)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionType":{"name":"encryptionType","type":"\u0007","is_mandatory":true,"title":"Snapshot encryption type (EncryptionAtRestWithPlatformKey, EncryptionAtRestWithCustomerKey, EncryptionAtRestWithPlatformAndCustomerKeys)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hyperVGeneration":{"name":"hyperVGeneration","type":"\u0007","is_mandatory":true,"title":"Hyper-V generation of the snapshot (V1, V2)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Snapshot ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immutabilityPolicyDurationDays":{"name":"immutabilityPolicyDurationDays","type":"\u0005","is_mandatory":true,"title":"Number of days the snapshot is protected for by the immutability policy","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immutabilityPolicyExpirationTime":{"name":"immutabilityPolicyExpirationTime","type":"\t","is_mandatory":true,"title":"When the immutability policy expires on the snapshot","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immutabilityPolicyExpired":{"name":"immutabilityPolicyExpired","type":"\u0004","is_mandatory":true,"title":"Whether the immutability policy on the snapshot has expired","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immutabilityPolicyStartTime":{"name":"immutabilityPolicyStartTime","type":"\t","is_mandatory":true,"title":"When the immutability policy was applied to the snapshot","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immutabilityPolicyType":{"name":"immutabilityPolicyType","type":"\u0007","is_mandatory":true,"title":"Immutability policy type protecting the snapshot from modification or deletion","desc":"One of Locked (the immutability duration cannot be reduced, only extended, and the policy cannot be removed until it expires) or Unlocked (privileged users can still modify or remove the policy). Null when no immutability policy is applied to the snapshot.","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"incremental":{"name":"incremental","type":"\u0004","is_mandatory":true,"title":"Whether this is an incremental snapshot","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"incrementalSnapshotFamilyId":{"name":"incrementalSnapshotFamilyId","type":"\u0007","is_mandatory":true,"title":"Family ID shared by incremental snapshots of the same disk","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"instantAccessDurationMinutes":{"name":"instantAccessDurationMinutes","type":"\u0005","is_mandatory":true,"title":"For snapshots of Premium SSD v2 or Ultra disks, time in minutes the snapshot is retained for instant access","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Snapshot location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Snapshot name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkAccessPolicy":{"name":"networkAccessPolicy","type":"\u0007","is_mandatory":true,"title":"Network access policy (AllowAll, AllowPrivate, DenyAll)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osType":{"name":"osType","type":"\u0007","is_mandatory":true,"title":"Operating system type of the source disk (Windows, Linux)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Snapshot resource properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the snapshot","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether public network access is enabled (Enabled, Disabled)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"The snapshot SKU name and tier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"snapshotAccessState":{"name":"snapshotAccessState","type":"\u0007","is_mandatory":true,"title":"Snapshot access state determining availability (Unknown, Pending, Available)","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceDisk":{"name":"sourceDisk","type":"\u001bazure.subscription.computeService.disk","title":"Source disk for this snapshot (resolved from creationData.sourceResourceId when it points to a managed disk)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"supportsHibernation":{"name":"supportsHibernation","type":"\u0004","is_mandatory":true,"title":"Whether the source disk supports hibernation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemData":{"name":"systemData","type":"\n","is_mandatory":true,"title":"Azure Resource Manager system metadata","desc":"Deprecated in favor of systemMetadata, which exposes createdBy, createdByType, createdAt, lastModifiedBy, lastModifiedByType, and lastModifiedAt as typed fields.","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Snapshot tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeCreated":{"name":"timeCreated","type":"\t","is_mandatory":true,"title":"When the snapshot was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Snapshot type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"uniqueId":{"name":"uniqueId","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the snapshot (128-bit GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure managed disk snapshot","desc":"Point-in-time snapshot of an Azure managed disk. Surfaces the snapshot SKU and tier, OS type, allocated and used size, the `diskState`, the source resource the snapshot was created from, the `incremental` flag (incremental vs full), encryption settings (platform-managed, customer-managed via diskEncryptionSet, or confidential-VM encryption), the network access policy, public network access, the immutability policy protecting it from modification or deletion, and any active SAS export for downloading the underlying VHD.","min_provider_version":"13.7.1","defaults":"name location diskSizeBytes diskState incremental","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.vm":{"id":"azure.subscription.computeService.vm","name":"azure.subscription.computeService.vm","fields":{"adeInstalled":{"name":"adeInstalled","type":"\u0004","title":"Whether the Azure Disk Encryption (ADE) extension is installed on the VM","desc":"ADE encrypts the OS and data disks from inside the guest using BitLocker (Windows) or dm-crypt (Linux). A true result indicates the encryption extension is present; it is distinct from `encryptionAtHost` (platform-side encryption of the VM host) and from server-side disk encryption set on the managed disk itself.","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"adminUsername":{"name":"adminUsername","type":"\u0007","is_mandatory":true,"title":"VM admin username","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"amaInstalled":{"name":"amaInstalled","type":"\u0004","title":"Whether the Azure Monitor Agent (AMA) extension is installed on the VM","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bootDiagnosticsEnabled":{"name":"bootDiagnosticsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether boot diagnostics is enabled on the VM","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bootDiagnosticsStorageUri":{"name":"bootDiagnosticsStorageUri","type":"\u0007","is_mandatory":true,"title":"Boot diagnostics storage URI; empty when boot diagnostics writes to platform-managed storage","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"computerName":{"name":"computerName","type":"\u0007","is_mandatory":true,"title":"VM computer name (OS hostname)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataDisks":{"name":"dataDisks","type":"\u0019\u001bazure.subscription.computeService.disk","title":"VM compute data disk","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dependencyAgentInstalled":{"name":"dependencyAgentInstalled","type":"\u0004","title":"Whether the Dependency Agent extension (used by VM Insights for service-map data) is installed on the VM","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disablePasswordAuthentication":{"name":"disablePasswordAuthentication","type":"\u0004","is_mandatory":true,"title":"Whether password authentication is disabled for SSH on the Linux VM","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableAutomaticUpdates":{"name":"enableAutomaticUpdates","type":"\u0004","is_mandatory":true,"title":"Whether automatic OS upgrades by the platform are enabled (WindowsConfiguration.EnableAutomaticUpdates)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionAtHost":{"name":"encryptionAtHost","type":"\u0004","is_mandatory":true,"title":"Whether encryption at host is enabled for all VM disks","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"exposure":{"name":"exposure","type":"\u001bazure.subscription.networkService.exposure","title":"Internet-exposure summary combining public IPs and NSG ingress rules","desc":"Reports whether the VM is reachable from the public internet by checking for an assigned public IP and whether the effective network security group chain admits inbound traffic from any source. Inbound traffic must be admitted by every NSG in the chain (subnet-level and NIC-level), and rule priority is honored so a higher-priority Deny that shadows an Allow closes the exposure.","min_provider_version":"13.20.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"extensions":{"name":"extensions","type":"\u0019\n","title":"VM extension","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fipsEncryptionEnabled":{"name":"fipsEncryptionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether FIPS 140-3 compliant cryptography is enabled for extension protectedSettings","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"VM ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity configuration (type, system- and user-assigned identities)","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"imageReference":{"name":"imageReference","type":"\u001bazure.subscription.computeService.vm.imageReference","is_mandatory":true,"title":"VM image reference (marketplace publisher/offer/sku/version, or direct gallery image ID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isRunning":{"name":"isRunning","type":"\u0004","title":"Whether the VM is running","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"licenseType":{"name":"licenseType","type":"\u0007","is_mandatory":true,"title":"Azure Hybrid Benefit license type","desc":"Null if using standard Azure licensing. Possible values: \"Windows_Client\", \"Windows_Server\", \"RHEL_BYOS\", \"SLES_BYOS\".","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"VM location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedBy":{"name":"managedBy","type":"\u0007","is_mandatory":true,"title":"ID of the resource that manages this VM (e.g. VMSS ARM resource ID)","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mdeInstalled":{"name":"mdeInstalled","type":"\u0004","title":"Whether the Microsoft Defender for Endpoint (MDE) extension is installed on the VM","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"VM name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkInterfaces":{"name":"networkInterfaces","type":"\u0019\u001bazure.subscription.networkService.interface","title":"VM network interfaces (NICs) attached via the VM's networkProfile","min_provider_version":"13.7.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"omsInstalled":{"name":"omsInstalled","type":"\u0004","title":"Whether the legacy Microsoft Monitoring Agent (OMS) extension is installed on the VM","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osDisk":{"name":"osDisk","type":"\u001bazure.subscription.computeService.disk","title":"VM compute disk","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osType":{"name":"osType","type":"\u0007","is_mandatory":true,"title":"Operating system type of the OS disk (\"Linux\" or \"Windows\")","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"patchMode":{"name":"patchMode","type":"\u0007","is_mandatory":true,"title":"Patch mode for the OS (\"Manual\", \"AutomaticByOS\", \"AutomaticByPlatform\", \"ImageDefault\")","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the VM's system-assigned managed identity; empty when no system-assigned identity is enabled","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"VM properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisionVMAgent":{"name":"provisionVMAgent","type":"\u0004","is_mandatory":true,"title":"Whether the VM agent is provisioned (Linux/Windows)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the VM (e.g. Succeeded, Failed, Creating, Updating, Deleting)","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"proxyAgentAddExtension":{"name":"proxyAgentAddExtension","type":"\u0004","is_mandatory":true,"title":"Whether to implicitly install the ProxyAgent extension (Linux only)","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"proxyAgentEnabled":{"name":"proxyAgentEnabled","type":"\u0004","is_mandatory":true,"title":"Whether ProxyAgent is enabled on the VM","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"proxyAgentMode":{"name":"proxyAgentMode","type":"\u0007","is_mandatory":true,"title":"ProxyAgent execution mode (\"Audit\", \"Enforce\")","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddresses":{"name":"publicIpAddresses","type":"\u0019\u001bazure.subscription.networkService.ipAddress","title":"VM public IP addresses","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resiliencyProfile":{"name":"resiliencyProfile","type":"\n","is_mandatory":true,"title":"Resiliency profile (zone movement configuration)","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scheduledEventsPolicy":{"name":"scheduledEventsPolicy","type":"\n","is_mandatory":true,"title":"Scheduled-events policy (UserInitiatedReboot, UserInitiatedRedeploy, additional publishing targets)","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secureBootEnabled":{"name":"secureBootEnabled","type":"\u0004","is_mandatory":true,"title":"Whether UEFI Secure Boot is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityType":{"name":"securityType","type":"\u0007","is_mandatory":true,"title":"Security type of the VM (\"ConfidentialVM\", \"TrustedLaunch\", or \"Standard\")","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sshPublicKeys":{"name":"sshPublicKeys","type":"\u0019\n","is_mandatory":true,"title":"SSH public keys configured on the Linux VM","desc":"Each entry carries the `path` the key is installed to, the raw `keyData`, and the `algorithm` (for example ssh-rsa, ecdsa-sha2-nistp256, ssh-ed25519) plus key size in `bits` parsed from the key data. Empty for Windows or password-authentication VMs.","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","title":"VM state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemAssignedIdentity":{"name":"systemAssignedIdentity","type":"\u001bazure.subscription.managedIdentity","title":"System-assigned managed identity of the VM; null when no system-assigned identity is enabled","desc":"Exposes the system-assigned identity as a managed identity so its role assignments, and their role definitions and permissions, can be traversed. This completes the resource-to-privilege leg of an attack path from an internet-reachable VM to what its identity is authorized to do.","min_provider_version":"13.26.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemData":{"name":"systemData","type":"\n","is_mandatory":true,"title":"Azure Resource Manager system metadata","desc":"Deprecated in favor of systemMetadata, which exposes createdBy, createdByType, createdAt, lastModifiedBy, lastModifiedByType, and lastModifiedAt as typed fields.","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"VM tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeCreated":{"name":"timeCreated","type":"\t","is_mandatory":true,"title":"When the VM was created","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"VM type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities attached to the VM","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userData":{"name":"userData","type":"\u0007","is_mandatory":true,"title":"Base64-encoded user data passed to the VM at provisioning time (cloud-init equivalent)","desc":"Empty when user data is not set. Treat as sensitive: secrets and bootstrap credentials are sometimes embedded here.","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vmId":{"name":"vmId","type":"\u0007","is_mandatory":true,"title":"Unique 128-bit VM identifier","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vmScaleSet":{"name":"vmScaleSet","type":"\u001bazure.subscription.computeService.vmScaleSet","title":"Virtual Machine Scale Set that manages this VM, if any (resolved from managedBy)","min_provider_version":"13.7.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vtpmEnabled":{"name":"vtpmEnabled","type":"\u0004","is_mandatory":true,"title":"Whether virtual Trusted Platform Module (vTPM) is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"VM zones","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure virtual machine","desc":"Virtual machine and the security-relevant configuration around it: the VM size, OS profile, storage profile (OS and data disks), network profile and attached network interfaces, identity assignments, applied tags, the availability/zone/proximity-placement-group placement, the boot diagnostics and security profile (TrustedLaunch / ConfidentialVM, SecureBoot, vTPM), the extensions installed on the VM, OS patching state, and the deployed extensions for ASC, Defender, and guest configuration.","min_provider_version":"9.0.1","defaults":"name location properties.hardwareProfile.vmSize properties.storageProfile.osDisk.osType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.vm.imageReference":{"id":"azure.subscription.computeService.vm.imageReference","name":"azure.subscription.computeService.vm.imageReference","fields":{"communityGalleryImageId":{"name":"communityGalleryImageId","type":"\u0007","is_mandatory":true,"title":"Community-gallery image unique ID; empty when not deployed from a community gallery","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"exactVersion":{"name":"exactVersion","type":"\u0007","is_mandatory":true,"title":"Resolved concrete version when `version` was `\"latest\"` at deploy time; empty otherwise","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"imageId":{"name":"imageId","type":"\u0007","is_mandatory":true,"title":"Direct image resource ID (managed image or shared gallery); empty when deployed from a marketplace image","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"offer":{"name":"offer","type":"\u0007","is_mandatory":true,"title":"Image offer (marketplace images; empty for gallery images)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publisher":{"name":"publisher","type":"\u0007","is_mandatory":true,"title":"Image publisher (marketplace images; empty for gallery images)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sharedGalleryImageId":{"name":"sharedGalleryImageId","type":"\u0007","is_mandatory":true,"title":"Shared-gallery image unique ID; empty when not deployed from a shared gallery","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\u0007","is_mandatory":true,"title":"Image SKU (marketplace images; empty for gallery images)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Image version (marketplace or shared-gallery images); `\"latest\"` indicates the platform picks the newest at deploy time","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure VM image reference","desc":"Image a VM was deployed from. For marketplace images the `publisher`, `offer`, `sku`, and `version` are populated. For shared / community / direct gallery images, `imageId`, `sharedGalleryImageId`, or `communityGalleryImageId` carries the gallery resource path. `exactVersion` resolves the concrete version when `version` was specified as `\"latest\"`. Audit queries typically check `version != \"latest\"` to enforce pinning, or flag deployments against unapproved publishers.","private":true,"min_provider_version":"13.12.2","defaults":"publisher offer sku version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.vmScaleSet":{"id":"azure.subscription.computeService.vmScaleSet","name":"azure.subscription.computeService.vmScaleSet","fields":{"automaticRepairsPolicy":{"name":"automaticRepairsPolicy","type":"\n","is_mandatory":true,"title":"Automatic repairs policy for the scale set","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionAtHost":{"name":"encryptionAtHost","type":"\u0004","is_mandatory":true,"title":"Whether encryption at host is enabled for all scale-set VM disks","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"extensions":{"name":"extensions","type":"\u0019\n","title":"Extensions installed on the scale set (each dict describes one extension)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"VMSS ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity configuration (type, system- and user-assigned identities)","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"instance":{"name":"instance","type":"\u001bazure.subscription.computeService.vmScaleSet.instance","title":"Azure scale set VM instance","desc":"Single VM instance inside a Virtual Machine Scale Set. Surfaces the per-instance ARM resource ID, the scale-set `instanceId`, applied availability zones, the `latestModelApplied` flag (whether the instance is on the current scale-set model), the `modelDefinitionApplied` (whether the model is the scale set's or customized), the Azure VM unique ID, instance SKU, and the raw instance properties for fields not yet promoted to typed accessors.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"instances":{"name":"instances","type":"\u0019\u001bazure.subscription.computeService.vmScaleSet.instance","title":"VMs that belong to this scale set","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"VMSS location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"VMSS name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"orchestrationMode":{"name":"orchestrationMode","type":"\u0007","is_mandatory":true,"title":"Orchestration mode (\"Uniform\" or \"Flexible\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"overprovision":{"name":"overprovision","type":"\u0004","is_mandatory":true,"title":"Whether the scale set should be overprovisioned","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"platformFaultDomainCount":{"name":"platformFaultDomainCount","type":"\u0005","is_mandatory":true,"title":"Fault Domain count for each placement group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the scale set's system-assigned managed identity; empty when no system-assigned identity is enabled","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"priorityMixPolicy":{"name":"priorityMixPolicy","type":"\n","is_mandatory":true,"title":"Spot/Regular priority mix policy for Flex VMSS","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"VMSS resource properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resiliencyPolicy":{"name":"resiliencyPolicy","type":"\n","is_mandatory":true,"title":"Resiliency policy (operation recovery, zone allocation, automatic zone rebalancing, resilient VM creation/deletion)","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scheduledEventsPolicy":{"name":"scheduledEventsPolicy","type":"\n","is_mandatory":true,"title":"Scheduled-events policy (UserInitiatedReboot, UserInitiatedRedeploy, additional publishing targets)","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secureBootEnabled":{"name":"secureBootEnabled","type":"\u0004","is_mandatory":true,"title":"Whether UEFI Secure Boot is enabled on scale-set VMs","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityPostureReference":{"name":"securityPostureReference","type":"\n","is_mandatory":true,"title":"Security posture reference applied to the scale set (community gallery security posture)","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityType":{"name":"securityType","type":"\u0007","is_mandatory":true,"title":"Security type applied to scale-set VMs (\"ConfidentialVM\", \"TrustedLaunch\", or \"Standard\")","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"singlePlacementGroup":{"name":"singlePlacementGroup","type":"\u0004","is_mandatory":true,"title":"Whether the scale set is limited to a single placement group of max 100 VMs","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"VMSS SKU (name, tier, capacity)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuProfile":{"name":"skuProfile","type":"\n","is_mandatory":true,"title":"SKU profile listing the candidate VM sizes and allocation strategy","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"spotRestorePolicy":{"name":"spotRestorePolicy","type":"\n","is_mandatory":true,"title":"Spot-Try-Restore policy (whether evicted Spot instances are restored opportunistically)","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemAssignedIdentity":{"name":"systemAssignedIdentity","type":"\u001bazure.subscription.managedIdentity","title":"System-assigned managed identity of the scale set; null when no system-assigned identity is enabled","desc":"Exposes the system-assigned identity as a managed identity so its role assignments, and their role definitions and permissions, can be traversed. This completes the resource-to-privilege leg of an attack path from an internet-reachable scale set to what its identity is authorized to do.","min_provider_version":"13.26.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemData":{"name":"systemData","type":"\n","is_mandatory":true,"title":"Azure Resource Manager system metadata","desc":"Deprecated in favor of systemMetadata, which exposes createdBy, createdByType, createdAt, lastModifiedBy, lastModifiedByType, and lastModifiedAt as typed fields.","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"VMSS tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeCreated":{"name":"timeCreated","type":"\t","is_mandatory":true,"title":"When the scale set was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"VMSS resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"uniqueId":{"name":"uniqueId","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the scale set","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"upgradePolicy":{"name":"upgradePolicy","type":"\n","is_mandatory":true,"title":"Upgrade policy for the scale set","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities attached to the scale set","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vtpmEnabled":{"name":"vtpmEnabled","type":"\u0004","is_mandatory":true,"title":"Whether virtual Trusted Platform Module (vTPM) is enabled on scale-set VMs","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zonalPlatformFaultDomainAlignMode":{"name":"zonalPlatformFaultDomainAlignMode","type":"\u0007","is_mandatory":true,"title":"Align mode between VMSS compute and storage Fault Domain count","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"Availability zones for the VMSS","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual Machine Scale Set","desc":"Virtual Machine Scale Set, the abstraction Azure uses to deploy and manage a group of identical VMs. Surfaces the `orchestrationMode` (Uniform or Flexible), the SKU and capacity, the network and OS profiles applied to instances, upgrade policy (Manual, Automatic, Rolling), automatic-OS-upgrade and rolling upgrade policy, the spot priority and eviction settings, identity assignments, the VM-extension profile, the platform-fault-domain count, and the per-instance `instances` currently provisioned.","min_provider_version":"13.7.1","defaults":"name location orchestrationMode sku","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.computeService.vmScaleSet.instance":{"id":"azure.subscription.computeService.vmScaleSet.instance","name":"azure.subscription.computeService.vmScaleSet.instance","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Instance ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"instanceId":{"name":"instanceId","type":"\u0007","is_mandatory":true,"title":"Instance ID within the scale set (e.g. \"0\", \"1\", ...)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"latestModelApplied":{"name":"latestModelApplied","type":"\u0004","is_mandatory":true,"title":"Whether the latest model has been applied to this instance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Instance location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"modelDefinitionApplied":{"name":"modelDefinitionApplied","type":"\u0007","is_mandatory":true,"title":"Whether the model applied to the VM is the scale set's model or a customized model","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Instance name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Instance properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"Instance SKU (name, tier, capacity)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Instance tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeCreated":{"name":"timeCreated","type":"\t","is_mandatory":true,"title":"When the instance was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vmId":{"name":"vmId","type":"\u0007","is_mandatory":true,"title":"Azure VM unique 128-bit identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"Availability zones","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure scale set VM instance","desc":"Single VM instance inside a Virtual Machine Scale Set. Surfaces the per-instance ARM resource ID, the scale-set `instanceId`, applied availability zones, the `latestModelApplied` flag (whether the instance is on the current scale-set model), the `modelDefinitionApplied` (whether the model is the scale set's or customized), the Azure VM unique ID, instance SKU, and the raw instance properties for fields not yet promoted to typed accessors.","min_provider_version":"13.7.1","defaults":"name instanceId provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerAppService":{"id":"azure.subscription.containerAppService","name":"azure.subscription.containerAppService","fields":{"containerApp":{"name":"containerApp","type":"\u001bazure.subscription.containerAppService.containerApp","title":"Azure Container App","desc":"Single Container App workload, exposing ingress posture (external vs internal, transport, allowed origins, IP rules, client-cert mode), revision strategy, scale bounds, secrets and registry auth, and the per-container image and resource definitions.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"containerApps":{"name":"containerApps","type":"\u0019\u001bazure.subscription.containerAppService.containerApp","title":"All Container Apps in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"job":{"name":"job","type":"\u001bazure.subscription.containerAppService.job","title":"Azure Container Apps Job","desc":"Run-to-completion workload, the batch sibling of Azure Container Apps. The `triggerType` field (Manual, Schedule, or Event) selects how the job starts, and the resource surfaces the replica timeout and retry limits, the schedule or event-trigger configuration, the container template, registry and secret auth, the linked managed environment, and the workload profile the job runs on.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"jobs":{"name":"jobs","type":"\u0019\u001bazure.subscription.containerAppService.job","title":"Container Apps jobs (run-to-completion workloads)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedEnvironment":{"name":"managedEnvironment","type":"\u001bazure.subscription.containerAppService.managedEnvironment","title":"Azure Container Apps managed environment","desc":"Network, logging, and TLS boundary that hosts a set of container apps. Selectable by ARM id; fields cover VNET delegation, public-network access, peer-traffic mTLS, zone redundancy, and the linked Log Analytics workspace.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"managedEnvironments":{"name":"managedEnvironments","type":"\u0019\u001bazure.subscription.containerAppService.managedEnvironment","title":"Managed environments (network/log boundary for Container Apps)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Container Apps","desc":"Azure Container Apps managed environments, the container apps running in them, and Container Apps jobs across the subscription. Covers ingress posture, image pinning, identity-vs-secret registry auth, Easy Auth configuration, and revision history.","private":true,"min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerAppService.containerApp":{"id":"azure.subscription.containerAppService.containerApp","name":"azure.subscription.containerAppService.containerApp","fields":{"authConfig":{"name":"authConfig","type":"\u001bazure.subscription.containerAppService.containerApp.authConfig","title":"Container App Easy Auth (authConfig) configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"authConfigs":{"name":"authConfigs","type":"\u0019\u001bazure.subscription.containerAppService.containerApp.authConfig","title":"Easy Auth (authConfigs) children","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"clientCertificateMode":{"name":"clientCertificateMode","type":"\u0007","is_mandatory":true,"title":"Client-certificate mode (\"ignore\", \"accept\", \"require\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"container":{"name":"container","type":"\u001bazure.subscription.containerAppService.containerApp.container","title":"Container definition inside a Container App","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"containers":{"name":"containers","type":"\u0019\u001bazure.subscription.containerAppService.containerApp.container","title":"Containers running in each replica","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"corsAllowedOrigins":{"name":"corsAllowedOrigins","type":"\u0019\u0007","is_mandatory":true,"title":"CORS allowed origins on ingress","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"eventStreamEndpoint":{"name":"eventStreamEndpoint","type":"\u0007","is_mandatory":true,"title":"Eventstream endpoint URL for log streaming","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"httpsOnly":{"name":"httpsOnly","type":"\u0004","is_mandatory":true,"title":"Whether HTTPS-only is enforced (insecureAllowed == false)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Identity block (system + user-assigned principal IDs)","desc":"Deprecated in favor of principalId and userAssignedIdentities.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"ingressEnabled":{"name":"ingressEnabled","type":"\u0004","is_mandatory":true,"title":"Whether ingress is enabled at all","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ingressExternal":{"name":"ingressExternal","type":"\u0004","is_mandatory":true,"title":"External ingress (true) vs internal-only (false)","desc":"Only meaningful when `ingressEnabled` is true; defaults to false when ingress is disabled.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"initContainers":{"name":"initContainers","type":"\u0019\u001bazure.subscription.containerAppService.containerApp.container","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipSecurityRestrictions":{"name":"ipSecurityRestrictions","type":"\u0019\n","is_mandatory":true,"title":"IP security restrictions on ingress","desc":"Each entry has `name`, `description`, `ipAddressRange` (CIDR), and `action` (\"Allow\" or \"Deny\"). A rule set is all-Allow or all-Deny; when Allow rules are present, every other source IP is denied.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Container app variant (\"Functionapp\", \"Workflowapp\", or empty for a plain container app)","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"latestRevisionFqdn":{"name":"latestRevisionFqdn","type":"\u0007","is_mandatory":true,"title":"Latest revision FQDN (where ingress lands)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"latestRevisionName":{"name":"latestRevisionName","type":"\u0007","is_mandatory":true,"title":"Latest revision name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Azure region","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedEnvironment":{"name":"managedEnvironment","type":"\u001bazure.subscription.containerAppService.managedEnvironment","title":"Parent managed environment that hosts the container app","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedEnvironmentId":{"name":"managedEnvironmentId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the parent managed environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxReplicas":{"name":"maxReplicas","type":"\u0005","is_mandatory":true,"title":"Max replica count","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minReplicas":{"name":"minReplicas","type":"\u0005","is_mandatory":true,"title":"Min replica count","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Container App name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"outboundIpAddresses":{"name":"outboundIpAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Outbound IP addresses used by the container app","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the container app's system-assigned managed identity; empty when no system-assigned identity is enabled","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state (\"Succeeded\", \"Failed\", \"Canceled\", \"InProgress\", \"Deleting\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"registries":{"name":"registries","type":"\u0019\n","is_mandatory":true,"title":"Container registry references (server, identity, passwordSecretRef)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"registryAuthUsesIdentity":{"name":"registryAuthUsesIdentity","type":"\u0004","is_mandatory":true,"title":"Whether any registry credential uses managed identity","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"revision":{"name":"revision","type":"\u001bazure.subscription.containerAppService.containerApp.revision","title":"Container App revision","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"revisionMode":{"name":"revisionMode","type":"\u0007","is_mandatory":true,"title":"Active revision mode (\"Single\" or \"Multiple\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"revisions":{"name":"revisions","type":"\u0019\u001bazure.subscription.containerAppService.containerApp.revision","title":"Revision history","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"runningStatus":{"name":"runningStatus","type":"\u0007","is_mandatory":true,"title":"Running status of the container app (\"Running\", \"Stopped\", \"Progressing\", \"Suspended\", \"Ready\")","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scaleRules":{"name":"scaleRules","type":"\u0019\n","is_mandatory":true,"title":"Scale rules","desc":"Each entry has `name` plus exactly one of `http`, `tcp`, `azureQueue`, or `custom` (KEDA), and an optional `auth []` of `{triggerParameter, secretRef}` entries pointing at names in `secretNames`. http:       {metadata: {concurrentRequests}} tcp:        {metadata: {concurrentConnections}} azureQueue: {queueName, queueLength} custom:     {type, metadata, identity}","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secretNames":{"name":"secretNames","type":"\u0019\u0007","is_mandatory":true,"title":"Names of declared secrets (values are not returned by ARM on read)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"stickySessions":{"name":"stickySessions","type":"\u0007","is_mandatory":true,"title":"Sticky sessions affinity (\"none\" or \"sticky\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemAssignedIdentity":{"name":"systemAssignedIdentity","type":"\u001bazure.subscription.managedIdentity","title":"System-assigned managed identity of the container app; null when no system-assigned identity is enabled","desc":"Resolves the system-assigned identity so its role assignments, and their role definitions and permissions, can be traversed, completing the resource-to-privilege leg of an attack path.","min_provider_version":"13.26.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"targetPort":{"name":"targetPort","type":"\u0005","is_mandatory":true,"title":"Target port for ingress","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"transport":{"name":"transport","type":"\u0007","is_mandatory":true,"title":"Allowed transport (\"Auto\", \"Http\", \"Http2\", \"Tcp\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities attached to the container app","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"volumes":{"name":"volumes","type":"\u0019\n","is_mandatory":true,"title":"Volumes referenced by containers (azureFile / emptyDir / secret)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workloadProfileName":{"name":"workloadProfileName","type":"\u0007","is_mandatory":true,"title":"Workload profile name in the parent environment (\"Consumption\" by default)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Container App","desc":"Single Container App workload, exposing ingress posture (external vs internal, transport, allowed origins, IP rules, client-cert mode), revision strategy, scale bounds, secrets and registry auth, and the per-container image and resource definitions.","min_provider_version":"13.10.2","defaults":"name location provisioningState ingressExternal httpsOnly","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerAppService.containerApp.authConfig":{"id":"azure.subscription.containerAppService.containerApp.authConfig","name":"azure.subscription.containerAppService.containerApp.authConfig","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether Easy Auth is enabled at all (Platform.Enabled)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"httpSettings":{"name":"httpSettings","type":"\n","is_mandatory":true,"title":"HTTP settings (requireHttps, route configuration, forward proxy)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityProviders":{"name":"identityProviders","type":"\u0019\u0007","is_mandatory":true,"title":"Configured providers (e.g., \"azureActiveDirectory\", \"github\", \"google\", \"facebook\", \"twitter\", \"apple\", \"customOpenIdConnect\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"login":{"name":"login","type":"\n","is_mandatory":true,"title":"Login config (token store enabled, token refresh extension hours, allowed external redirect URLs)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"AuthConfig name (always \"current\" for the active config)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"unauthenticatedClientAction":{"name":"unauthenticatedClientAction","type":"\u0007","is_mandatory":true,"title":"Action when an unauthenticated request arrives (\"RedirectToLoginPage\", \"AllowAnonymous\", \"Return401\", \"Return403\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Container App Easy Auth (authConfig) configuration","private":true,"min_provider_version":"13.10.2","defaults":"name unauthenticatedClientAction","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerAppService.containerApp.container":{"id":"azure.subscription.containerAppService.containerApp.container","name":"azure.subscription.containerAppService.containerApp.container","fields":{"args":{"name":"args","type":"\u0019\u0007","is_mandatory":true,"title":"Container start args","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"command":{"name":"command","type":"\u0019\u0007","is_mandatory":true,"title":"Container start command","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cpuCores":{"name":"cpuCores","type":"\u0006","is_mandatory":true,"title":"CPU cores (e.g., 0.25, 0.5, 1.0)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"env":{"name":"env","type":"\u0019\n","is_mandatory":true,"title":"Environment variables","desc":"Each entry has `name`, `value` (the inline value), and `secretRef` (name of a declared secret to pull the value from instead).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Composite id: \u003ccontainerAppId\u003e/containers/\u003cname\u003e","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"image":{"name":"image","type":"\u0007","is_mandatory":true,"title":"Image reference (e.g., \"myacr.azurecr.io/api:1.2.3\" or \"...@sha256:...\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"imagePinned":{"name":"imagePinned","type":"\u0004","is_mandatory":true,"title":"Whether the image reference is digest-pinned (contains \"@sha256:\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"memory":{"name":"memory","type":"\u0007","is_mandatory":true,"title":"Memory string as returned by ARM (e.g., \"0.5Gi\", \"1Gi\", \"2Gi\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Container name (within the app)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"probes":{"name":"probes","type":"\u0019\n","is_mandatory":true,"title":"Liveness/readiness/startup probes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"volumeMounts":{"name":"volumeMounts","type":"\u0019\n","is_mandatory":true,"title":"Volume mounts (volumeName, mountPath, subPath)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Container definition inside a Container App","private":true,"min_provider_version":"13.10.2","defaults":"name image imagePinned","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerAppService.containerApp.revision":{"id":"azure.subscription.containerAppService.containerApp.revision","name":"azure.subscription.containerAppService.containerApp.revision","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether this is currently active","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdTime":{"name":"createdTime","type":"\t","is_mandatory":true,"title":"Creation time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"healthState":{"name":"healthState","type":"\u0007","is_mandatory":true,"title":"Health state (\"Healthy\", \"Unhealthy\", \"None\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastActiveTime":{"name":"lastActiveTime","type":"\t","is_mandatory":true,"title":"Last active time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Revision name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningError":{"name":"provisioningError","type":"\u0007","is_mandatory":true,"title":"Platform error message (when provisioning failed)","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicas":{"name":"replicas","type":"\u0005","is_mandatory":true,"title":"Replicas currently running","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"runningState":{"name":"runningState","type":"\u0007","is_mandatory":true,"title":"Running state (\"Running\", \"Processing\", \"Stopped\", \"Degraded\", \"Failed\", \"Unknown\")","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trafficWeight":{"name":"trafficWeight","type":"\u0005","is_mandatory":true,"title":"Traffic weight (% routed in Multiple-revision mode)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Container App revision","private":true,"min_provider_version":"13.10.2","defaults":"name active trafficWeight provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerAppService.job":{"id":"azure.subscription.containerAppService.job","name":"azure.subscription.containerAppService.job","fields":{"containers":{"name":"containers","type":"\u0019\n","is_mandatory":true,"title":"Container definitions (image, env, resources, probes); flattened","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cronExpression":{"name":"cronExpression","type":"\u0007","is_mandatory":true,"title":"Cron expression (when triggerType == \"Schedule\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"eventStreamEndpoint":{"name":"eventStreamEndpoint","type":"\u0007","is_mandatory":true,"title":"Eventstream endpoint URL for log streaming","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"eventTriggerConfig":{"name":"eventTriggerConfig","type":"\n","is_mandatory":true,"title":"Event-driven scaling configuration, set when triggerType is \"Event\"","desc":"Keys: `parallelism`, `replicaCompletionCount`, and `scale` (`minExecutions`, `maxExecutions`, `pollingInterval`, and `rules` holding the KEDA trigger definitions).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity","desc":"Keys: `type` (\"SystemAssigned\", \"UserAssigned\", \"SystemAssigned, UserAssigned\", or \"None\"), `principalId` and `tenantId` of the system-assigned identity, and `userAssignedIdentities` keyed by resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Azure region","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedEnvironmentId":{"name":"managedEnvironmentId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the parent managed environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Job name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"registries":{"name":"registries","type":"\u0019\n","is_mandatory":true,"title":"Container registry references","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"registryAuthUsesIdentity":{"name":"registryAuthUsesIdentity","type":"\u0004","is_mandatory":true,"title":"Whether any registry credential uses managed identity","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicaRetryLimit":{"name":"replicaRetryLimit","type":"\u0005","is_mandatory":true,"title":"Replica retry limit","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicaTimeoutSeconds":{"name":"replicaTimeoutSeconds","type":"\u0005","is_mandatory":true,"title":"Replica timeout (seconds)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secretNames":{"name":"secretNames","type":"\u0019\u0007","is_mandatory":true,"title":"Names of declared secrets (values are not returned by ARM on read)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"triggerType":{"name":"triggerType","type":"\u0007","is_mandatory":true,"title":"Trigger type (\"Manual\", \"Schedule\", \"Event\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workloadProfileName":{"name":"workloadProfileName","type":"\u0007","is_mandatory":true,"title":"Workload profile name in the parent environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Container Apps Job","desc":"Run-to-completion workload, the batch sibling of Azure Container Apps. The `triggerType` field (Manual, Schedule, or Event) selects how the job starts, and the resource surfaces the replica timeout and retry limits, the schedule or event-trigger configuration, the container template, registry and secret auth, the linked managed environment, and the workload profile the job runs on.","min_provider_version":"13.10.2","defaults":"name location triggerType provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerAppService.managedEnvironment":{"id":"azure.subscription.containerAppService.managedEnvironment","name":"azure.subscription.containerAppService.managedEnvironment","fields":{"certificate":{"name":"certificate","type":"\u001bazure.subscription.containerAppService.managedEnvironment.certificate","title":"Certificate uploaded to a Container Apps managed environment","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"certificates":{"name":"certificates","type":"\u0019\u001bazure.subscription.containerAppService.managedEnvironment.certificate","title":"Certificates uploaded to the environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"customDomainConfiguration":{"name":"customDomainConfiguration","type":"\n","is_mandatory":true,"title":"Custom domain configuration (dnsSuffix + cert thumbprint)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"daprComponent":{"name":"daprComponent","type":"\u001bazure.subscription.containerAppService.managedEnvironment.daprComponent","title":"Dapr component configured at the managed environment scope","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"daprComponents":{"name":"daprComponents","type":"\u0019\u001bazure.subscription.containerAppService.managedEnvironment.daprComponent","title":"Dapr components configured at the environment scope","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultDomain":{"name":"defaultDomain","type":"\u0007","is_mandatory":true,"title":"Default DNS suffix for apps in this environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deploymentErrors":{"name":"deploymentErrors","type":"\u0007","is_mandatory":true,"title":"Free-form error string set by ARM when deployment or validation failed","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"httpRouteConfig":{"name":"httpRouteConfig","type":"\u001bazure.subscription.containerAppService.managedEnvironment.httpRouteConfig","title":"HTTP route config attached to a Container Apps managed environment","desc":"Env-scoped routing table that fans traffic across multiple container apps by path or prefix. The `name` field selects the route config within an environment.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"httpRouteConfigs":{"name":"httpRouteConfigs","type":"\u0019\u001bazure.subscription.containerAppService.managedEnvironment.httpRouteConfig","title":"Env-scoped HTTP route configs (routing tables that span multiple container apps)","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ingressConfiguration":{"name":"ingressConfiguration","type":"\n","is_mandatory":true,"title":"Env-wide ingress configuration (workloadProfileName, terminationGracePeriodSeconds, requestIdleTimeout, headerCountLimit)","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"internalLoadBalancerEnabled":{"name":"internalLoadBalancerEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the env's load balancer is internal-only (no public DNS)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kind (e.g., \"serverless\", null for standard)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Azure region","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"logAnalyticsCustomerId":{"name":"logAnalyticsCustomerId","type":"\u0007","is_mandatory":true,"title":"Log Analytics workspace customer ID, when destination is \"log-analytics\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"logAnalyticsDestination":{"name":"logAnalyticsDestination","type":"\u0007","is_mandatory":true,"title":"App-logs destination (\"log-analytics\", \"azure-monitor\", \"none\", or null)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maintenanceConfiguration":{"name":"maintenanceConfiguration","type":"\u001bazure.subscription.containerAppService.managedEnvironment.maintenanceConfiguration","title":"Maintenance configuration on a Container Apps managed environment","desc":"Maintenance window schedule for a managed environment. Container Apps applies infrastructure-level patches during the listed scheduled entries. The `name` field selects the configuration; a managed environment typically has at most one.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"maintenanceConfigurations":{"name":"maintenanceConfigurations","type":"\u0019\u001bazure.subscription.containerAppService.managedEnvironment.maintenanceConfiguration","title":"Env-scoped maintenance window configurations","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Environment name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peerAuthentication":{"name":"peerAuthentication","type":"\n","is_mandatory":true,"title":"Peer authentication settings","desc":"Mutual TLS between apps in the environment. The dict has a single key `mtls`, whose `enabled` bool reports whether app-to-app mTLS is enforced.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peerTrafficConfiguration":{"name":"peerTrafficConfiguration","type":"\n","is_mandatory":true,"title":"Peer traffic settings","desc":"Cluster-internal traffic encryption. The dict has a single key `encryption`, whose `enabled` bool reports whether peer traffic is encrypted.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnection":{"name":"privateEndpointConnection","type":"\u001bazure.subscription.containerAppService.managedEnvironment.privateEndpointConnection","title":"Private endpoint connection on a Container Apps managed environment","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.containerAppService.managedEnvironment.privateEndpointConnection","title":"Private endpoint connections approved on this environment","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state (\"Succeeded\", \"Failed\", \"Canceled\", \"InProgress\", \"Waiting\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether public network access is enabled (\"Enabled\", \"Disabled\", or empty when not set)","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"staticIp":{"name":"staticIp","type":"\u0007","is_mandatory":true,"title":"Static outbound IP for the environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vnetConfiguration":{"name":"vnetConfiguration","type":"\n","is_mandatory":true,"title":"VNET configuration: infrastructureSubnetId, dockerBridgeCidr, platformReservedCidr, platformReservedDnsIP, internal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workloadProfiles":{"name":"workloadProfiles","type":"\u0019\n","is_mandatory":true,"title":"Workload profiles (Consumption + Dedicated D4/D8/E4/...)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zoneRedundant":{"name":"zoneRedundant","type":"\u0004","is_mandatory":true,"title":"Whether zone redundancy is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Container Apps managed environment","desc":"Network, logging, and TLS boundary that hosts a set of container apps. Selectable by ARM id; fields cover VNET delegation, public-network access, peer-traffic mTLS, zone redundancy, and the linked Log Analytics workspace.","min_provider_version":"13.10.2","defaults":"name location provisioningState internalLoadBalancerEnabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerAppService.managedEnvironment.certificate":{"id":"azure.subscription.containerAppService.managedEnvironment.certificate","name":"azure.subscription.containerAppService.managedEnvironment.certificate","fields":{"deploymentErrors":{"name":"deploymentErrors","type":"\u0007","is_mandatory":true,"title":"Free-form error string set by ARM when deployment or validation failed","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"issueDate":{"name":"issueDate","type":"\t","is_mandatory":true,"title":"Issue time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"Certificate issuer (CN of the issuing authority)","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Certificate name within the environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"notAfter":{"name":"notAfter","type":"\t","is_mandatory":true,"title":"Expiration time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicKeyHash":{"name":"publicKeyHash","type":"\u0007","is_mandatory":true,"title":"SHA-256 hash of the certificate's public key","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subjectAlternativeNames":{"name":"subjectAlternativeNames","type":"\u0019\u0007","is_mandatory":true,"title":"Subject alternative names declared on the cert","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subjectName":{"name":"subjectName","type":"\u0007","is_mandatory":true,"title":"Subject name on the cert","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"thumbprint":{"name":"thumbprint","type":"\u0007","is_mandatory":true,"title":"SHA-1 thumbprint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"valid":{"name":"valid","type":"\u0004","is_mandatory":true,"title":"Whether the cert is currently valid (according to ARM)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Certificate uploaded to a Container Apps managed environment","private":true,"min_provider_version":"13.10.2","defaults":"name notAfter valid","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerAppService.managedEnvironment.daprComponent":{"id":"azure.subscription.containerAppService.managedEnvironment.daprComponent","name":"azure.subscription.containerAppService.managedEnvironment.daprComponent","fields":{"componentType":{"name":"componentType","type":"\u0007","is_mandatory":true,"title":"Component type (e.g., \"state.azure.cosmosdb\", \"secretstores.azure.keyvault\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deploymentErrors":{"name":"deploymentErrors","type":"\u0007","is_mandatory":true,"title":"Free-form error string set by ARM when deployment or validation failed","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ignoreErrors":{"name":"ignoreErrors","type":"\u0004","is_mandatory":true,"title":"Whether component init failure is silently ignored","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Component name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state (\"Succeeded\", \"Failed\", \"Canceled\", \"InProgress\", \"Deleting\")","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"Container Apps allowed to use this component","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secretNames":{"name":"secretNames","type":"\u0019\u0007","is_mandatory":true,"title":"Names of declared secrets (values are not returned by ARM on read)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secretsConfigured":{"name":"secretsConfigured","type":"\u0004","is_mandatory":true,"title":"Whether secret values are referenced (vs inline)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Component version (e.g., \"v1\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Dapr component configured at the managed environment scope","private":true,"min_provider_version":"13.10.2","defaults":"name componentType version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerAppService.managedEnvironment.httpRouteConfig":{"id":"azure.subscription.containerAppService.managedEnvironment.httpRouteConfig","name":"azure.subscription.containerAppService.managedEnvironment.httpRouteConfig","fields":{"customDomains":{"name":"customDomains","type":"\u0019\n","is_mandatory":true,"title":"Custom domain bindings on this route config","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fqdn":{"name":"fqdn","type":"\u0007","is_mandatory":true,"title":"FQDN this route config serves","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Route config name within the environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningErrors":{"name":"provisioningErrors","type":"\u0019\n","is_mandatory":true,"title":"Errors encountered while reconciling routes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state (\"Succeeded\", \"Failed\", \"Canceled\", \"Pending\", \"Updating\", \"Waiting\", \"Deleting\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Routing rules","desc":"Each entry has `description`, `routes` (match and action), and `targets` (the container apps, revisions, or labels traffic is sent to).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"HTTP route config attached to a Container Apps managed environment","desc":"Env-scoped routing table that fans traffic across multiple container apps by path or prefix. The `name` field selects the route config within an environment.","private":true,"min_provider_version":"13.11.3","defaults":"name fqdn provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerAppService.managedEnvironment.maintenanceConfiguration":{"id":"azure.subscription.containerAppService.managedEnvironment.maintenanceConfiguration","name":"azure.subscription.containerAppService.managedEnvironment.maintenanceConfiguration","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Configuration name within the environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scheduledEntries":{"name":"scheduledEntries","type":"\u0019\n","is_mandatory":true,"title":"Scheduled maintenance windows — each entry has `weekDay`, `startHourUtc`, `durationHours`","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Maintenance configuration on a Container Apps managed environment","desc":"Maintenance window schedule for a managed environment. Container Apps applies infrastructure-level patches during the listed scheduled entries. The `name` field selects the configuration; a managed environment typically has at most one.","private":true,"min_provider_version":"13.11.3","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerAppService.managedEnvironment.privateEndpointConnection":{"id":"azure.subscription.containerAppService.managedEnvironment.privateEndpointConnection","name":"azure.subscription.containerAppService.managedEnvironment.privateEndpointConnection","fields":{"actionsRequired":{"name":"actionsRequired","type":"\u0007","is_mandatory":true,"title":"Actions required by the consumer (e.g., \"None\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Reason / description supplied with the status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"groupIds":{"name":"groupIds","type":"\u0019\u0007","is_mandatory":true,"title":"Private endpoint group IDs this connection covers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection name within the environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointId":{"name":"privateEndpointId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the private endpoint on the consumer side","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state (\"Succeeded\", \"Failed\", \"Canceled\", \"Creating\", \"Deleting\", \"Updating\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Approval status (\"Approved\", \"Pending\", \"Rejected\", \"Disconnected\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Private endpoint connection on a Container Apps managed environment","private":true,"min_provider_version":"13.11.3","defaults":"name status provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerInstanceService":{"id":"azure.subscription.containerInstanceService","name":"azure.subscription.containerInstanceService","fields":{"containerGroup":{"name":"containerGroup","type":"\u001bazure.subscription.containerInstanceService.containerGroup","title":"Azure Container Instances container group","desc":"Container group, the unit of deployment in ACI that holds one or more containers sharing lifecycle, network, and storage. Exposes group-level networking (public or private IP, exposed ports, subnet delegation), image registry credentials, customer-managed-key encryption, and the confidential-computing SKU. Selected by ARM resource id, for example azure.subscription.containerInstanceService.containerGroup(id: \"/subscriptions/.../containerGroups/mygroup\").","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"containerGroups":{"name":"containerGroups","type":"\u0019\u001bazure.subscription.containerInstanceService.containerGroup","title":"All container groups in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Container Instances","desc":"Container Instances (ACI) container groups in the subscription and the containers within them. The auditable surface includes OS type, restart policy, image pinning, registry authentication, VNET delegation, container security context (privileged, runAsUser), and confidential-ACI usage.","private":true,"min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerInstanceService.containerGroup":{"id":"azure.subscription.containerInstanceService.containerGroup","name":"azure.subscription.containerInstanceService.containerGroup","fields":{"ccePolicyHash":{"name":"ccePolicyHash","type":"\u0007","is_mandatory":true,"title":"SHA-256 hash of the CCE policy (Confidential ACI only)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"confidential":{"name":"confidential","type":"\u0004","is_mandatory":true,"title":"Convenience: sku == \"Confidential\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"container":{"name":"container","type":"\u001bazure.subscription.containerInstanceService.containerGroup.container","title":"Single container inside a container group","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"containers":{"name":"containers","type":"\u0019\u001bazure.subscription.containerInstanceService.containerGroup.container","title":"Containers in the group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dnsConfig":{"name":"dnsConfig","type":"\n","is_mandatory":true,"title":"DNS configuration (nameServers, searchDomains, options)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dnsNameLabelReusePolicy":{"name":"dnsNameLabelReusePolicy","type":"\u0007","is_mandatory":true,"title":"Auto-generated domain name label scope (\"Unsecure\", \"TenantReuse\", \"SubscriptionReuse\", \"ResourceGroupReuse\", \"Noreuse\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryption":{"name":"encryption","type":"\n","is_mandatory":true,"title":"CMK encryption properties (vaultBaseUrl, keyName, keyVersion, identity)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"exposedPorts":{"name":"exposedPorts","type":"\u0019\n","is_mandatory":true,"title":"Exposed ports at the group level — each entry has {port, protocol}","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fqdn":{"name":"fqdn","type":"\u0007","is_mandatory":true,"title":"FQDN, if a DNS name label was set","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hasSecretVolume":{"name":"hasSecretVolume","type":"\u0004","is_mandatory":true,"title":"Convenience: any volume of type \"secret\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity assigned to the group","desc":"Keys: type (\"None\", \"SystemAssigned\", \"UserAssigned\", or \"SystemAssigned, UserAssigned\"), principalId and tenantId of the system-assigned identity, and userAssignedIdentities keyed by identity resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"imageRegistryCredentials":{"name":"imageRegistryCredentials","type":"\u0019\n","is_mandatory":true,"title":"Image registry credentials — each entry has {server, username?, identity?, identityUrl?}","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"initContainers":{"name":"initContainers","type":"\u0019\u001bazure.subscription.containerInstanceService.containerGroup.container","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipAddressType":{"name":"ipAddressType","type":"\u0007","is_mandatory":true,"title":"IP address type (\"Public\", \"Private\", or null)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Azure region","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"logAnalyticsWorkspaceId":{"name":"logAnalyticsWorkspaceId","type":"\u0007","is_mandatory":true,"title":"Diagnostics: log analytics workspace ID linked to this group, if any","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Container group name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"osType":{"name":"osType","type":"\u0007","is_mandatory":true,"title":"OS type (\"Linux\" or \"Windows\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"priority":{"name":"priority","type":"\u0007","is_mandatory":true,"title":"Priority (\"Regular\" or \"Spot\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state (\"Succeeded\", \"Pending\", \"Failed\", \"Canceled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIp":{"name":"publicIp","type":"\u0007","is_mandatory":true,"title":"Public IP address, if any","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"registryAuthUsesIdentity":{"name":"registryAuthUsesIdentity","type":"\u0004","is_mandatory":true,"title":"Whether any registry credential uses managed identity (vs username/password)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"restartPolicy":{"name":"restartPolicy","type":"\u0007","is_mandatory":true,"title":"Restart policy (\"Always\", \"OnFailure\", \"Never\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\u0007","is_mandatory":true,"title":"SKU (\"Standard\", \"Dedicated\", \"Confidential\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnetIds":{"name":"subnetIds","type":"\u0019\u0007","is_mandatory":true,"title":"Subnet ARM resource IDs the group is delegated into (Private only)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"volumes":{"name":"volumes","type":"\u0019\n","is_mandatory":true,"title":"Volumes mounted into containers — entries are azureFile / emptyDir / secret / gitRepo","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"Availability zones the group is pinned to","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Container Instances container group","desc":"Container group, the unit of deployment in ACI that holds one or more containers sharing lifecycle, network, and storage. Exposes group-level networking (public or private IP, exposed ports, subnet delegation), image registry credentials, customer-managed-key encryption, and the confidential-computing SKU. Selected by ARM resource id, for example azure.subscription.containerInstanceService.containerGroup(id: \"/subscriptions/.../containerGroups/mygroup\").","min_provider_version":"13.10.2","defaults":"name location osType sku ipAddressType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerInstanceService.containerGroup.container":{"id":"azure.subscription.containerInstanceService.containerGroup.container","name":"azure.subscription.containerInstanceService.containerGroup.container","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities added to the container beyond the default set","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"allowPrivilegeEscalation":{"name":"allowPrivilegeEscalation","type":"\u0004","is_mandatory":true,"title":"Whether a process can gain more privileges than its parent","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"command":{"name":"command","type":"\u0019\u0007","is_mandatory":true,"title":"Container start command","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cpuCores":{"name":"cpuCores","type":"\u0006","is_mandatory":true,"title":"CPU cores requested","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"currentState":{"name":"currentState","type":"\n","is_mandatory":true,"title":"Current state (state, startTime, exitCode, finishTime, detailStatus)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"droppedCapabilities":{"name":"droppedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities dropped from the container's default set","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"env":{"name":"env","type":"\u0019\n","is_mandatory":true,"title":"Environment variables — each entry has {name, value, secureValue}","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"gpuCount":{"name":"gpuCount","type":"\u0005","is_mandatory":true,"title":"GPU count (zero when no GPU)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"gpuSku":{"name":"gpuSku","type":"\u0007","is_mandatory":true,"title":"GPU SKU (\"K80\", \"P100\", \"V100\"), or null","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Composite id: \u003ccontainerGroupId\u003e/containers/\u003cname\u003e","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"image":{"name":"image","type":"\u0007","is_mandatory":true,"title":"Image reference","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"imagePinned":{"name":"imagePinned","type":"\u0004","is_mandatory":true,"title":"Whether the image reference is digest-pinned (contains \"@sha256:\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"livenessProbe":{"name":"livenessProbe","type":"\n","is_mandatory":true,"title":"Liveness probe","desc":"Keys: exec, httpGet, initialDelaySeconds, periodSeconds, failureThreshold, successThreshold, and timeoutSeconds.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"memoryGB":{"name":"memoryGB","type":"\u0006","is_mandatory":true,"title":"Memory in GB requested","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Container name (within the group)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ports":{"name":"ports","type":"\u0019\n","is_mandatory":true,"title":"Ports exposed by this container — each entry has {port, protocol}","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privileged":{"name":"privileged","type":"\u0004","is_mandatory":true,"title":"Whether the container runs in privileged mode (full host access)","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"readinessProbe":{"name":"readinessProbe","type":"\n","is_mandatory":true,"title":"Readiness probe","desc":"Keys: exec, httpGet, initialDelaySeconds, periodSeconds, failureThreshold, successThreshold, and timeoutSeconds.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"restartCount":{"name":"restartCount","type":"\u0005","is_mandatory":true,"title":"Restart count","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"runAsGroup":{"name":"runAsGroup","type":"\u0005","is_mandatory":true,"title":"GID the container process runs as; null when not pinned","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"runAsUser":{"name":"runAsUser","type":"\u0005","is_mandatory":true,"title":"UID the container process runs as; null when not pinned (may default to root, UID 0)","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"seccompProfile":{"name":"seccompProfile","type":"\u0007","is_mandatory":true,"title":"Seccomp profile applied to the container, or null when none is set","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityContext":{"name":"securityContext","type":"\n","is_mandatory":true,"title":"Raw security context","desc":"Deprecated in favor of privileged, allowPrivilegeEscalation, runAsUser, runAsGroup, seccompProfile, addedCapabilities, and droppedCapabilities.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"volumeMounts":{"name":"volumeMounts","type":"\u0019\n","is_mandatory":true,"title":"Volume mounts (volumeName, mountPath, readOnly)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Single container inside a container group","private":true,"min_provider_version":"13.10.2","defaults":"name image imagePinned","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerRegistryService":{"id":"azure.subscription.containerRegistryService","name":"azure.subscription.containerRegistryService","fields":{"registries":{"name":"registries","type":"\u0019\u001bazure.subscription.containerRegistryService.registry","title":"List of container registries","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"registry":{"name":"registry","type":"\u001bazure.subscription.containerRegistryService.registry","title":"Azure Container Registry","desc":"Managed private Docker and OCI registry that stores and distributes container images and artifacts. Auditing a registry surfaces its SKU tier (Basic, Standard, Premium), whether the admin user and anonymous pull are enabled, the public network access state and the network rule set that restricts inbound traffic, the encryption configuration, and the content-trust, retention, quarantine, and export policies that govern image lifecycle and supply-chain controls. Sub-resources cover geo-replications, webhooks, scope-map and token access, pull-through cache rules, and connected edge registries.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Container Registry service","private":true,"min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerRegistryService.registry":{"id":"azure.subscription.containerRegistryService.registry","name":"azure.subscription.containerRegistryService.registry","fields":{"adminUserEnabled":{"name":"adminUserEnabled","type":"\u0004","is_mandatory":true,"title":"Whether admin user is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"anonymousPullEnabled":{"name":"anonymousPullEnabled","type":"\u0004","is_mandatory":true,"title":"Whether registry-wide pull from unauthenticated clients is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cacheRule":{"name":"cacheRule","type":"\u001bazure.subscription.containerRegistryService.registry.cacheRule","title":"Pull-through cache rule for an Azure Container Registry","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"cacheRules":{"name":"cacheRules","type":"\u0019\u001bazure.subscription.containerRegistryService.registry.cacheRule","title":"Pull-through cache rules from upstream registries","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectedRegistries":{"name":"connectedRegistries","type":"\u0019\u001bazure.subscription.containerRegistryService.registry.connectedRegistry","title":"Connected (edge/on-prem) registries that mirror this registry","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectedRegistry":{"name":"connectedRegistry","type":"\u001bazure.subscription.containerRegistryService.registry.connectedRegistry","title":"Connected (edge/on-prem) registry that mirrors an Azure Container Registry","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"creationDate":{"name":"creationDate","type":"\t","is_mandatory":true,"title":"Registry creation date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"credentialSet":{"name":"credentialSet","type":"\u001bazure.subscription.containerRegistryService.registry.credentialSet","title":"Credential set referenced by cache rules in an Azure Container Registry","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"credentialSets":{"name":"credentialSets","type":"\u0019\u001bazure.subscription.containerRegistryService.registry.credentialSet","title":"Credential sets referenced by cache rules (Key Vault-backed upstream credentials)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataEndpointEnabled":{"name":"dataEndpointEnabled","type":"\u0004","is_mandatory":true,"title":"Whether data endpoint is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryption":{"name":"encryption","type":"\u001bazure.subscription.containerRegistryService.registry.encryption","title":"Encryption configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Registry resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Identity configuration","desc":"Deprecated in favor of principalId, tenantId, and userAssignedIdentities, which expose the managed identity configuration as typed accessors.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Registry location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"loginServer":{"name":"loginServer","type":"\u0007","is_mandatory":true,"title":"Login server URL","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Registry name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkRuleBypassAllowedForTasks":{"name":"networkRuleBypassAllowedForTasks","type":"\u0004","is_mandatory":true,"title":"Whether ACR Tasks are allowed to bypass the network rules (\"True\"/\"False\" semantics surfaced as a bool)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkRuleBypassOptions":{"name":"networkRuleBypassOptions","type":"\u0007","is_mandatory":true,"title":"Network rule bypass options (\"AzureServices\" or \"None\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkRuleSet":{"name":"networkRuleSet","type":"\u001bazure.subscription.containerRegistryService.registry.networkRuleSet","title":"Network rule set configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policies":{"name":"policies","type":"\u001bazure.subscription.containerRegistryService.registry.policies","title":"Registry policies (trust, retention, quarantine, export)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the registry's system-assigned managed identity; empty when no system-assigned identity is enabled","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access setting (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replication":{"name":"replication","type":"\u001bazure.subscription.containerRegistryService.registry.replication","title":"Geo-replication for an Azure Container Registry","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"replications":{"name":"replications","type":"\u0019\u001bazure.subscription.containerRegistryService.registry.replication","title":"Geo-replications","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleAssignmentMode":{"name":"roleAssignmentMode","type":"\u0007","is_mandatory":true,"title":"Registry role assignment mode (\"AbacRepositoryPermissions\" or \"LegacyRegistryPermissions\")","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scopeMap":{"name":"scopeMap","type":"\u001bazure.subscription.containerRegistryService.registry.scopeMap","title":"Scope map for token-based access in an Azure Container Registry","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"scopeMaps":{"name":"scopeMaps","type":"\u0019\u001bazure.subscription.containerRegistryService.registry.scopeMap","title":"Scope maps for token-based access","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"SKU name (\"Basic\", \"Standard\", or \"Premium\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Registry tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Tenant ID of the registry's managed identity; empty when no managed identity is configured","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"token":{"name":"token","type":"\u001bazure.subscription.containerRegistryService.registry.token","title":"Repository-scoped access token for an Azure Container Registry","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"tokens":{"name":"tokens","type":"\u0019\u001bazure.subscription.containerRegistryService.registry.token","title":"Repository-scoped access tokens","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities attached to the registry","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"webhook":{"name":"webhook","type":"\u001bazure.subscription.containerRegistryService.registry.webhook","title":"Webhook for an Azure Container Registry","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"webhooks":{"name":"webhooks","type":"\u0019\u001bazure.subscription.containerRegistryService.registry.webhook","title":"Webhooks configured on the registry","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zoneRedundancy":{"name":"zoneRedundancy","type":"\u0007","is_mandatory":true,"title":"Zone redundancy setting (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Container Registry","desc":"Managed private Docker and OCI registry that stores and distributes container images and artifacts. Auditing a registry surfaces its SKU tier (Basic, Standard, Premium), whether the admin user and anonymous pull are enabled, the public network access state and the network rule set that restricts inbound traffic, the encryption configuration, and the content-trust, retention, quarantine, and export policies that govern image lifecycle and supply-chain controls. Sub-resources cover geo-replications, webhooks, scope-map and token access, pull-through cache rules, and connected edge registries.","min_provider_version":"13.3.3","defaults":"id name location skuName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerRegistryService.registry.cacheRule":{"id":"azure.subscription.containerRegistryService.registry.cacheRule","name":"azure.subscription.containerRegistryService.registry.cacheRule","fields":{"creationDate":{"name":"creationDate","type":"\t","is_mandatory":true,"title":"Cache rule creation date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"credentialSet":{"name":"credentialSet","type":"\u001bazure.subscription.containerRegistryService.registry.credentialSet","title":"Credential set used by this cache rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"credentialSetResourceId":{"name":"credentialSetResourceId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the credential set associated with the cache rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cache rule resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cache rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceRepository":{"name":"sourceRepository","type":"\u0007","is_mandatory":true,"title":"Source repository pulled from upstream","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"targetRepository":{"name":"targetRepository","type":"\u0007","is_mandatory":true,"title":"Target repository in this registry","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Pull-through cache rule for an Azure Container Registry","private":true,"min_provider_version":"13.5.1","defaults":"id name sourceRepository targetRepository","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerRegistryService.registry.connectedRegistry":{"id":"azure.subscription.containerRegistryService.registry.connectedRegistry","name":"azure.subscription.containerRegistryService.registry.connectedRegistry","fields":{"activationStatus":{"name":"activationStatus","type":"\u0007","is_mandatory":true,"title":"Activation status (\"Active\" or \"Inactive\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"auditLogStatus":{"name":"auditLogStatus","type":"\u0007","is_mandatory":true,"title":"Audit log status (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"clientTokenIds":{"name":"clientTokenIds","type":"\u0019\u0007","is_mandatory":true,"title":"ACR token resource IDs used to authenticate clients connecting to this registry","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionState":{"name":"connectionState","type":"\u0007","is_mandatory":true,"title":"Current connection state (\"Online\", \"Offline\", \"Syncing\", or \"Unhealthy\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"garbageCollectionEnabled":{"name":"garbageCollectionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether garbage collection is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"garbageCollectionSchedule":{"name":"garbageCollectionSchedule","type":"\u0007","is_mandatory":true,"title":"Cron schedule for garbage collection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connected registry resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastActivityTime":{"name":"lastActivityTime","type":"\t","is_mandatory":true,"title":"Last activity time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"logLevel":{"name":"logLevel","type":"\u0007","is_mandatory":true,"title":"Verbosity of logs persisted on the connected registry (\"Debug\", \"Information\", \"Warning\", \"Error\", or \"None\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"loginServerHost":{"name":"loginServerHost","type":"\u0007","is_mandatory":true,"title":"Login server hostname (FQDN or IP) for the connected registry","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Permission mode of the connected registry (\"Mirror\", \"ReadOnly\", \"ReadWrite\", or \"Registry\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connected registry name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"notificationsList":{"name":"notificationsList","type":"\u0019\u0007","is_mandatory":true,"title":"Notification subscriptions","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"parentId":{"name":"parentId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the parent registry/connected-registry","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"syncLastSyncTime":{"name":"syncLastSyncTime","type":"\t","is_mandatory":true,"title":"Last successful sync time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"syncMessageTtl":{"name":"syncMessageTtl","type":"\u0007","is_mandatory":true,"title":"Sync message TTL (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"syncSchedule":{"name":"syncSchedule","type":"\u0007","is_mandatory":true,"title":"Cron schedule for parent sync","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"syncTokenId":{"name":"syncTokenId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the ACR token used to authenticate sync to the parent","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"syncWindow":{"name":"syncWindow","type":"\u0007","is_mandatory":true,"title":"Sync window duration (ISO 8601, e.g. \"PT3H\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tlsStatus":{"name":"tlsStatus","type":"\u0007","is_mandatory":true,"title":"Login server TLS status (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"ACR runtime version on the connected registry","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Connected (edge/on-prem) registry that mirrors an Azure Container Registry","private":true,"min_provider_version":"13.5.1","defaults":"id name mode connectionState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerRegistryService.registry.credentialSet":{"id":"azure.subscription.containerRegistryService.registry.credentialSet","name":"azure.subscription.containerRegistryService.registry.credentialSet","fields":{"authCredentials":{"name":"authCredentials","type":"\u0019\n","is_mandatory":true,"title":"Upstream authentication credentials","desc":"Each entry carries `name` (\"Credential1\"), the Key Vault secret URIs `usernameSecretIdentifier` and `passwordSecretIdentifier` for the username and password, and `credentialHealth` describing the last validation status. Secret values are never returned.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationDate":{"name":"creationDate","type":"\t","is_mandatory":true,"title":"Credential set creation date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Credential set resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity used to read the Key Vault secrets","desc":"Carries `type` (\"SystemAssigned\", \"UserAssigned\", \"SystemAssigned, UserAssigned\", or \"None\"), `principalId`, `tenantId`, and `userAssignedIdentities` (map keyed by user-assigned identity resource ID).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"loginServer":{"name":"loginServer","type":"\u0007","is_mandatory":true,"title":"The upstream login server the credentials apply to (e.g. \"docker.io\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Credential set name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Credential set referenced by cache rules in an Azure Container Registry","private":true,"min_provider_version":"13.5.1","defaults":"id name loginServer","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerRegistryService.registry.encryption":{"id":"azure.subscription.containerRegistryService.registry.encryption","name":"azure.subscription.containerRegistryService.registry.encryption","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Encryption identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"key":{"name":"key","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used for encryption","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyRotationEnabled":{"name":"keyRotationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether automatic key rotation is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultKeyIdentifier":{"name":"keyVaultKeyIdentifier","type":"\u0007","is_mandatory":true,"title":"Key Vault key identifier URI","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastKeyRotationTimestamp":{"name":"lastKeyRotationTimestamp","type":"\t","is_mandatory":true,"title":"Timestamp of last key rotation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Encryption status (\"enabled\" or \"disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Encryption configuration for an Azure Container Registry","private":true,"min_provider_version":"13.3.3","defaults":"status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerRegistryService.registry.networkRuleSet":{"id":"azure.subscription.containerRegistryService.registry.networkRuleSet","name":"azure.subscription.containerRegistryService.registry.networkRuleSet","fields":{"defaultAction":{"name":"defaultAction","type":"\u0007","is_mandatory":true,"title":"Default action (\"Allow\" or \"Deny\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Network rule set identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipRule":{"name":"ipRule","type":"\u001bazure.subscription.containerRegistryService.registry.networkRuleSet.ipRule","title":"IP rule in a container registry network rule set","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"ipRules":{"name":"ipRules","type":"\u0019\u001bazure.subscription.containerRegistryService.registry.networkRuleSet.ipRule","title":"IP rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network rule set for an Azure Container Registry","private":true,"min_provider_version":"13.3.3","defaults":"defaultAction","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerRegistryService.registry.networkRuleSet.ipRule":{"id":"azure.subscription.containerRegistryService.registry.networkRuleSet.ipRule","name":"azure.subscription.containerRegistryService.registry.networkRuleSet.ipRule","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action (\"Allow\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"IP rule identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipAddressOrRange":{"name":"ipAddressOrRange","type":"\u0007","is_mandatory":true,"title":"IP address or CIDR range","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"IP rule in a container registry network rule set","private":true,"min_provider_version":"13.3.3","defaults":"ipAddressOrRange action","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerRegistryService.registry.policies":{"id":"azure.subscription.containerRegistryService.registry.policies","name":"azure.subscription.containerRegistryService.registry.policies","fields":{"azureADAuthenticationAsArmPolicyEnabled":{"name":"azureADAuthenticationAsArmPolicyEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the AAD-as-ARM authentication policy is enabled (rejects ACR-audience tokens; requires ARM-audience tokens)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"exportPolicyEnabled":{"name":"exportPolicyEnabled","type":"\u0004","is_mandatory":true,"title":"Whether export policy is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policies identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"quarantinePolicyEnabled":{"name":"quarantinePolicyEnabled","type":"\u0004","is_mandatory":true,"title":"Whether quarantine policy is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionPolicyDays":{"name":"retentionPolicyDays","type":"\u0005","is_mandatory":true,"title":"Number of days to retain untagged manifests","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionPolicyEnabled":{"name":"retentionPolicyEnabled","type":"\u0004","is_mandatory":true,"title":"Whether untagged manifest retention is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trustPolicyEnabled":{"name":"trustPolicyEnabled","type":"\u0004","is_mandatory":true,"title":"Whether content trust (Notary) is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trustPolicyType":{"name":"trustPolicyType","type":"\u0007","is_mandatory":true,"title":"Trust policy type (\"Notary\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Policies for an Azure Container Registry","private":true,"min_provider_version":"13.3.3","defaults":"trustPolicyEnabled retentionPolicyEnabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerRegistryService.registry.replication":{"id":"azure.subscription.containerRegistryService.registry.replication","name":"azure.subscription.containerRegistryService.registry.replication","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Replication resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Replication location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Replication name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"regionEndpointEnabled":{"name":"regionEndpointEnabled","type":"\u0004","is_mandatory":true,"title":"Whether regional endpoint is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Replication tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zoneRedundancy":{"name":"zoneRedundancy","type":"\u0007","is_mandatory":true,"title":"Zone redundancy setting (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Geo-replication for an Azure Container Registry","private":true,"min_provider_version":"13.3.3","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerRegistryService.registry.scopeMap":{"id":"azure.subscription.containerRegistryService.registry.scopeMap","name":"azure.subscription.containerRegistryService.registry.scopeMap","fields":{"actions":{"name":"actions","type":"\u0019\u0007","is_mandatory":true,"title":"List of allowed actions (e.g., \"repositories/repo/content/read\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationDate":{"name":"creationDate","type":"\t","is_mandatory":true,"title":"Scope map creation date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the scope map","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Scope map resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Scope map name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Scope map for token-based access in an Azure Container Registry","private":true,"min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerRegistryService.registry.token":{"id":"azure.subscription.containerRegistryService.registry.token","name":"azure.subscription.containerRegistryService.registry.token","fields":{"certificates":{"name":"certificates","type":"\u0019\n","is_mandatory":true,"title":"Certificate credentials that authenticate the token","desc":"Each entry carries `name` (\"certificate1\" or \"certificate2\"), `encodedPemCertificate` (base64-encoded public certificate in PEM format), `expiry`, and `thumbprint`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationDate":{"name":"creationDate","type":"\t","is_mandatory":true,"title":"Token creation date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Token resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Token name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"passwords":{"name":"passwords","type":"\u0019\n","is_mandatory":true,"title":"Token password credentials","desc":"Each entry carries the password `name`, `creationTime`, and `expiry`. An absent expiry means the password never expires. Secret values are never returned.","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scopeMap":{"name":"scopeMap","type":"\u001bazure.subscription.containerRegistryService.registry.scopeMap","title":"Scope map that defines token permissions","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Token status (\"enabled\" or \"disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Repository-scoped access token for an Azure Container Registry","private":true,"min_provider_version":"13.3.3","defaults":"id name status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.containerRegistryService.registry.webhook":{"id":"azure.subscription.containerRegistryService.registry.webhook","name":"azure.subscription.containerRegistryService.registry.webhook","fields":{"actions":{"name":"actions","type":"\u0019\u0007","is_mandatory":true,"title":"Actions that trigger the webhook (e.g., \"push\", \"delete\", \"quarantine\", \"chart_push\", \"chart_delete\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Webhook resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Webhook location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Webhook name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Repository scope filter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Webhook status (\"enabled\" or \"disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Webhook tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Webhook for an Azure Container Registry","private":true,"min_provider_version":"13.3.3","defaults":"id name status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService":{"id":"azure.subscription.cosmosDbService","name":"azure.subscription.cosmosDbService","fields":{"account":{"name":"account","type":"\u001bazure.subscription.cosmosDbService.account","title":"Azure Cosmos DB account","desc":"Top-level resource of the Azure Cosmos DB multi-model NoSQL service. The account `kind` (GlobalDocumentDB, MongoDB, or Parse) selects which API surface the account serves. Audit an account for its network exposure (public network access, IP firewall rules, virtual-network rules, and network ACL bypass for Azure services), its default consistency level, its encryption posture (customer-managed key and the identity used to reach Key Vault), whether local key-based authentication is disabled in favor of Entra ID, the backup policy, and the data-plane RBAC role definitions and assignments granted across the SQL, Cassandra, Gremlin, Table, and MongoDB managed-instance APIs.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"accounts":{"name":"accounts","type":"\u0019\u001bazure.subscription.cosmosDbService.account","title":"List of Cosmos DB accounts","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mongoCluster":{"name":"mongoCluster","type":"\u001bazure.subscription.cosmosDbService.mongoCluster","title":"Azure Cosmos DB for MongoDB (vCore) cluster","desc":"Cosmos DB for MongoDB (vCore) cluster (`Microsoft.DocumentDB/mongoClusters`), a distinct Azure resource from a classic Cosmos DB account. Audit the compute tier and data-disk size, shard count, high availability mode, MongoDB server version, allowed authentication modes, Mongo Data API access, public network access, the customer-managed encryption key, and the replication role and state.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"mongoClusters":{"name":"mongoClusters","type":"\u0019\u001bazure.subscription.cosmosDbService.mongoCluster","title":"List of Cosmos DB for MongoDB (vCore) clusters","min_provider_version":"13.12.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"postgresqlCluster":{"name":"postgresqlCluster","type":"\u001bazure.subscription.cosmosDbService.postgresqlCluster","title":"Azure Cosmos DB for PostgreSQL cluster","desc":"Cosmos DB for PostgreSQL (Citus) cluster (`Microsoft.DBforPostgreSQL/serverGroupsv2`), a distinct Azure resource from a classic Cosmos DB account. Audit the PostgreSQL and Citus versions, coordinator and worker-node compute (vCores, storage quota, server edition), worker node count, high availability, public IP access on the coordinator and worker nodes, the maintenance window, and the read-replica topology.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"postgresqlClusters":{"name":"postgresqlClusters","type":"\u0019\u001bazure.subscription.cosmosDbService.postgresqlCluster","title":"List of Cosmos DB for PostgreSQL clusters","min_provider_version":"13.12.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB","desc":"Entry point to Azure Cosmos DB resources in a subscription. Lists the classic multi-model Cosmos DB accounts, the Cosmos DB for MongoDB (vCore) clusters, and the Cosmos DB for PostgreSQL (Citus) clusters, each a distinct Azure resource type with its own configuration and security posture.","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account":{"id":"azure.subscription.cosmosDbService.account","name":"azure.subscription.cosmosDbService.account","fields":{"backupIntervalInMinutes":{"name":"backupIntervalInMinutes","type":"\u0005","is_mandatory":true,"title":"Backup interval in minutes (for Periodic backup policy)","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"backupRetentionIntervalInHours":{"name":"backupRetentionIntervalInHours","type":"\u0005","is_mandatory":true,"title":"Backup retention in hours (for Periodic backup policy)","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"backupStorageRedundancy":{"name":"backupStorageRedundancy","type":"\u0007","is_mandatory":true,"title":"Backup storage redundancy (for Periodic backup policy: \"Geo\", \"Local\", \"Zone\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"backupType":{"name":"backupType","type":"\u0007","is_mandatory":true,"title":"Backup policy type (\"Periodic\" or \"Continuous\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cassandraRoleAssignment":{"name":"cassandraRoleAssignment","type":"\u001bazure.subscription.cosmosDbService.account.cassandraRoleAssignment","title":"Azure Cosmos DB Cassandra data-plane role assignment","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"cassandraRoleAssignments":{"name":"cassandraRoleAssignments","type":"\u0019\u001bazure.subscription.cosmosDbService.account.cassandraRoleAssignment","title":"Cosmos DB Cassandra data-plane role assignments","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cassandraRoleDefinition":{"name":"cassandraRoleDefinition","type":"\u001bazure.subscription.cosmosDbService.account.cassandraRoleDefinition","title":"Azure Cosmos DB Cassandra data-plane role definition","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"cassandraRoleDefinitions":{"name":"cassandraRoleDefinitions","type":"\u0019\u001bazure.subscription.cosmosDbService.account.cassandraRoleDefinition","title":"Cosmos DB Cassandra data-plane role definitions (built-in and custom)","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"corsAllowedOrigins":{"name":"corsAllowedOrigins","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed origins from the account's CORS policies (empty when CORS is not configured)","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultConsistencyLevel":{"name":"defaultConsistencyLevel","type":"\u0007","is_mandatory":true,"title":"Default consistency level (\"Eventual\", \"Session\", \"BoundedStaleness\", \"Strong\", \"ConsistentPrefix\")","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultIdentity":{"name":"defaultIdentity","type":"\u0007","is_mandatory":true,"title":"Default identity used for accessing customer-managed encryption key","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettings":{"name":"diagnosticSettings","type":"\u0019\u001bazure.subscription.monitorService.diagnosticsetting","title":"Diagnostic settings configured on the Cosmos DB account","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettingsCategories":{"name":"diagnosticSettingsCategories","type":"\u0019\u001bazure.subscription.monitorService.diagnosticSettingsCategory","title":"Diagnostic settings categories the Cosmos DB account can emit (available log and metric categories)","min_provider_version":"13.30.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableKeyBasedMetadataWriteAccess":{"name":"disableKeyBasedMetadataWriteAccess","type":"\u0004","is_mandatory":true,"title":"Whether key-based metadata write access is disabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether local authentication is disabled (requires Entra ID)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableAutomaticFailover":{"name":"enableAutomaticFailover","type":"\u0004","is_mandatory":true,"title":"Whether automatic failover is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableMultipleWriteLocations":{"name":"enableMultipleWriteLocations","type":"\u0004","is_mandatory":true,"title":"Whether multi-region write is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionKey":{"name":"encryptionKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used for customer-managed encryption (null if platform-managed)","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"gremlinRoleAssignment":{"name":"gremlinRoleAssignment","type":"\u001bazure.subscription.cosmosDbService.account.gremlinRoleAssignment","title":"Azure Cosmos DB Gremlin data-plane role assignment","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"gremlinRoleAssignments":{"name":"gremlinRoleAssignments","type":"\u0019\u001bazure.subscription.cosmosDbService.account.gremlinRoleAssignment","title":"Cosmos DB Gremlin data-plane role assignments","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"gremlinRoleDefinition":{"name":"gremlinRoleDefinition","type":"\u001bazure.subscription.cosmosDbService.account.gremlinRoleDefinition","title":"Azure Cosmos DB Gremlin data-plane role definition","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"gremlinRoleDefinitions":{"name":"gremlinRoleDefinitions","type":"\u0019\u001bazure.subscription.cosmosDbService.account.gremlinRoleDefinition","title":"Cosmos DB Gremlin data-plane role definitions (built-in and custom)","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cosmos DB account ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityType":{"name":"identityType","type":"\u0007","is_mandatory":true,"title":"Type of managed identity configured on the account","desc":"One of \"SystemAssigned\", \"UserAssigned\", \"SystemAssigned,UserAssigned\", or \"None\".","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipRangeFilter":{"name":"ipRangeFilter","type":"\u0019\u0007","is_mandatory":true,"title":"IP address or CIDR ranges allowed by IP firewall rules","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isVirtualNetworkFilterEnabled":{"name":"isVirtualNetworkFilterEnabled","type":"\u0004","is_mandatory":true,"title":"Whether virtual network filtering is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Cosmos DB account kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Cosmos DB account location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"locations":{"name":"locations","type":"\u0019\u0007","is_mandatory":true,"title":"Names of the regions the account is deployed to (more than one indicates multi-region)","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minimalTlsVersion":{"name":"minimalTlsVersion","type":"\u0007","is_mandatory":true,"title":"Minimum allowed TLS version for the Cosmos DB account","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mongoMIRoleAssignment":{"name":"mongoMIRoleAssignment","type":"\u001bazure.subscription.cosmosDbService.account.mongoMIRoleAssignment","title":"Azure Cosmos DB MongoDB managed-instance data-plane role assignment","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"mongoMIRoleAssignments":{"name":"mongoMIRoleAssignments","type":"\u0019\u001bazure.subscription.cosmosDbService.account.mongoMIRoleAssignment","title":"Cosmos DB MongoDB managed-instance data-plane role assignments","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mongoMIRoleDefinition":{"name":"mongoMIRoleDefinition","type":"\u001bazure.subscription.cosmosDbService.account.mongoMIRoleDefinition","title":"Azure Cosmos DB MongoDB managed-instance data-plane role definition","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"mongoMIRoleDefinitions":{"name":"mongoMIRoleDefinitions","type":"\u0019\u001bazure.subscription.cosmosDbService.account.mongoMIRoleDefinition","title":"Cosmos DB MongoDB managed-instance data-plane role definitions (built-in and custom)","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cosmos DB account name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkAclBypass":{"name":"networkAclBypass","type":"\u0007","is_mandatory":true,"title":"Network ACL bypass setting (\"None\" or \"AzureServices\")","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the account's system-assigned managed identity; empty when no system-assigned identity is enabled","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections for the Cosmos DB account","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Cosmos DB account properties","desc":"The full DatabaseAccountGetProperties payload as returned by Azure Resource Manager. Most values are also surfaced as typed sibling fields (for example defaultConsistencyLevel, publicNetworkAccess, ipRangeFilter, and the backup* fields); use this dict for values not otherwise modeled.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether public network access is enabled for the Cosmos DB account","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sqlDatabase":{"name":"sqlDatabase","type":"\u001bazure.subscription.cosmosDbService.account.sqlDatabase","title":"Azure Cosmos DB SQL API database","desc":"SQL-API (Core) database hosted on a Cosmos DB account, selectable by its ARM resource id. The throughput posture distinguishes manually provisioned RU/s from an autoscale ceiling, and `throughputPerContainer` marks the case where throughput is set per-container rather than at the database level. The contained containers are exposed as a sub-resource.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"sqlDatabases":{"name":"sqlDatabases","type":"\u0019\u001bazure.subscription.cosmosDbService.account.sqlDatabase","title":"SQL API databases hosted on the account (Core SQL API)","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sqlRoleAssignment":{"name":"sqlRoleAssignment","type":"\u001bazure.subscription.cosmosDbService.account.sqlRoleAssignment","title":"Azure Cosmos DB SQL data-plane role assignment","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"sqlRoleAssignments":{"name":"sqlRoleAssignments","type":"\u0019\u001bazure.subscription.cosmosDbService.account.sqlRoleAssignment","title":"Cosmos DB SQL data-plane role assignments","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sqlRoleDefinition":{"name":"sqlRoleDefinition","type":"\u001bazure.subscription.cosmosDbService.account.sqlRoleDefinition","title":"Azure Cosmos DB SQL data-plane role definition (data-plane RBAC, separate from Azure ARM roles)","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"sqlRoleDefinitions":{"name":"sqlRoleDefinitions","type":"\u0019\u001bazure.subscription.cosmosDbService.account.sqlRoleDefinition","title":"Cosmos DB SQL data-plane role definitions (built-in and custom)","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tableRoleAssignment":{"name":"tableRoleAssignment","type":"\u001bazure.subscription.cosmosDbService.account.tableRoleAssignment","title":"Azure Cosmos DB Table data-plane role assignment","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"tableRoleAssignments":{"name":"tableRoleAssignments","type":"\u0019\u001bazure.subscription.cosmosDbService.account.tableRoleAssignment","title":"Cosmos DB Table data-plane role assignments","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tableRoleDefinition":{"name":"tableRoleDefinition","type":"\u001bazure.subscription.cosmosDbService.account.tableRoleDefinition","title":"Azure Cosmos DB Table data-plane role definition","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"tableRoleDefinitions":{"name":"tableRoleDefinitions","type":"\u0019\u001bazure.subscription.cosmosDbService.account.tableRoleDefinition","title":"Cosmos DB Table data-plane role definitions (built-in and custom)","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Cosmos DB account tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Tenant ID of the account's system-assigned managed identity","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Cosmos DB account type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities attached to the Cosmos DB account","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkRule":{"name":"virtualNetworkRule","type":"\u001bazure.subscription.cosmosDbService.account.virtualNetworkRule","title":"Azure Cosmos DB account virtual network rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualNetworkRules":{"name":"virtualNetworkRules","type":"\u0019\u001bazure.subscription.cosmosDbService.account.virtualNetworkRule","is_mandatory":true,"title":"Virtual network rules for the Cosmos DB account","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB account","desc":"Top-level resource of the Azure Cosmos DB multi-model NoSQL service. The account `kind` (GlobalDocumentDB, MongoDB, or Parse) selects which API surface the account serves. Audit an account for its network exposure (public network access, IP firewall rules, virtual-network rules, and network ACL bypass for Azure services), its default consistency level, its encryption posture (customer-managed key and the identity used to reach Key Vault), whether local key-based authentication is disabled in favor of Entra ID, the backup policy, and the data-plane RBAC role definitions and assignments granted across the SQL, Cassandra, Gremlin, Table, and MongoDB managed-instance APIs.","min_provider_version":"9.0.1","defaults":"name kind location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account.cassandraRoleAssignment":{"id":"azure.subscription.cosmosDbService.account.cassandraRoleAssignment","name":"azure.subscription.cosmosDbService.account.cassandraRoleAssignment","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource name (a GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"AAD principal granted access by this assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the role assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleDefinitionId":{"name":"roleDefinitionId","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition ID this assignment binds","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Data-plane scope this assignment applies to (account, database, or table)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB Cassandra data-plane role assignment","private":true,"min_provider_version":"13.31.1","defaults":"name principalId scope","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account.cassandraRoleDefinition":{"id":"azure.subscription.cosmosDbService.account.cassandraRoleDefinition","name":"azure.subscription.cosmosDbService.account.cassandraRoleDefinition","fields":{"assignableScopes":{"name":"assignableScopes","type":"\u0019\u0007","is_mandatory":true,"title":"Scopes at or below which assignments using this definition may be created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource name (a GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"permissions":{"name":"permissions","type":"\u0019\n","is_mandatory":true,"title":"Permission set granted by this role (Cosmos permission JSON: dataActions, notDataActions)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleName":{"name":"roleName","type":"\u0007","is_mandatory":true,"title":"User-friendly role name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleType":{"name":"roleType","type":"\u0007","is_mandatory":true,"title":"\"BuiltInRole\" or \"CustomRole\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB Cassandra data-plane role definition","private":true,"min_provider_version":"13.31.1","defaults":"name roleName roleType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account.gremlinRoleAssignment":{"id":"azure.subscription.cosmosDbService.account.gremlinRoleAssignment","name":"azure.subscription.cosmosDbService.account.gremlinRoleAssignment","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource name (a GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"AAD principal granted access by this assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the role assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleDefinitionId":{"name":"roleDefinitionId","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition ID this assignment binds","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Data-plane scope this assignment applies to (account, database, or graph)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB Gremlin data-plane role assignment","private":true,"min_provider_version":"13.31.1","defaults":"name principalId scope","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account.gremlinRoleDefinition":{"id":"azure.subscription.cosmosDbService.account.gremlinRoleDefinition","name":"azure.subscription.cosmosDbService.account.gremlinRoleDefinition","fields":{"assignableScopes":{"name":"assignableScopes","type":"\u0019\u0007","is_mandatory":true,"title":"Scopes at or below which assignments using this definition may be created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource name (a GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"permissions":{"name":"permissions","type":"\u0019\n","is_mandatory":true,"title":"Permission set granted by this role (Cosmos permission JSON: dataActions, notDataActions)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleName":{"name":"roleName","type":"\u0007","is_mandatory":true,"title":"User-friendly role name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleType":{"name":"roleType","type":"\u0007","is_mandatory":true,"title":"\"BuiltInRole\" or \"CustomRole\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB Gremlin data-plane role definition","private":true,"min_provider_version":"13.31.1","defaults":"name roleName roleType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account.mongoMIRoleAssignment":{"id":"azure.subscription.cosmosDbService.account.mongoMIRoleAssignment","name":"azure.subscription.cosmosDbService.account.mongoMIRoleAssignment","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource name (a GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"AAD principal granted access by this assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the role assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleDefinitionId":{"name":"roleDefinitionId","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition ID this assignment binds","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Data-plane scope this assignment applies to (account, database, or collection)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB MongoDB managed-instance data-plane role assignment","private":true,"min_provider_version":"13.31.1","defaults":"name principalId scope","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account.mongoMIRoleDefinition":{"id":"azure.subscription.cosmosDbService.account.mongoMIRoleDefinition","name":"azure.subscription.cosmosDbService.account.mongoMIRoleDefinition","fields":{"assignableScopes":{"name":"assignableScopes","type":"\u0019\u0007","is_mandatory":true,"title":"Scopes at or below which assignments using this definition may be created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource name (a GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"permissions":{"name":"permissions","type":"\u0019\n","is_mandatory":true,"title":"Permission set granted by this role (Cosmos permission JSON: dataActions, notDataActions)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleName":{"name":"roleName","type":"\u0007","is_mandatory":true,"title":"User-friendly role name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleType":{"name":"roleType","type":"\u0007","is_mandatory":true,"title":"\"BuiltInRole\" or \"CustomRole\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB MongoDB managed-instance data-plane role definition","private":true,"min_provider_version":"13.31.1","defaults":"name roleName roleType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account.sqlDatabase":{"id":"azure.subscription.cosmosDbService.account.sqlDatabase","name":"azure.subscription.cosmosDbService.account.sqlDatabase","fields":{"autoscaleEnabled":{"name":"autoscaleEnabled","type":"\u0004","title":"Whether autoscale is enabled at the database level","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"autoscaleMaxThroughput":{"name":"autoscaleMaxThroughput","type":"\u0005","title":"Autoscale max throughput in RU/s at the database level","desc":"Zero when not autoscale or when configured per-container.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"container":{"name":"container","type":"\u001bazure.subscription.cosmosDbService.account.sqlDatabase.container","title":"Azure Cosmos DB SQL API container","desc":"SQL-API container within a Cosmos DB database, selectable by its ARM resource id. Audit the partition key, default TTL, indexing policy mode, conflict resolution policy, unique-key constraints, and the throughput posture (manual, autoscale, or inherited from the parent database).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"containers":{"name":"containers","type":"\u0019\u001bazure.subscription.cosmosDbService.account.sqlDatabase.container","title":"Containers within the database","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"manualThroughput":{"name":"manualThroughput","type":"\u0005","title":"Manual provisioned throughput in RU/s at the database level","desc":"Zero when configured per-container or when autoscale is enabled.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Database name (Cosmos DB resource id; same as ARM child segment)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"throughputPerContainer":{"name":"throughputPerContainer","type":"\u0004","title":"Whether throughput is configured per-container instead of at the database level","desc":"True means each container manages its own throughput, equivalent to there being no database-scope throughput offer.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB SQL API database","desc":"SQL-API (Core) database hosted on a Cosmos DB account, selectable by its ARM resource id. The throughput posture distinguishes manually provisioned RU/s from an autoscale ceiling, and `throughputPerContainer` marks the case where throughput is set per-container rather than at the database level. The contained containers are exposed as a sub-resource.","private":true,"min_provider_version":"13.10.2","defaults":"name throughputPerContainer autoscaleEnabled manualThroughput","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account.sqlDatabase.container":{"id":"azure.subscription.cosmosDbService.account.sqlDatabase.container","name":"azure.subscription.cosmosDbService.account.sqlDatabase.container","fields":{"analyticalStorageTtl":{"name":"analyticalStorageTtl","type":"\u0005","is_mandatory":true,"title":"Analytical store TTL in seconds; zero when analytical store is disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"automaticIndexing":{"name":"automaticIndexing","type":"\u0004","is_mandatory":true,"title":"Whether automatic indexing is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"autoscaleEnabled":{"name":"autoscaleEnabled","type":"\u0004","title":"Whether autoscale is enabled at the container level","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"autoscaleMaxThroughput":{"name":"autoscaleMaxThroughput","type":"\u0005","title":"Autoscale max throughput in RU/s at the container level","desc":"Zero when not autoscale or when inherited from the parent database.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"conflictResolutionMode":{"name":"conflictResolutionMode","type":"\u0007","is_mandatory":true,"title":"Conflict resolution mode (\"LastWriterWins\", \"Custom\"); empty when default","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"conflictResolutionPath":{"name":"conflictResolutionPath","type":"\u0007","is_mandatory":true,"title":"Conflict resolution path (when mode == \"LastWriterWins\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultTtl":{"name":"defaultTtl","type":"\u0005","is_mandatory":true,"title":"Default time-to-live for items in seconds","desc":"0  — TTL is disabled on the container (the API returned nil; we surface that as 0). -1 — TTL is enabled on the container but items have no default expiration; per-item TTLs still apply. \u003e0 — default TTL value in seconds applied to items in the container.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"indexingMode":{"name":"indexingMode","type":"\u0007","is_mandatory":true,"title":"Indexing policy mode (\"Consistent\", \"Lazy\", \"None\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"manualThroughput":{"name":"manualThroughput","type":"\u0005","title":"Manual provisioned throughput in RU/s at the container level","desc":"Zero when inherited or when autoscale is configured.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Container name (Cosmos DB resource id; same as ARM child segment)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"partitionKeyKind":{"name":"partitionKeyKind","type":"\u0007","is_mandatory":true,"title":"Partition key kind (\"Hash\", \"Range\", \"MultiHash\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"partitionKeyPaths":{"name":"partitionKeyPaths","type":"\u0019\u0007","is_mandatory":true,"title":"Partition key paths (e.g., [\"/userId\"])","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"throughputInherited":{"name":"throughputInherited","type":"\u0004","title":"Whether throughput is inherited from the parent database","desc":"True means there is no container-level offer and the database scope provides the offer for this container.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"uniqueKeys":{"name":"uniqueKeys","type":"\u0019\n","is_mandatory":true,"title":"Unique key constraints. Each entry has shape {paths: []string}.","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB SQL API container","desc":"SQL-API container within a Cosmos DB database, selectable by its ARM resource id. Audit the partition key, default TTL, indexing policy mode, conflict resolution policy, unique-key constraints, and the throughput posture (manual, autoscale, or inherited from the parent database).","private":true,"min_provider_version":"13.10.2","defaults":"name partitionKeyPaths defaultTtl","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account.sqlRoleAssignment":{"id":"azure.subscription.cosmosDbService.account.sqlRoleAssignment","name":"azure.subscription.cosmosDbService.account.sqlRoleAssignment","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource name (a GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"AAD principal granted access by this assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleDefinitionId":{"name":"roleDefinitionId","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition ID this assignment binds","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Data-plane scope this assignment applies to (account, database, or container)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB SQL data-plane role assignment","private":true,"min_provider_version":"13.8.2","defaults":"name principalId scope","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account.sqlRoleDefinition":{"id":"azure.subscription.cosmosDbService.account.sqlRoleDefinition","name":"azure.subscription.cosmosDbService.account.sqlRoleDefinition","fields":{"assignableScopes":{"name":"assignableScopes","type":"\u0019\u0007","is_mandatory":true,"title":"Scopes at or below which assignments using this definition may be created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource name (a GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"permissions":{"name":"permissions","type":"\u0019\n","is_mandatory":true,"title":"Permission set granted by this role (Cosmos permission JSON: dataActions, notDataActions)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleName":{"name":"roleName","type":"\u0007","is_mandatory":true,"title":"User-friendly role name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleType":{"name":"roleType","type":"\u0007","is_mandatory":true,"title":"\"BuiltInRole\" or \"CustomRole\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.31.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB SQL data-plane role definition (data-plane RBAC, separate from Azure ARM roles)","private":true,"min_provider_version":"13.8.2","defaults":"name roleName roleType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account.tableRoleAssignment":{"id":"azure.subscription.cosmosDbService.account.tableRoleAssignment","name":"azure.subscription.cosmosDbService.account.tableRoleAssignment","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource name (a GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"AAD principal granted access by this assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the role assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleDefinitionId":{"name":"roleDefinitionId","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition ID this assignment binds","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Data-plane scope this assignment applies to (account or table)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Cosmos role assignment resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB Table data-plane role assignment","private":true,"min_provider_version":"13.31.1","defaults":"name principalId scope","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account.tableRoleDefinition":{"id":"azure.subscription.cosmosDbService.account.tableRoleDefinition","name":"azure.subscription.cosmosDbService.account.tableRoleDefinition","fields":{"assignableScopes":{"name":"assignableScopes","type":"\u0019\u0007","is_mandatory":true,"title":"Scopes at or below which assignments using this definition may be created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource name (a GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"permissions":{"name":"permissions","type":"\u0019\n","is_mandatory":true,"title":"Permission set granted by this role (Cosmos permission JSON: dataActions, notDataActions)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleName":{"name":"roleName","type":"\u0007","is_mandatory":true,"title":"User-friendly role name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleType":{"name":"roleType","type":"\u0007","is_mandatory":true,"title":"\"BuiltInRole\" or \"CustomRole\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Cosmos role definition resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB Table data-plane role definition","private":true,"min_provider_version":"13.31.1","defaults":"name roleName roleType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.account.virtualNetworkRule":{"id":"azure.subscription.cosmosDbService.account.virtualNetworkRule","name":"azure.subscription.cosmosDbService.account.virtualNetworkRule","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule ID (account ID + subnet ID hash)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ignoreMissingVNetServiceEndpoint":{"name":"ignoreMissingVNetServiceEndpoint","type":"\u0004","is_mandatory":true,"title":"Whether to allow requests from the subnet even if the service endpoint is not configured","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnetId":{"name":"subnetId","type":"\u0007","is_mandatory":true,"title":"Virtual network subnet resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB account virtual network rule","private":true,"min_provider_version":"13.1.8","defaults":"subnetId ignoreMissingVNetServiceEndpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.mongoCluster":{"id":"azure.subscription.cosmosDbService.mongoCluster","name":"azure.subscription.cosmosDbService.mongoCluster","fields":{"administratorLogin":{"name":"administratorLogin","type":"\u0007","is_mandatory":true,"title":"Administrator user name configured on the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"authModes":{"name":"authModes","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed authentication modes for data access (\"NativeAuth\", \"MicrosoftEntraID\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"clusterStatus":{"name":"clusterStatus","type":"\u0007","is_mandatory":true,"title":"Status of the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"computeTier":{"name":"computeTier","type":"\u0007","is_mandatory":true,"title":"Compute tier assigned to the cluster (for example \"M30\" or \"M40\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataApiMode":{"name":"dataApiMode","type":"\u0007","is_mandatory":true,"title":"Mongo Data API access mode (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"earliestRestoreTime":{"name":"earliestRestoreTime","type":"\t","is_mandatory":true,"title":"Earliest restore point time for the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionKey":{"name":"encryptionKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used for customer-managed encryption (null if platform-managed)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"highAvailabilityMode":{"name":"highAvailabilityMode","type":"\u0007","is_mandatory":true,"title":"Target high availability mode (\"Disabled\", \"SameZone\", or \"ZoneRedundantPreferred\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"MongoDB vCore cluster resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"infrastructureVersion":{"name":"infrastructureVersion","type":"\u0007","is_mandatory":true,"title":"Infrastructure version the cluster is provisioned on","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Azure region the cluster is provisioned in","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"MongoDB vCore cluster resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkBypassMode":{"name":"networkBypassMode","type":"\u0007","is_mandatory":true,"title":"Network bypass mode for the cluster","desc":"Controls whether the Azure Cosmos DB service may bypass the cluster's network restrictions. One of \"AzureCosmosDB\" (the service is permitted to bypass firewall rules) or \"None\" (no bypass is enabled).","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether public network access is enabled (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicationRole":{"name":"replicationRole","type":"\u0007","is_mandatory":true,"title":"Replication role of the cluster (\"Primary\", \"AsyncReplica\", or \"GeoAsyncReplica\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicationSourceId":{"name":"replicationSourceId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the source cluster for a replica cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicationState":{"name":"replicationState","type":"\u0007","is_mandatory":true,"title":"Replication link state of a replica cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serverVersion":{"name":"serverVersion","type":"\u0007","is_mandatory":true,"title":"MongoDB server version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"shardCount":{"name":"shardCount","type":"\u0005","is_mandatory":true,"title":"Number of shards provisioned on the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageSizeGb":{"name":"storageSizeGb","type":"\u0005","is_mandatory":true,"title":"Data-disk size in GB assigned to each server","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageType":{"name":"storageType","type":"\u0007","is_mandatory":true,"title":"Storage type provisioned for cluster servers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB for MongoDB (vCore) cluster","desc":"Cosmos DB for MongoDB (vCore) cluster (`Microsoft.DocumentDB/mongoClusters`), a distinct Azure resource from a classic Cosmos DB account. Audit the compute tier and data-disk size, shard count, high availability mode, MongoDB server version, allowed authentication modes, Mongo Data API access, public network access, the customer-managed encryption key, and the replication role and state.","private":true,"min_provider_version":"13.12.1","defaults":"computeTier serverVersion provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.cosmosDbService.postgresqlCluster":{"id":"azure.subscription.cosmosDbService.postgresqlCluster","name":"azure.subscription.cosmosDbService.postgresqlCluster","fields":{"administratorLogin":{"name":"administratorLogin","type":"\u0007","is_mandatory":true,"title":"Administrator login name of the servers in the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"citusVersion":{"name":"citusVersion","type":"\u0007","is_mandatory":true,"title":"Citus extension version on all cluster servers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"coordinatorEnablePublicIpAccess":{"name":"coordinatorEnablePublicIpAccess","type":"\u0004","is_mandatory":true,"title":"Whether public access is enabled on the coordinator","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"coordinatorServerEdition":{"name":"coordinatorServerEdition","type":"\u0007","is_mandatory":true,"title":"Coordinator server edition (for example \"GeneralPurpose\" or \"MemoryOptimized\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"coordinatorStorageQuotaInMb":{"name":"coordinatorStorageQuotaInMb","type":"\u0005","is_mandatory":true,"title":"Coordinator server storage in MB","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"coordinatorVCores":{"name":"coordinatorVCores","type":"\u0005","is_mandatory":true,"title":"Coordinator server vCore count","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"earliestRestoreTime":{"name":"earliestRestoreTime","type":"\t","is_mandatory":true,"title":"Earliest restore point time for the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableHa":{"name":"enableHa","type":"\u0004","is_mandatory":true,"title":"Whether high availability (HA) is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableShardsOnCoordinator":{"name":"enableShardsOnCoordinator","type":"\u0004","is_mandatory":true,"title":"Whether distributed tables are placed on the coordinator","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"PostgreSQL cluster resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Azure region the cluster is provisioned in","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maintenanceWindow":{"name":"maintenanceWindow","type":"\n","is_mandatory":true,"title":"Maintenance window of the cluster","desc":"Keys: `customWindow` (whether a custom maintenance window is enabled), `dayOfWeek` (preferred day of the week, 0 to 6), `startHour`, and `startMinute`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"PostgreSQL cluster resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodeCount":{"name":"nodeCount","type":"\u0005","is_mandatory":true,"title":"Worker node count of the cluster (0 indicates a single-node configuration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodeEnablePublicIpAccess":{"name":"nodeEnablePublicIpAccess","type":"\u0004","is_mandatory":true,"title":"Whether public access is enabled on worker nodes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodeServerEdition":{"name":"nodeServerEdition","type":"\u0007","is_mandatory":true,"title":"Worker node server edition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodeStorageQuotaInMb":{"name":"nodeStorageQuotaInMb","type":"\u0005","is_mandatory":true,"title":"Storage in MB on each worker node","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nodeVCores":{"name":"nodeVCores","type":"\u0005","is_mandatory":true,"title":"Compute in vCores on each worker node","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"postgresqlVersion":{"name":"postgresqlVersion","type":"\u0007","is_mandatory":true,"title":"Major PostgreSQL version on all cluster servers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"preferredPrimaryZone":{"name":"preferredPrimaryZone","type":"\u0007","is_mandatory":true,"title":"Preferred primary availability zone for all cluster servers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"readReplicas":{"name":"readReplicas","type":"\u0019\u0007","is_mandatory":true,"title":"Resource IDs of read-replica clusters","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serverNames":{"name":"serverNames","type":"\u0019\n","is_mandatory":true,"title":"Server names in the cluster","desc":"Each entry has keys `name` (the server name) and `fullyQualifiedDomainName` (the server's fully qualified domain name).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceLocation":{"name":"sourceLocation","type":"\u0007","is_mandatory":true,"title":"Azure region of the source cluster for read-replica clusters","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceResourceId":{"name":"sourceResourceId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the source cluster for read-replica clusters","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"State of the cluster visible to the user","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Cosmos DB for PostgreSQL cluster","desc":"Cosmos DB for PostgreSQL (Citus) cluster (`Microsoft.DBforPostgreSQL/serverGroupsv2`), a distinct Azure resource from a classic Cosmos DB account. Audit the PostgreSQL and Citus versions, coordinator and worker-node compute (vCores, storage quota, server edition), worker node count, high availability, public IP access on the coordinator and worker nodes, the maintenance window, and the read-replica topology.","private":true,"min_provider_version":"13.12.1","defaults":"postgresqlVersion nodeCount provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.dataFactoryService":{"id":"azure.subscription.dataFactoryService","name":"azure.subscription.dataFactoryService","fields":{"factories":{"name":"factories","type":"\u0019\u001bazure.subscription.dataFactoryService.factory","title":"List of Data Factory instances","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"factory":{"name":"factory","type":"\u001bazure.subscription.dataFactoryService.factory","title":"Azure Data Factory","desc":"Managed cloud ETL/ELT and data-integration service that orchestrates pipelines across data stores. Auditing a factory surfaces its public network access posture, source-control (Git) binding, customer-managed key encryption, and the managed identities it uses to reach data sources, along with its linked services, integration runtimes, and managed virtual network.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Factory service","private":true,"min_provider_version":"13.3.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.dataFactoryService.factory":{"id":"azure.subscription.dataFactoryService.factory","name":"azure.subscription.dataFactoryService.factory","fields":{"cmkIdentity":{"name":"cmkIdentity","type":"\u001bazure.subscription.managedIdentity","title":"User-assigned managed identity used to access the customer-managed encryption key (null when the factory's system-assigned identity is used)","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKey":{"name":"cmkKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Customer-managed key in Key Vault used to encrypt the factory (null for platform-managed encryption)","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeyName":{"name":"cmkKeyName","type":"\u0007","is_mandatory":true,"title":"Customer-managed key name in Key Vault used to encrypt the factory","desc":"Deprecated in favor of cmkKey.","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"cmkKeyVaultUri":{"name":"cmkKeyVaultUri","type":"\u0007","is_mandatory":true,"title":"Key Vault base URL backing the customer-managed encryption key","desc":"Deprecated in favor of cmkKey.","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"cmkKeyVersion":{"name":"cmkKeyVersion","type":"\u0007","is_mandatory":true,"title":"Version of the customer-managed encryption key","desc":"Deprecated in favor of cmkKey.","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"cmkUserAssignedIdentity":{"name":"cmkUserAssignedIdentity","type":"\u0007","is_mandatory":true,"title":"User-assigned identity resource ID used to access the customer-managed key","desc":"Deprecated in favor of cmkIdentity.","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Time the factory was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryption":{"name":"encryption","type":"\n","is_mandatory":true,"title":"Encryption configuration","desc":"Deprecated in favor of cmkKeyName, cmkKeyVaultUri, cmkKeyVersion, and cmkUserAssignedIdentity.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Full resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity assigned to the factory","desc":"Keys: type (\"SystemAssigned\", \"UserAssigned\", or \"SystemAssigned,UserAssigned\"), principalId, tenantId, and userAssignedIdentities (map keyed by identity resource ID). Null when no identity is configured.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"integrationRuntime":{"name":"integrationRuntime","type":"\u001bazure.subscription.dataFactoryService.factory.integrationRuntime","title":"Azure Data Factory integration runtime","desc":"Compute resource attached to the factory that executes pipeline activities, either a fully-managed Azure Integration Runtime (or Azure-SSIS) or a Self-hosted runtime running on customer infrastructure. Selectable by ARM id. The runtimeType field selects the variant and typeProperties carries the runtime-specific configuration (Managed exposes compute and SSIS properties; SelfHosted exposes node and version info).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"integrationRuntimes":{"name":"integrationRuntimes","type":"\u0019\u001bazure.subscription.dataFactoryService.factory.integrationRuntime","title":"Integration runtimes that execute pipeline activities","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"linkedService":{"name":"linkedService","type":"\u001bazure.subscription.dataFactoryService.factory.linkedService","title":"Azure Data Factory linked service","desc":"Configured connection from the factory to an external system such as Azure SQL, Blob Storage, or a REST API. Selectable by ARM id. The serviceType field identifies the connector, integrationRuntimeName names the runtime that executes it, and usesKeyVaultReference flags whether any credential in typeProperties resolves through Azure Key Vault rather than being stored inline, a common configuration audit.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"linkedServices":{"name":"linkedServices","type":"\u0019\u001bazure.subscription.dataFactoryService.factory.linkedService","title":"Linked services configured on the factory (connection info for external systems)","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Location of the factory","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedPrivateEndpoint":{"name":"managedPrivateEndpoint","type":"\u001bazure.subscription.dataFactoryService.factory.managedPrivateEndpoint","title":"Azure Data Factory managed private endpoint","desc":"Managed private endpoint inside a factory's managed virtual network that routes factory traffic to a target Azure resource over Private Link. Selectable by ARM id. Exposes the target resource, the connection-approval state, and the FQDNs assigned to the endpoint.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"managedVirtualNetwork":{"name":"managedVirtualNetwork","type":"\u001bazure.subscription.dataFactoryService.factory.managedVirtualNetwork","title":"Managed virtual network for the factory, if one exists","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the factory","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Unmodeled resource properties returned by the Azure API","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether public network access is enabled (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"repoConfiguration":{"name":"repoConfiguration","type":"\n","is_mandatory":true,"title":"Source-control (Git) binding for the factory","desc":"Keys: type (\"FactoryVSTSConfiguration\" for Azure DevOps or \"FactoryGitHubConfiguration\" for GitHub), accountName, projectName (Azure DevOps only), repositoryName, collaborationBranch, rootFolder, and lastCommitId. Null when the factory is not bound to a repository.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Tags for the factory","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities associated with the factory","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Version of the factory","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Factory","desc":"Managed cloud ETL/ELT and data-integration service that orchestrates pipelines across data stores. Auditing a factory surfaces its public network access posture, source-control (Git) binding, customer-managed key encryption, and the managed identities it uses to reach data sources, along with its linked services, integration runtimes, and managed virtual network.","min_provider_version":"13.3.0","defaults":"name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.dataFactoryService.factory.integrationRuntime":{"id":"azure.subscription.dataFactoryService.factory.integrationRuntime","name":"azure.subscription.dataFactoryService.factory.integrationRuntime","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Integration runtime name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"runtimeType":{"name":"runtimeType","type":"\u0007","is_mandatory":true,"title":"Runtime type (\"Managed\", \"SelfHosted\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"typeProperties":{"name":"typeProperties","type":"\n","is_mandatory":true,"title":"Type-specific properties returned by the SDK (shape varies by runtimeType)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Factory integration runtime","desc":"Compute resource attached to the factory that executes pipeline activities, either a fully-managed Azure Integration Runtime (or Azure-SSIS) or a Self-hosted runtime running on customer infrastructure. Selectable by ARM id. The runtimeType field selects the variant and typeProperties carries the runtime-specific configuration (Managed exposes compute and SSIS properties; SelfHosted exposes node and version info).","private":true,"min_provider_version":"13.10.2","defaults":"name runtimeType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.dataFactoryService.factory.linkedService":{"id":"azure.subscription.dataFactoryService.factory.linkedService","name":"azure.subscription.dataFactoryService.factory.linkedService","fields":{"annotations":{"name":"annotations","type":"\u0019\n","is_mandatory":true,"title":"Annotations declared on the linked service (free-form list of any)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"authenticationType":{"name":"authenticationType","type":"\u0007","is_mandatory":true,"title":"Authentication mode declared by the connector","desc":"The auth scheme the linked service uses to reach its external system, when the connector declares one, for example \"Basic\", \"ManagedServiceIdentity\", \"ServicePrincipal\", or \"Anonymous\". Empty when the connector has no auth-type field or the credential resolves through Key Vault (see usesKeyVaultReference).","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Linked-service description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"integrationRuntimeName":{"name":"integrationRuntimeName","type":"\u0007","is_mandatory":true,"title":"Name of the referenced integration runtime; empty when the factory's default is used","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Linked service name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"parameterNames":{"name":"parameterNames","type":"\u0019\u0007","is_mandatory":true,"title":"Names of declared parameters","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceType":{"name":"serviceType","type":"\u0007","is_mandatory":true,"title":"Linked-service type (e.g., \"AzureBlobStorage\", \"AzureSqlDatabase\", \"RestService\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type (always \"Microsoft.DataFactory/factories/linkedservices\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"typeProperties":{"name":"typeProperties","type":"\n","is_mandatory":true,"title":"Raw type-specific properties returned by the SDK (shape varies by serviceType)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"usesKeyVaultReference":{"name":"usesKeyVaultReference","type":"\u0004","is_mandatory":true,"title":"Whether any credential or secret field resolves via Azure Key Vault","desc":"True when a nested `{type: \"AzureKeyVaultSecret\", store: {...}, secretName: ...}` reference exists in typeProperties.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Linked-service version","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Factory linked service","desc":"Configured connection from the factory to an external system such as Azure SQL, Blob Storage, or a REST API. Selectable by ARM id. The serviceType field identifies the connector, integrationRuntimeName names the runtime that executes it, and usesKeyVaultReference flags whether any credential in typeProperties resolves through Azure Key Vault rather than being stored inline, a common configuration audit.","private":true,"min_provider_version":"13.10.2","defaults":"name serviceType integrationRuntimeName usesKeyVaultReference","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.dataFactoryService.factory.managedPrivateEndpoint":{"id":"azure.subscription.dataFactoryService.factory.managedPrivateEndpoint","name":"azure.subscription.dataFactoryService.factory.managedPrivateEndpoint","fields":{"actionsRequired":{"name":"actionsRequired","type":"\u0007","is_mandatory":true,"title":"Action required by the consumer (\"None\" or a description string)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionStatus":{"name":"connectionStatus","type":"\u0007","is_mandatory":true,"title":"Connection status (\"Approved\", \"Pending\", \"Rejected\", \"Disconnected\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description / reason text on the connection state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fqdns":{"name":"fqdns","type":"\u0019\u0007","is_mandatory":true,"title":"Fully qualified domain names assigned to the endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"groupId":{"name":"groupId","type":"\u0007","is_mandatory":true,"title":"Sub-resource group ID on the target (e.g., \"blob\", \"sqlServer\", \"vault\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Endpoint name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateLinkResourceId":{"name":"privateLinkResourceId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the target Private Link resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"reserved":{"name":"reserved","type":"\u0004","is_mandatory":true,"title":"Whether the endpoint is reserved","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Factory managed private endpoint","desc":"Managed private endpoint inside a factory's managed virtual network that routes factory traffic to a target Azure resource over Private Link. Selectable by ARM id. Exposes the target resource, the connection-approval state, and the FQDNs assigned to the endpoint.","private":true,"min_provider_version":"13.10.2","defaults":"name groupId connectionStatus","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.dataFactoryService.factory.managedVirtualNetwork":{"id":"azure.subscription.dataFactoryService.factory.managedVirtualNetwork","name":"azure.subscription.dataFactoryService.factory.managedVirtualNetwork","fields":{"alias":{"name":"alias","type":"\u0007","is_mandatory":true,"title":"Managed Virtual Network alias","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Managed virtual network name (always \"default\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpoints":{"name":"privateEndpoints","type":"\u0019\u001bazure.subscription.dataFactoryService.factory.managedPrivateEndpoint","title":"Managed private endpoints attached to this managed virtual network","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vnetId":{"name":"vnetId","type":"\u0007","is_mandatory":true,"title":"Underlying virtual network ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Factory managed virtual network","desc":"Managed virtual network on a factory that isolates integration runtime traffic and routes it privately to data sources. Selectable by ARM id. Exposes the alias, the underlying virtual-network id, and the managed private endpoints that carry factory-side traffic to other Azure resources over Private Link.","private":true,"min_provider_version":"13.10.2","defaults":"name alias","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.databricksService":{"id":"azure.subscription.databricksService","name":"azure.subscription.databricksService","fields":{"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workspace":{"name":"workspace","type":"\u001bazure.subscription.databricksService.workspace","title":"Azure Databricks workspace","desc":"Analytics platform workspace and its per-environment control plane. A workspace is the security boundary for Databricks compute and data, so query it to audit network isolation (public network access, Secure Cluster Connectivity, and VNet injection into a custom virtual network), customer-managed key encryption for managed services and managed disks, and the Compliance Security Profile posture. The requiredNsgRules value selects which network security group rules the data plane relies on.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"workspaces":{"name":"workspaces","type":"\u0019\u001bazure.subscription.databricksService.workspace","title":"Databricks workspaces in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Databricks","private":true,"min_provider_version":"11.4.25","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.databricksService.workspace":{"id":"azure.subscription.databricksService.workspace","name":"azure.subscription.databricksService.workspace","fields":{"automaticClusterUpdate":{"name":"automaticClusterUpdate","type":"\u0007","is_mandatory":true,"title":"Automatic cluster update status (\"Enabled\" or \"Disabled\")","min_provider_version":"13.30.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"complianceSecurityProfile":{"name":"complianceSecurityProfile","type":"\u0007","is_mandatory":true,"title":"Compliance Security Profile status (\"Enabled\" or \"Disabled\")","min_provider_version":"13.30.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"complianceStandards":{"name":"complianceStandards","type":"\u0019\u0007","is_mandatory":true,"title":"Compliance standards enforced by the Compliance Security Profile","desc":"For example HIPAA, PCI_DSS, or NONE. Empty when the Compliance Security Profile is disabled.","min_provider_version":"13.30.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the workspace was created","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"customVirtualNetworkId":{"name":"customVirtualNetworkId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the custom VNet the workspace is injected into (empty if using a managed VNet)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultStorageFirewall":{"name":"defaultStorageFirewall","type":"\u0007","is_mandatory":true,"title":"Whether the workspace default storage account is locked behind a firewall (\"Enabled\" or \"Disabled\")","min_provider_version":"13.30.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diskEncryptionSetId":{"name":"diskEncryptionSetId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the managed disk encryption set used for managed disks","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableNoPublicIp":{"name":"enableNoPublicIp","type":"\u0004","is_mandatory":true,"title":"Whether public IPs are disabled on cluster nodes (Secure Cluster Connectivity / VNet injection)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enhancedSecurityMonitoring":{"name":"enhancedSecurityMonitoring","type":"\u0007","is_mandatory":true,"title":"Enhanced Security Monitoring status (\"Enabled\" or \"Disabled\")","min_provider_version":"13.30.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Workspace ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Workspace location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedDiskKeyName":{"name":"managedDiskKeyName","type":"\u0007","is_mandatory":true,"title":"Managed-disk CMK key name","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedDiskKeySource":{"name":"managedDiskKeySource","type":"\u0007","is_mandatory":true,"title":"CMK key source for managed disks (\"Default\" or \"Microsoft.Keyvault\")","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedDiskKeyVaultUri":{"name":"managedDiskKeyVaultUri","type":"\u0007","is_mandatory":true,"title":"Key Vault URI for the managed-disk CMK (empty if platform-managed)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedDiskKeyVersion":{"name":"managedDiskKeyVersion","type":"\u0007","is_mandatory":true,"title":"Managed-disk CMK key version","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedResourceGroupId":{"name":"managedResourceGroupId","type":"\u0007","is_mandatory":true,"title":"Managed resource group ARM resource ID","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedServicesKeyName":{"name":"managedServicesKeyName","type":"\u0007","is_mandatory":true,"title":"Managed-services CMK key name","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedServicesKeySource":{"name":"managedServicesKeySource","type":"\u0007","is_mandatory":true,"title":"CMK key source for managed services (\"Default\" or \"Microsoft.Keyvault\")","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedServicesKeyVaultUri":{"name":"managedServicesKeyVaultUri","type":"\u0007","is_mandatory":true,"title":"Key Vault URI for the managed-services CMK (empty if platform-managed)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedServicesKeyVersion":{"name":"managedServicesKeyVersion","type":"\u0007","is_mandatory":true,"title":"Managed-services CMK key version","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Workspace name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw workspace properties","desc":"Workspace properties object as returned by Azure Resource Manager. Most values are also surfaced as dedicated fields on this resource (publicNetworkAccess, requiredNsgRules, the managed-disk and managed-services encryption settings, and the Compliance Security Profile fields); prefer those for audits.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access setting (\"Enabled\" or \"Disabled\")","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requireInfrastructureEncryption":{"name":"requireInfrastructureEncryption","type":"\u0004","is_mandatory":true,"title":"Whether double encryption (platform-managed key on top of CMK) is enabled for the DBFS root","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requiredNsgRules":{"name":"requiredNsgRules","type":"\u0007","is_mandatory":true,"title":"Required NSG rules mode (\"AllRules\", \"NoAzureDatabricksRules\", or \"NoAzureServiceRules\")","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"Workspace pricing SKU","desc":"SKU object with keys `name` (Standard, Premium, or Trial) and `tier`, identifying the Databricks plan the workspace runs under.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Workspace tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Workspace type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workspaceId":{"name":"workspaceId","type":"\u0007","is_mandatory":true,"title":"Databricks control-plane workspace identifier","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Databricks workspace","desc":"Analytics platform workspace and its per-environment control plane. A workspace is the security boundary for Databricks compute and data, so query it to audit network isolation (public network access, Secure Cluster Connectivity, and VNet injection into a custom virtual network), customer-managed key encryption for managed services and managed disks, and the Compliance Security Profile posture. The requiredNsgRules value selects which network security group rules the data plane relies on.","min_provider_version":"11.4.25","defaults":"id name location publicNetworkAccess","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.deployment":{"id":"azure.subscription.deployment","name":"azure.subscription.deployment","fields":{"correlationId":{"name":"correlationId","type":"\u0007","is_mandatory":true,"title":"Correlation identifier shared with the activity log events for this deployment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"duration":{"name":"duration","type":"\u0007","is_mandatory":true,"title":"Duration of the deployment, as an ISO 8601 duration (for example PT1M30S)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"error":{"name":"error","type":"\n","is_mandatory":true,"title":"Error details when the deployment failed","desc":"Null on a successful deployment. When present, an object with `code`, `message`, `target`, a nested `details` list of the same shape, and `additionalInfo` entries carrying `type` and `info`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Deployment ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Deployment location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Deployment mode","desc":"One of Incremental or Complete.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Deployment name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"outputResources":{"name":"outputResources","type":"\u0019\u0007","is_mandatory":true,"title":"IDs of the resources provisioned or updated by the deployment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"outputs":{"name":"outputs","type":"\n","is_mandatory":true,"title":"Output values produced by the deployment","desc":"Keys are output names as declared in the template's outputs section. Each value is an object with a `type` and the resolved `value`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"parameters":{"name":"parameters","type":"\n","is_mandatory":true,"title":"Parameters supplied to the deployment","desc":"Keys are parameter names. Each value is an object holding either a `value` with the supplied value, or a `reference` pointing at a Key Vault secret (with `keyVault` and `secretName`) for secure parameters.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"parametersLink":{"name":"parametersLink","type":"\u0007","is_mandatory":true,"title":"URI of the linked parameters file, when the deployment used one","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"providers":{"name":"providers","type":"\u0019\n","is_mandatory":true,"title":"Resource providers used by the deployment","desc":"Each entry describes a registered Azure resource provider, with `id`, `namespace`, `registrationState`, `registrationPolicy`, and a `resourceTypes` list of the provider's resource types.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","desc":"Typical values are Accepted, Running, Succeeded, Failed, and Canceled.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Deployment tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"templateHash":{"name":"templateHash","type":"\u0007","is_mandatory":true,"title":"Hash produced for the deployed template","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"templateLink":{"name":"templateLink","type":"\u0007","is_mandatory":true,"title":"URI of the linked template, when the deployment used one","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timestamp":{"name":"timestamp","type":"\t","is_mandatory":true,"title":"When the deployment finished","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Deployment type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Resource Manager deployment","desc":"Azure Resource Manager template deployment, the unit that provisions or updates a set of resources from a template. The deployment reports its provisioning state and completion timestamp, the deployment mode, the template and parameters used, the resources it produced through `outputResources`, and the `correlationId` that links it to the activity log events it generated. Query this to trace which deployment created or last changed a group of resources.","private":true,"min_provider_version":"13.19.2","defaults":"name provisioningState timestamp","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.desktopVirtualizationService":{"id":"azure.subscription.desktopVirtualizationService","name":"azure.subscription.desktopVirtualizationService","fields":{"hostPool":{"name":"hostPool","type":"\u001bazure.subscription.desktopVirtualizationService.hostPool","title":"Azure Virtual Desktop host pool","desc":"Group of session hosts that deliver virtual desktops and remote applications to users, and the primary control point for the pool's security posture. The raw `customRdpProperty` string carries the RDP redirection rules (clipboard, drive, and device access) that decide how data can move between the session host and the client, while `publicNetworkAccess` and `ssoSecretType` govern network reachability and how the single sign-on secret is stored. Audit these to confirm a pool does not leak data through unrestricted redirection or exposure.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"hostPools":{"name":"hostPools","type":"\u0019\u001bazure.subscription.desktopVirtualizationService.hostPool","title":"Azure Virtual Desktop host pools in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual Desktop","desc":"Azure Virtual Desktop deployment in the subscription and the entry point for auditing virtual desktop infrastructure. The `hostPools` field lists every host pool, each of which governs RDP redirection settings, session limits, public network exposure, and single sign-on for the session hosts that deliver desktops and applications to users.","private":true,"min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.desktopVirtualizationService.hostPool":{"id":"azure.subscription.desktopVirtualizationService.hostPool","name":"azure.subscription.desktopVirtualizationService.hostPool","fields":{"customRdpProperty":{"name":"customRdpProperty","type":"\u0007","is_mandatory":true,"title":"Raw custom RDP property string applied to sessions (redirection and device-access settings)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostPoolType":{"name":"hostPoolType","type":"\u0007","is_mandatory":true,"title":"Host pool type (\"Personal\", \"Pooled\", or \"BYODesktop\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Host pool resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity assigned to the host pool","desc":"Keys: `type` (the identity model, currently always \"SystemAssigned\"), `principalId` (the object ID of the system-assigned identity), and `tenantId` (the Entra tenant that owns the identity).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"loadBalancerType":{"name":"loadBalancerType","type":"\u0007","is_mandatory":true,"title":"Load-balancing algorithm (\"BreadthFirst\", \"DepthFirst\", or \"Persistent\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Host pool location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxSessionLimit":{"name":"maxSessionLimit","type":"\u0005","is_mandatory":true,"title":"Maximum number of concurrent sessions allowed per session host","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Host pool name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"personalDesktopAssignmentType":{"name":"personalDesktopAssignmentType","type":"\u0007","is_mandatory":true,"title":"Assignment model for personal host pools (\"Automatic\" or \"Direct\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"preferredAppGroupType":{"name":"preferredAppGroupType","type":"\u0007","is_mandatory":true,"title":"Preferred application group type (\"Desktop\", \"RailApplications\", or \"None\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnectionCount":{"name":"privateEndpointConnectionCount","type":"\u0005","is_mandatory":true,"title":"Number of approved private endpoint connections to the host pool","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access setting","desc":"Controls whether the host pool is reachable from the public internet. One of \"Enabled\", \"Disabled\", \"EnabledForSessionHostsOnly\", or \"EnabledForClientsOnly\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ring":{"name":"ring","type":"\u0005","is_mandatory":true,"title":"Update ring the host pool belongs to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ssoSecretType":{"name":"ssoSecretType","type":"\u0007","is_mandatory":true,"title":"How the single-sign-on secret is stored (\"SharedKey\", \"Certificate\", \"SharedKeyInKeyVault\", or \"CertificateInKeyVault\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ssoadfsAuthority":{"name":"ssoadfsAuthority","type":"\u0007","is_mandatory":true,"title":"AD FS authority URL used for single sign-on, if configured","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"startVMOnConnect":{"name":"startVMOnConnect","type":"\u0004","is_mandatory":true,"title":"Whether session-host VMs are started automatically when a user connects","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Host pool tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"validationEnvironment":{"name":"validationEnvironment","type":"\u0004","is_mandatory":true,"title":"Whether the host pool is a validation environment receiving pre-release agent updates","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual Desktop host pool","desc":"Group of session hosts that deliver virtual desktops and remote applications to users, and the primary control point for the pool's security posture. The raw `customRdpProperty` string carries the RDP redirection rules (clipboard, drive, and device access) that decide how data can move between the session host and the client, while `publicNetworkAccess` and `ssoSecretType` govern network reachability and how the single sign-on secret is stored. Audit these to confirm a pool does not leak data through unrestricted redirection or exposure.","min_provider_version":"13.16.2","defaults":"id name location hostPoolType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.dnsService":{"id":"azure.subscription.dnsService","name":"azure.subscription.dnsService","fields":{"privateZone":{"name":"privateZone","type":"\u001bazure.subscription.dnsService.privateZone","title":"Azure Private DNS zone","desc":"Private DNS zone whose records resolve only from the virtual networks linked to it, keeping internal name resolution off the public internet. Reports the provisioning state, the current record-set and virtual-network-link counts against their maximums, and the record sets hosted in the zone. Linked virtual networks, including which ones auto-register VM records, are reached through virtualNetworkLinks.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"privateZones":{"name":"privateZones","type":"\u0019\u001bazure.subscription.dnsService.privateZone","title":"List of private DNS zones","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zone":{"name":"zone","type":"\u001bazure.subscription.dnsService.zone","title":"Azure public DNS zone","desc":"Public DNS zone that hosts authoritative records for a domain and answers queries from the internet. Reports the assigned authoritative name servers, the current record-set count against the maxNumberOfRecordSets cap, and the individual recordSets hosted in the zone. For internal-only zones resolved from linked virtual networks, query azure.subscription.dnsService.privateZone.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"zones":{"name":"zones","type":"\u0019\u001bazure.subscription.dnsService.zone","title":"List of public DNS zones","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure DNS service","private":true,"min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.dnsService.privateZone":{"id":"azure.subscription.dnsService.privateZone","name":"azure.subscription.dnsService.privateZone","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Private DNS zone resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Private DNS zone location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxNumberOfRecordSets":{"name":"maxNumberOfRecordSets","type":"\u0005","is_mandatory":true,"title":"Maximum number of record sets allowed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Private DNS zone name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"numberOfRecordSets":{"name":"numberOfRecordSets","type":"\u0005","is_mandatory":true,"title":"Number of record sets in the zone","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"numberOfVirtualNetworkLinks":{"name":"numberOfVirtualNetworkLinks","type":"\u0005","is_mandatory":true,"title":"Number of virtual network links","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Private DNS zone tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkLink":{"name":"virtualNetworkLink","type":"\u001bazure.subscription.dnsService.privateZone.virtualNetworkLink","title":"Azure private DNS zone virtual network link","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualNetworkLinks":{"name":"virtualNetworkLinks","type":"\u0019\u001bazure.subscription.dnsService.privateZone.virtualNetworkLink","title":"Virtual network links for this private zone","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Private DNS zone","desc":"Private DNS zone whose records resolve only from the virtual networks linked to it, keeping internal name resolution off the public internet. Reports the provisioning state, the current record-set and virtual-network-link counts against their maximums, and the record sets hosted in the zone. Linked virtual networks, including which ones auto-register VM records, are reached through virtualNetworkLinks.","min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.dnsService.privateZone.virtualNetworkLink":{"id":"azure.subscription.dnsService.privateZone.virtualNetworkLink","name":"azure.subscription.dnsService.privateZone.virtualNetworkLink","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Virtual network link resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Virtual network link location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Virtual network link name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"registrationEnabled":{"name":"registrationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether auto-registration of VM records is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Virtual network link tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure private DNS zone virtual network link","private":true,"min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.dnsService.zone":{"id":"azure.subscription.dnsService.zone","name":"azure.subscription.dnsService.zone","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"DNS zone resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"DNS zone location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxNumberOfRecordSets":{"name":"maxNumberOfRecordSets","type":"\u0005","is_mandatory":true,"title":"Maximum number of record sets allowed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"DNS zone name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nameServers":{"name":"nameServers","type":"\u0019\u0007","is_mandatory":true,"title":"Name servers for the zone","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"numberOfRecordSets":{"name":"numberOfRecordSets","type":"\u0005","is_mandatory":true,"title":"Number of record sets in the zone","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"recordSet":{"name":"recordSet","type":"\u001bazure.subscription.dnsService.zone.recordSet","title":"Azure DNS record set","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"recordSets":{"name":"recordSets","type":"\u0019\u001bazure.subscription.dnsService.zone.recordSet","title":"Record sets in the zone","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"DNS zone tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure public DNS zone","desc":"Public DNS zone that hosts authoritative records for a domain and answers queries from the internet. Reports the assigned authoritative name servers, the current record-set count against the maxNumberOfRecordSets cap, and the individual recordSets hosted in the zone. For internal-only zones resolved from linked virtual networks, query azure.subscription.dnsService.privateZone.","min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.dnsService.zone.recordSet":{"id":"azure.subscription.dnsService.zone.recordSet","name":"azure.subscription.dnsService.zone.recordSet","fields":{"fqdn":{"name":"fqdn","type":"\u0007","is_mandatory":true,"title":"Fully qualified domain name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Record set resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Record set name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Record set properties","desc":"Raw record-set properties keyed by record type. The type-specific record array present depends on the record type: aRecords, aaaaRecords, cnameRecord, mxRecords, nsRecords, ptrRecords, srvRecords, txtRecords, caaRecords, and soaRecord. Also carries fqdn, TTL, metadata, provisioningState, and targetResource.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ttl":{"name":"ttl","type":"\u0005","is_mandatory":true,"title":"Time-to-live in seconds","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Record type (A, AAAA, CNAME, MX, NS, PTR, SOA, SRV, TXT, CAA)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure DNS record set","private":true,"min_provider_version":"13.3.3","defaults":"id name type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.eventGridService":{"id":"azure.subscription.eventGridService","name":"azure.subscription.eventGridService","fields":{"domain":{"name":"domain","type":"\u001bazure.subscription.eventGridService.domain","title":"Azure Event Grid domain","desc":"Multi-tenant topic container that scopes thousands of topics under a single publishing endpoint. As with a custom topic, its publish surface is governed by `disableLocalAuth`, `publicNetworkAccess`, `inboundIpRules`, and `minimumTlsVersionAllowed`, while `autoCreateTopicWithFirstSubscription` and `autoDeleteTopicWithLastSubscription` control the lifecycle of the domain topics beneath it. Audit these to confirm the shared endpoint is not publicly writable over weak transport or shared access keys.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"domains":{"name":"domains","type":"\u0019\u001bazure.subscription.eventGridService.domain","title":"Event Grid domains in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemTopic":{"name":"systemTopic","type":"\u001bazure.subscription.eventGridService.systemTopic","title":"Azure Event Grid system topic","desc":"Auto-generated topic through which an Azure resource (storage account, key vault, container registry, and similar) publishes its own events. The `source` field points back to the originating resource and `topicType` identifies the publisher category (for example \"Microsoft.Storage.StorageAccounts\" or \"Microsoft.KeyVault.vaults\"), which together reveal which resources are wired into event routing and under what identity.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"systemTopics":{"name":"systemTopics","type":"\u0019\u001bazure.subscription.eventGridService.systemTopic","title":"Event Grid system topics in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"topic":{"name":"topic","type":"\u001bazure.subscription.eventGridService.topic","title":"Azure Event Grid custom topic","desc":"User-created event ingestion endpoint that clients publish events to. Custom topics are the primary control point for publish security: `disableLocalAuth` governs whether key-based publishing is allowed, `publicNetworkAccess` and `inboundIpRules` gate network reachability, and `minimumTlsVersionAllowed` sets the transport floor for publishers. Audit these together to confirm a topic is not publicly writable over weak transport or shared access keys.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"topics":{"name":"topics","type":"\u0019\u001bazure.subscription.eventGridService.topic","title":"Event Grid custom topics in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Event Grid service","private":true,"min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.eventGridService.domain":{"id":"azure.subscription.eventGridService.domain","name":"azure.subscription.eventGridService.domain","fields":{"autoCreateTopicWithFirstSubscription":{"name":"autoCreateTopicWithFirstSubscription","type":"\u0004","is_mandatory":true,"title":"Whether domain topics are auto-created when the first subscription is created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"autoDeleteTopicWithLastSubscription":{"name":"autoDeleteTopicWithLastSubscription","type":"\u0004","is_mandatory":true,"title":"Whether domain topics are auto-deleted when the last subscription is deleted","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataResidencyBoundary":{"name":"dataResidencyBoundary","type":"\u0007","is_mandatory":true,"title":"Data residency boundary (\"WithinGeopair\" or \"WithinRegion\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether local (key) authentication is disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpoint":{"name":"endpoint","type":"\u0007","is_mandatory":true,"title":"Endpoint URL clients publish events to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Domain resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityType":{"name":"identityType","type":"\u0007","is_mandatory":true,"title":"Identity type (\"None\", \"SystemAssigned\", \"UserAssigned\", \"SystemAssigned, UserAssigned\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inboundIpRules":{"name":"inboundIpRules","type":"\u0019\n","is_mandatory":true,"title":"Inbound IP rules; each entry has ipMask and action (\"Allow\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inputSchema":{"name":"inputSchema","type":"\u0007","is_mandatory":true,"title":"Input schema for events (\"EventGridSchema\", \"CustomEventSchema\", \"CloudEventSchemaV1_0\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Domain location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metricResourceId":{"name":"metricResourceId","type":"\u0007","is_mandatory":true,"title":"Metric resource ID for the domain","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minimumTlsVersionAllowed":{"name":"minimumTlsVersionAllowed","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version enforced on publishers (\"1.0\", \"1.1\", \"1.2\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Domain name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnectionCount":{"name":"privateEndpointConnectionCount","type":"\u0005","is_mandatory":true,"title":"Number of private endpoint connections to the domain","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access setting (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Domain tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Event Grid domain","desc":"Multi-tenant topic container that scopes thousands of topics under a single publishing endpoint. As with a custom topic, its publish surface is governed by `disableLocalAuth`, `publicNetworkAccess`, `inboundIpRules`, and `minimumTlsVersionAllowed`, while `autoCreateTopicWithFirstSubscription` and `autoDeleteTopicWithLastSubscription` control the lifecycle of the domain topics beneath it. Audit these to confirm the shared endpoint is not publicly writable over weak transport or shared access keys.","min_provider_version":"13.10.2","defaults":"name location publicNetworkAccess provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.eventGridService.systemTopic":{"id":"azure.subscription.eventGridService.systemTopic","name":"azure.subscription.eventGridService.systemTopic","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"System topic resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityType":{"name":"identityType","type":"\u0007","is_mandatory":true,"title":"Identity type (\"None\", \"SystemAssigned\", \"UserAssigned\", \"SystemAssigned, UserAssigned\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"System topic location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metricResourceId":{"name":"metricResourceId","type":"\u0007","is_mandatory":true,"title":"Metric resource ID for the system topic","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"System topic name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Source resource ID (the Azure resource that publishes events through this system topic)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"System topic tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"topicType":{"name":"topicType","type":"\u0007","is_mandatory":true,"title":"Topic type (e.g. \"Microsoft.Storage.StorageAccounts\", \"Microsoft.KeyVault.vaults\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Event Grid system topic","desc":"Auto-generated topic through which an Azure resource (storage account, key vault, container registry, and similar) publishes its own events. The `source` field points back to the originating resource and `topicType` identifies the publisher category (for example \"Microsoft.Storage.StorageAccounts\" or \"Microsoft.KeyVault.vaults\"), which together reveal which resources are wired into event routing and under what identity.","min_provider_version":"13.10.2","defaults":"name location topicType source provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.eventGridService.topic":{"id":"azure.subscription.eventGridService.topic","name":"azure.subscription.eventGridService.topic","fields":{"dataResidencyBoundary":{"name":"dataResidencyBoundary","type":"\u0007","is_mandatory":true,"title":"Data residency boundary (\"WithinGeopair\" or \"WithinRegion\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether local (key) authentication is disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpoint":{"name":"endpoint","type":"\u0007","is_mandatory":true,"title":"Endpoint URL clients publish events to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Topic resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityType":{"name":"identityType","type":"\u0007","is_mandatory":true,"title":"Identity type (\"None\", \"SystemAssigned\", \"UserAssigned\", \"SystemAssigned, UserAssigned\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inboundIpRules":{"name":"inboundIpRules","type":"\u0019\n","is_mandatory":true,"title":"Inbound IP rules; each entry has ipMask and action (\"Allow\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inputSchema":{"name":"inputSchema","type":"\u0007","is_mandatory":true,"title":"Input schema for events (\"EventGridSchema\", \"CustomEventSchema\", \"CloudEventSchemaV1_0\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Topic location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metricResourceId":{"name":"metricResourceId","type":"\u0007","is_mandatory":true,"title":"Metric resource ID for the topic","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minimumTlsVersionAllowed":{"name":"minimumTlsVersionAllowed","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version enforced on publishers (\"1.0\", \"1.1\", \"1.2\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Topic name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnectionCount":{"name":"privateEndpointConnectionCount","type":"\u0005","is_mandatory":true,"title":"Number of private endpoint connections to the topic","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state (\"Succeeded\", \"Canceled\", \"Creating\", \"Deleting\", \"Failed\", \"Updating\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access setting (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Topic tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Event Grid custom topic","desc":"User-created event ingestion endpoint that clients publish events to. Custom topics are the primary control point for publish security: `disableLocalAuth` governs whether key-based publishing is allowed, `publicNetworkAccess` and `inboundIpRules` gate network reachability, and `minimumTlsVersionAllowed` sets the transport floor for publishers. Audit these together to confirm a topic is not publicly writable over weak transport or shared access keys.","min_provider_version":"13.10.2","defaults":"name location publicNetworkAccess provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.eventHubService":{"id":"azure.subscription.eventHubService","name":"azure.subscription.eventHubService","fields":{"authorizationRule":{"name":"authorizationRule","type":"\u001bazure.subscription.eventHubService.authorizationRule","title":"Event Hubs shared access signature authorization rule","desc":"Shared access signature (SAS) policy attached to an Event Hubs namespace or an individual Event Hub, selected by `name`. The `rights` list enumerates the granted permissions: Listen, Send, or Manage. A rule that grants Manage (including the default RootManageSharedAccessKey) confers full control, so audit these to find over-privileged keys and to confirm SAS access is scoped to the minimum each client needs.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"namespace":{"name":"namespace","type":"\u001bazure.subscription.eventHubService.namespace","title":"Azure Event Hubs namespace","desc":"Streaming-ingestion entity scope that owns Event Hubs and their consumer groups. The namespace determines the security posture of everything inside it: SAS-key authentication can be disabled in favor of Entra ID via disableLocalAuth, a minimum TLS version enforced, public network access restricted, network rule sets applied, and customer-managed keys used for encryption at rest. Audit these settings to confirm a namespace is not reachable over unauthenticated or plaintext paths.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"namespaces":{"name":"namespaces","type":"\u0019\u001bazure.subscription.eventHubService.namespace","title":"List of Event Hub namespaces","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Event Hubs service","private":true,"min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.eventHubService.authorizationRule":{"id":"azure.subscription.eventHubService.authorizationRule","name":"azure.subscription.eventHubService.authorizationRule","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Authorization rule resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Authorization rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rights":{"name":"rights","type":"\u0019\u0007","is_mandatory":true,"title":"Granted rights (Listen, Send, Manage)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Event Hubs shared access signature authorization rule","desc":"Shared access signature (SAS) policy attached to an Event Hubs namespace or an individual Event Hub, selected by `name`. The `rights` list enumerates the granted permissions: Listen, Send, or Manage. A rule that grants Manage (including the default RootManageSharedAccessKey) confers full control, so audit these to find over-privileged keys and to confirm SAS access is scoped to the minimum each client needs.","private":true,"min_provider_version":"13.32.1","defaults":"name rights","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.eventHubService.namespace":{"id":"azure.subscription.eventHubService.namespace","name":"azure.subscription.eventHubService.namespace","fields":{"authorizationRules":{"name":"authorizationRules","type":"\u0019\u001bazure.subscription.eventHubService.authorizationRule","title":"Shared access signature (SAS) authorization rules on the namespace","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeySource":{"name":"cmkKeySource","type":"\u0007","is_mandatory":true,"title":"CMK key source (\"Microsoft.KeyVault\" when CMK is configured; empty for platform-managed)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeys":{"name":"cmkKeys","type":"\u0019\n","is_mandatory":true,"title":"Customer-managed encryption keys","desc":"Key Vault references used to encrypt data at rest. Each entry has `keyName`, `keyVaultUri`, `keyVersion`, and an `identity` used to reach the key.","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the namespace was created","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether local (SAS key) authentication is disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"eventHub":{"name":"eventHub","type":"\u001bazure.subscription.eventHubService.namespace.eventHub","title":"Azure Event Hub","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"eventHubs":{"name":"eventHubs","type":"\u0019\u001bazure.subscription.eventHubService.namespace.eventHub","title":"Event Hubs in this namespace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Namespace resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isAutoInflateEnabled":{"name":"isAutoInflateEnabled","type":"\u0004","is_mandatory":true,"title":"Whether auto-inflate is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kafkaEnabled":{"name":"kafkaEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Kafka is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Namespace location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maximumThroughputUnits":{"name":"maximumThroughputUnits","type":"\u0005","is_mandatory":true,"title":"Maximum throughput units when auto-inflate is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minimumTlsVersion":{"name":"minimumTlsVersion","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version (e.g., \"1.0\", \"1.1\", \"1.2\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Namespace name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkRuleSet":{"name":"networkRuleSet","type":"\n","title":"Raw namespace network rule set","desc":"Deprecated in favor of `networkRules()`.","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"networkRules":{"name":"networkRules","type":"\u001bazure.subscription.eventHubService.namespace.networkRules","title":"Namespace network rules (default action, public network access, IP / VNet rules, trusted-service access)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections to the namespace","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether public network access is enabled (\"Enabled\", \"Disabled\", or \"SecuredByPerimeter\")","min_provider_version":"13.4.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requireInfrastructureEncryption":{"name":"requireInfrastructureEncryption","type":"\u0004","is_mandatory":true,"title":"Whether double encryption (infrastructure layer + CMK) is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"SKU tier and capacity","desc":"Keys: `name` and `tier` (one of Basic, Standard, or Premium), and `capacity` (the provisioned throughput or premium units).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Namespace status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Namespace tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zoneRedundant":{"name":"zoneRedundant","type":"\u0004","is_mandatory":true,"title":"Whether the namespace is zone-redundant","min_provider_version":"13.4.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Event Hubs namespace","desc":"Streaming-ingestion entity scope that owns Event Hubs and their consumer groups. The namespace determines the security posture of everything inside it: SAS-key authentication can be disabled in favor of Entra ID via disableLocalAuth, a minimum TLS version enforced, public network access restricted, network rule sets applied, and customer-managed keys used for encryption at rest. Audit these settings to confirm a namespace is not reachable over unauthenticated or plaintext paths.","min_provider_version":"13.3.3","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.eventHubService.namespace.eventHub":{"id":"azure.subscription.eventHubService.namespace.eventHub","name":"azure.subscription.eventHubService.namespace.eventHub","fields":{"authorizationRules":{"name":"authorizationRules","type":"\u0019\u001bazure.subscription.eventHubService.authorizationRule","title":"Shared access signature (SAS) authorization rules on the Event Hub","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"consumerGroup":{"name":"consumerGroup","type":"\u001bazure.subscription.eventHubService.namespace.eventHub.consumerGroup","title":"Azure Event Hub consumer group","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"consumerGroups":{"name":"consumerGroups","type":"\u0019\u001bazure.subscription.eventHubService.namespace.eventHub.consumerGroup","title":"Consumer groups for this Event Hub","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the Event Hub was created","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Event Hub resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"messageRetentionInDays":{"name":"messageRetentionInDays","type":"\u0005","is_mandatory":true,"title":"Message retention period in days","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Event Hub name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"partitionCount":{"name":"partitionCount","type":"\u0005","is_mandatory":true,"title":"Number of partitions","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"partitionIds":{"name":"partitionIds","type":"\u0019\u0007","is_mandatory":true,"title":"List of partition IDs","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Event Hub status (Active, Disabled, SendDisabled)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Event Hub","private":true,"min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.eventHubService.namespace.eventHub.consumerGroup":{"id":"azure.subscription.eventHubService.namespace.eventHub.consumerGroup","name":"azure.subscription.eventHubService.namespace.eventHub.consumerGroup","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the consumer group was created","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Consumer group resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Consumer group name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userMetadata":{"name":"userMetadata","type":"\u0007","is_mandatory":true,"title":"User-defined metadata","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Event Hub consumer group","private":true,"min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.eventHubService.namespace.networkRules":{"id":"azure.subscription.eventHubService.namespace.networkRules","name":"azure.subscription.eventHubService.namespace.networkRules","fields":{"defaultAction":{"name":"defaultAction","type":"\u0007","is_mandatory":true,"title":"Default action for traffic that does not match any rule (\"Allow\" or \"Deny\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipRules":{"name":"ipRules","type":"\u0019\n","is_mandatory":true,"title":"IP allow rules. Each entry is `{ipMask, action}` where `action` is \"Allow\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether traffic is allowed over the public network (\"Enabled\", \"Disabled\", or \"SecuredByPerimeter\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trustedServiceAccessEnabled":{"name":"trustedServiceAccessEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Microsoft-owned trusted services can bypass the rule set","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkRule":{"name":"virtualNetworkRule","type":"\u001bazure.subscription.eventHubService.namespace.networkRules.virtualNetworkRule","title":"Event Hubs namespace virtual network rule","desc":"Single virtual-network rule attached to an Event Hubs namespace, resolving to the referenced subnet. The ignoreMissingVnetServiceEndpoint flag indicates whether the rule permits traffic from the subnet even when the subnet has not yet enabled the Microsoft.EventHub service endpoint.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualNetworkRules":{"name":"virtualNetworkRules","type":"\u0019\u001bazure.subscription.eventHubService.namespace.networkRules.virtualNetworkRule","is_mandatory":true,"title":"Virtual network rules; each references a subnet","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Event Hubs namespace network rule set","desc":"Namespace-level network access policy. The defaultAction (Allow or Deny) applies to traffic that matches no rule, publicNetworkAccess controls whether the public endpoint is reachable at all, trustedServiceAccessEnabled lets Microsoft-owned services bypass the rule set, and ipRules and virtualNetworkRules enumerate the explicitly permitted sources. A defaultAction of Allow leaves the namespace open to any network.","private":true,"min_provider_version":"13.12.2","defaults":"defaultAction publicNetworkAccess trustedServiceAccessEnabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.eventHubService.namespace.networkRules.virtualNetworkRule":{"id":"azure.subscription.eventHubService.namespace.networkRules.virtualNetworkRule","name":"azure.subscription.eventHubService.namespace.networkRules.virtualNetworkRule","fields":{"ignoreMissingVnetServiceEndpoint":{"name":"ignoreMissingVnetServiceEndpoint","type":"\u0004","is_mandatory":true,"title":"Whether to allow traffic from the subnet even if the Microsoft.EventHub service endpoint is not yet enabled on it","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet referenced by the rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Event Hubs namespace virtual network rule","desc":"Single virtual-network rule attached to an Event Hubs namespace, resolving to the referenced subnet. The ignoreMissingVnetServiceEndpoint flag indicates whether the rule permits traffic from the subnet even when the subnet has not yet enabled the Microsoft.EventHub service endpoint.","private":true,"min_provider_version":"13.12.2","defaults":"ignoreMissingVnetServiceEndpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.frontDoorService":{"id":"azure.subscription.frontDoorService","name":"azure.subscription.frontDoorService","fields":{"profile":{"name":"profile","type":"\u001bazure.subscription.frontDoorService.profile","title":"Azure Front Door / CDN profile","desc":"Azure Front Door (Standard / Premium) or classic CDN profile, the top-level container for a content-delivery configuration. The `sku` name selects the tier: Standard_AzureFrontDoor, Premium_AzureFrontDoor, Standard_Microsoft, Standard_Verizon, Premium_Verizon, Standard_Akamai, or Standard_ChinaCdn. Audit the profile to reach its endpoints, custom domains, origin groups, and the security policies that bind Web Application Firewall protection to its domains.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"profiles":{"name":"profiles","type":"\u0019\u001bazure.subscription.frontDoorService.profile","title":"List of Front Door and CDN profiles","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Front Door and CDN service","private":true,"min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.frontDoorService.profile":{"id":"azure.subscription.frontDoorService.profile","name":"azure.subscription.frontDoorService.profile","fields":{"customDomain":{"name":"customDomain","type":"\u001bazure.subscription.frontDoorService.profile.customDomain","title":"Azure Front Door / CDN custom domain","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"customDomains":{"name":"customDomains","type":"\u0019\u001bazure.subscription.frontDoorService.profile.customDomain","title":"Custom domains in this profile","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpoint":{"name":"endpoint","type":"\u001bazure.subscription.frontDoorService.profile.endpoint","title":"Azure Front Door / CDN endpoint","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"endpoints":{"name":"endpoints","type":"\u0019\u001bazure.subscription.frontDoorService.profile.endpoint","title":"Endpoints in this profile","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"frontDoorId":{"name":"frontDoorId","type":"\u0007","is_mandatory":true,"title":"Front Door ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Profile resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Profile kind (frontdoor, cdn)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Profile location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Profile name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"originGroup":{"name":"originGroup","type":"\u001bazure.subscription.frontDoorService.profile.originGroup","title":"Azure Front Door / CDN origin group","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"originGroups":{"name":"originGroups","type":"\u0019\u001bazure.subscription.frontDoorService.profile.originGroup","title":"Origin groups in this profile","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceState":{"name":"resourceState","type":"\u0007","is_mandatory":true,"title":"Resource state (Active, Disabled, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityPolicies":{"name":"securityPolicies","type":"\u0019\u001bazure.subscription.frontDoorService.profile.securityPolicy","title":"Security policies (Web Application Firewall associations) attached to this profile","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityPolicy":{"name":"securityPolicy","type":"\u001bazure.subscription.frontDoorService.profile.securityPolicy","title":"Azure Front Door security policy associating a WAF policy with domains","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"Pricing tier","desc":"Object with a single `name` key holding the pricing tier: Standard_AzureFrontDoor, Premium_AzureFrontDoor, Standard_Microsoft, Standard_Verizon, Premium_Verizon, Standard_Akamai, or Standard_ChinaCdn.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Profile tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Front Door / CDN profile","desc":"Azure Front Door (Standard / Premium) or classic CDN profile, the top-level container for a content-delivery configuration. The `sku` name selects the tier: Standard_AzureFrontDoor, Premium_AzureFrontDoor, Standard_Microsoft, Standard_Verizon, Premium_Verizon, Standard_Akamai, or Standard_ChinaCdn. Audit the profile to reach its endpoints, custom domains, origin groups, and the security policies that bind Web Application Firewall protection to its domains.","min_provider_version":"13.3.3","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.frontDoorService.profile.customDomain":{"id":"azure.subscription.frontDoorService.profile.customDomain","name":"azure.subscription.frontDoorService.profile.customDomain","fields":{"hostName":{"name":"hostName","type":"\u0007","is_mandatory":true,"title":"Custom domain hostname","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Custom domain resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Custom domain name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tlsCertificateType":{"name":"tlsCertificateType","type":"\u0007","is_mandatory":true,"title":"Certificate source (\"CustomerCertificate\", \"ManagedCertificate\", or \"AzureFirstPartyManagedCertificate\")","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tlsMinimumVersion":{"name":"tlsMinimumVersion","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version configured for HTTPS on this domain (\"TLS10\", \"TLS12\", or empty if not set)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"validationState":{"name":"validationState","type":"\u0007","is_mandatory":true,"title":"Domain validation state (Approved, Pending, Rejected, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Front Door / CDN custom domain","private":true,"min_provider_version":"13.3.3","defaults":"id name hostName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.frontDoorService.profile.endpoint":{"id":"azure.subscription.frontDoorService.profile.endpoint","name":"azure.subscription.frontDoorService.profile.endpoint","fields":{"enabledState":{"name":"enabledState","type":"\u0007","is_mandatory":true,"title":"Enabled state (Enabled, Disabled)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostName":{"name":"hostName","type":"\u0007","is_mandatory":true,"title":"Endpoint hostname","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Endpoint resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Endpoint location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Endpoint name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"route":{"name":"route","type":"\u001bazure.subscription.frontDoorService.profile.endpoint.route","title":"Azure Front Door / CDN route attached to an endpoint","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"routes":{"name":"routes","type":"\u0019\u001bazure.subscription.frontDoorService.profile.endpoint.route","title":"Routes attached to this endpoint","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Front Door / CDN endpoint","private":true,"min_provider_version":"13.3.3","defaults":"id name hostName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.frontDoorService.profile.endpoint.route":{"id":"azure.subscription.frontDoorService.profile.endpoint.route","name":"azure.subscription.frontDoorService.profile.endpoint.route","fields":{"enabledState":{"name":"enabledState","type":"\u0007","is_mandatory":true,"title":"Route enabled state (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"forwardingProtocol":{"name":"forwardingProtocol","type":"\u0007","is_mandatory":true,"title":"Forwarding protocol to origin (\"HttpOnly\", \"HttpsOnly\", or \"MatchRequest\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"httpsRedirect":{"name":"httpsRedirect","type":"\u0007","is_mandatory":true,"title":"Whether HTTP traffic is automatically redirected to HTTPS (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Route resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"linkToDefaultDomain":{"name":"linkToDefaultDomain","type":"\u0007","is_mandatory":true,"title":"Whether the route is linked to the default endpoint domain (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Route name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"originGroupId":{"name":"originGroupId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the origin group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"originPath":{"name":"originPath","type":"\u0007","is_mandatory":true,"title":"Origin path on the backend","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"patternsToMatch":{"name":"patternsToMatch","type":"\u0019\u0007","is_mandatory":true,"title":"URL patterns matched by the route","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"supportedProtocols":{"name":"supportedProtocols","type":"\u0019\u0007","is_mandatory":true,"title":"Protocols accepted by the route (\"Http\", \"Https\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Front Door / CDN route attached to an endpoint","private":true,"min_provider_version":"13.5.1","defaults":"id name httpsRedirect supportedProtocols","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.frontDoorService.profile.originGroup":{"id":"azure.subscription.frontDoorService.profile.originGroup","name":"azure.subscription.frontDoorService.profile.originGroup","fields":{"healthProbeSettings":{"name":"healthProbeSettings","type":"\n","is_mandatory":true,"title":"Health probe settings","desc":"Object with `probePath` (path requested against each origin), `probeProtocol` (Http, Https, or NotSet), `probeRequestType` (GET or HEAD), and `probeIntervalInSeconds` (seconds between probes).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Origin group resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"loadBalancingSettings":{"name":"loadBalancingSettings","type":"\n","is_mandatory":true,"title":"Load balancing settings","desc":"Object with `sampleSize` (samples considered per load-balancing decision), `successfulSamplesRequired` (samples that must succeed for an origin to be considered healthy), and `additionalLatencyInMilliseconds` (latency band width used when grouping origins by latency).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Origin group name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"origin":{"name":"origin","type":"\u001bazure.subscription.frontDoorService.profile.originGroup.origin","title":"Azure Front Door / CDN origin","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"origins":{"name":"origins","type":"\u0019\u001bazure.subscription.frontDoorService.profile.originGroup.origin","title":"Origins in this origin group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Front Door / CDN origin group","private":true,"min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.frontDoorService.profile.originGroup.origin":{"id":"azure.subscription.frontDoorService.profile.originGroup.origin","name":"azure.subscription.frontDoorService.profile.originGroup.origin","fields":{"enabledState":{"name":"enabledState","type":"\u0007","is_mandatory":true,"title":"Enabled state (Enabled, Disabled)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostName":{"name":"hostName","type":"\u0007","is_mandatory":true,"title":"Origin hostname","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"httpPort":{"name":"httpPort","type":"\u0005","is_mandatory":true,"title":"HTTP port","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"httpsPort":{"name":"httpsPort","type":"\u0005","is_mandatory":true,"title":"HTTPS port","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Origin resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Origin name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"originHostHeader":{"name":"originHostHeader","type":"\u0007","is_mandatory":true,"title":"Origin host header","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Origin priority (1-5)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"weight":{"name":"weight","type":"\u0005","is_mandatory":true,"title":"Origin weight (1-1000)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Front Door / CDN origin","private":true,"min_provider_version":"13.3.3","defaults":"id name hostName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.frontDoorService.profile.securityPolicy":{"id":"azure.subscription.frontDoorService.profile.securityPolicy","name":"azure.subscription.frontDoorService.profile.securityPolicy","fields":{"associations":{"name":"associations","type":"\u0019\n","is_mandatory":true,"title":"Domains and path patterns the WAF policy protects","desc":"Each entry has `domains` (a list of domain references, each carrying an `id` and an `isActive` flag) and `patternsToMatch` (the URL path patterns the policy applies to).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Security policy resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Security policy name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyType":{"name":"policyType","type":"\u0007","is_mandatory":true,"title":"Security policy type (e.g. \"WebApplicationFirewall\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"wafPolicyId":{"name":"wafPolicyId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the associated WAF policy (empty if none is associated)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Front Door security policy associating a WAF policy with domains","private":true,"min_provider_version":"13.16.2","defaults":"id name policyType wafPolicyId","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.functionsService":{"id":"azure.subscription.functionsService","name":"azure.subscription.functionsService","fields":{"functionApp":{"name":"functionApp","type":"\u001bazure.subscription.functionsService.functionApp","title":"Azure Function App","desc":"Function App, an App Service site configured to run serverless functions. Covers runtime state, HTTPS-only enforcement, client certificate mode, managed-identity assignments, public network access, and regional virtual-network integration. The site configuration (minimum TLS version, FTPS state, IP restrictions, CORS, always-on) is available through `configuration`, while `appSettings` and `connectionStrings` report the configured settings without exposing their values, so you can audit for plaintext secrets and Azure Key Vault reference usage.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"functionApps":{"name":"functionApps","type":"\u0019\u001bazure.subscription.functionsService.functionApp","title":"List of function apps","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Functions service","private":true,"min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.functionsService.functionApp":{"id":"azure.subscription.functionsService.functionApp","name":"azure.subscription.functionsService.functionApp","fields":{"appSetting":{"name":"appSetting","type":"\u001bazure.subscription.functionsService.functionApp.appSetting","title":"Azure Function App application setting","desc":"Single application setting on a function app, selectable by its composite id. Reports whether the value resolves through Azure Key Vault (`hasKeyVaultReference`), whether the setting is sticky across slot swaps (`slotSetting`), and a heuristic flag (`isLikelySecret`) for setting names that suggest secret content, supporting audits for any plaintext secret-like setting that is not a Key Vault reference.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"appSettings":{"name":"appSettings","type":"\u0019\u001bazure.subscription.functionsService.functionApp.appSetting","title":"Application settings configured on the function app","desc":"Values are not returned — each entry exposes name, slot-stickiness, Key-Vault-reference detection, and a heuristic flag for secret-bearing names.","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"clientCertEnabled":{"name":"clientCertEnabled","type":"\u0004","is_mandatory":true,"title":"Whether client certificates are enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"clientCertMode":{"name":"clientCertMode","type":"\u0007","is_mandatory":true,"title":"Client certificate mode (Required, Optional, OptionalInteractiveUser)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"configuration":{"name":"configuration","type":"\u001bazure.subscription.webService.appsiteconfig","title":"Site configuration: minimum TLS version, FTPS state, HTTP/2, always-on, remote debugging, and IP restrictions","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionStrings":{"name":"connectionStrings","type":"\u0019\n","title":"Connection strings configured on the function app","desc":"Each entry has shape {name, type, hasKeyVaultReference, slotSetting}. Connection-string values are not returned.","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultHostName":{"name":"defaultHostName","type":"\u0007","is_mandatory":true,"title":"Default hostname of the function app","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"function":{"name":"function","type":"\u001bazure.subscription.functionsService.functionApp.function","title":"Azure Function within a Function App","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"functions":{"name":"functions","type":"\u0019\u001bazure.subscription.functionsService.functionApp.function","title":"Functions in this function app","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"httpsOnly":{"name":"httpsOnly","type":"\u0004","is_mandatory":true,"title":"Whether the function app only accepts HTTPS traffic","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Function App resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultReferenceIdentity":{"name":"keyVaultReferenceIdentity","type":"\u0007","is_mandatory":true,"title":"Identity used to resolve Key Vault references in app settings and connection strings (resource ID of a user-assigned identity, or \"SystemAssigned\")","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Function App kind (e.g., \"functionapp\", \"functionapp,linux\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Function App location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedServiceIdentityId":{"name":"managedServiceIdentityId","type":"\u0007","is_mandatory":true,"title":"Managed service identity ID","desc":"Deprecated in favor of principalId and userAssignedIdentities.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Function App name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the function app's system-assigned managed identity; empty when no system-assigned identity is enabled","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw Azure Resource Manager site properties","desc":"Full SiteProperties object returned by ARM for the function app, including hosting-plan binding, host names, and site state. Many of these values are surfaced as top-level fields (state, defaultHostName, httpsOnly, publicNetworkAccess); use those for stable audits and this dict for keys not otherwise modeled.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether public network access is enabled (\"Enabled\" or \"Disabled\")","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Function App state (e.g., \"Running\", \"Stopped\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemAssignedIdentity":{"name":"systemAssignedIdentity","type":"\u001bazure.subscription.managedIdentity","title":"System-assigned managed identity of the function app; null when no system-assigned identity is enabled","desc":"Resolves the system-assigned identity so its role assignments, and their role definitions and permissions, can be traversed, completing the resource-to-privilege leg of an attack path.","min_provider_version":"13.26.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Function App tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities attached to the function app","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkSubnet":{"name":"virtualNetworkSubnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet the function app is regionally VNet-integrated with; null when no regional VNet integration is configured","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkSubnetId":{"name":"virtualNetworkSubnetId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the subnet the function app is regionally VNet-integrated with; empty when no regional VNet integration is configured","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Function App","desc":"Function App, an App Service site configured to run serverless functions. Covers runtime state, HTTPS-only enforcement, client certificate mode, managed-identity assignments, public network access, and regional virtual-network integration. The site configuration (minimum TLS version, FTPS state, IP restrictions, CORS, always-on) is available through `configuration`, while `appSettings` and `connectionStrings` report the configured settings without exposing their values, so you can audit for plaintext secrets and Azure Key Vault reference usage.","min_provider_version":"13.3.3","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.functionsService.functionApp.appSetting":{"id":"azure.subscription.functionsService.functionApp.appSetting","name":"azure.subscription.functionsService.functionApp.appSetting","fields":{"hasKeyVaultReference":{"name":"hasKeyVaultReference","type":"\u0004","is_mandatory":true,"title":"Whether the setting's value is a Key Vault reference","desc":"True when the value starts with `@Microsoft.KeyVault(...)`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hasValue":{"name":"hasValue","type":"\u0004","is_mandatory":true,"title":"Whether the setting has a non-empty value (the value itself is not exposed)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Composite ID: \u003cfunctionAppId\u003e/config/appsettings/\u003cname\u003e","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isLikelySecret":{"name":"isLikelySecret","type":"\u0004","is_mandatory":true,"title":"Whether the setting name suggests it carries a secret","desc":"True when the name (case-insensitively) contains \"key\", \"password\", \"secret\", \"token\", or a connection-string identifier ending in `str`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Setting name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"slotSetting":{"name":"slotSetting","type":"\u0004","is_mandatory":true,"title":"Whether the setting is \"sticky\" on slot swaps","desc":"Configured via the app's slot-config-names list.","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Function App application setting","desc":"Single application setting on a function app, selectable by its composite id. Reports whether the value resolves through Azure Key Vault (`hasKeyVaultReference`), whether the setting is sticky across slot swaps (`slotSetting`), and a heuristic flag (`isLikelySecret`) for setting names that suggest secret content, supporting audits for any plaintext secret-like setting that is not a Key Vault reference.","private":true,"min_provider_version":"13.10.2","defaults":"name hasKeyVaultReference isLikelySecret slotSetting","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.functionsService.functionApp.function":{"id":"azure.subscription.functionsService.functionApp.function","name":"azure.subscription.functionsService.functionApp.function","fields":{"config":{"name":"config","type":"\n","is_mandatory":true,"title":"Function configuration (function.json)","desc":"Raw function.json content: the `bindings` array (trigger and input/output binding definitions with their type, direction, and name), the `disabled` flag, and script settings such as `scriptFile` and `entryPoint`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Function resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isDisabled":{"name":"isDisabled","type":"\u0004","is_mandatory":true,"title":"Whether the function is disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"language":{"name":"language","type":"\u0007","is_mandatory":true,"title":"Function language","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Function name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Function within a Function App","private":true,"min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.iotService":{"id":"azure.subscription.iotService","name":"azure.subscription.iotService","fields":{"hubs":{"name":"hubs","type":"\u0019\n","title":"Raw IoT hubs in the subscription","desc":"Deprecated in favor of `iotHubs`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"iotHub":{"name":"iotHub","type":"\u001bazure.subscription.iotService.iotHub","title":"Azure IoT hub","desc":"Single IoT Hub instance, the cloud endpoint that authenticates devices and ingests their telemetry. Security-relevant settings include the SAS-key authentication policy (`disableLocalAuth`, `disableDeviceSAS`, `disableModuleSAS`), `minTlsVersion`, `publicNetworkAccess`, outbound egress restrictions via `restrictOutboundNetworkAccess` and `allowedFqdnList`, the `networkRuleSet` IP filter, and managed identity assignment. The `id` field is the full resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"iotHubs":{"name":"iotHubs","type":"\u0019\u001bazure.subscription.iotService.iotHub","title":"Typed IoT hubs in the subscription","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure IoT Hub Service","desc":"IoT Hub deployments across the subscription. IoT Hub is the managed service that brokers bidirectional communication between IoT devices and Azure. Query `iotHubs` to audit each hub's authentication policy (SAS-key controls), TLS enforcement, public network exposure, outbound egress restrictions, and managed identity assignment.","private":true,"min_provider_version":"11.3.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.iotService.iotHub":{"id":"azure.subscription.iotService.iotHub","name":"azure.subscription.iotService.iotHub","fields":{"allowedFqdnList":{"name":"allowedFqdnList","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed FQDNs for egress when restrictOutboundNetworkAccess is true","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettings":{"name":"diagnosticSettings","type":"\u0019\u001bazure.subscription.monitorService.diagnosticsetting","title":"Diagnostic settings configured on the IoT hub (forwarding logs and metrics to Log Analytics, storage, or Event Hub)","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettingsCategories":{"name":"diagnosticSettingsCategories","type":"\u0019\u001bazure.subscription.monitorService.diagnosticSettingsCategory","title":"Diagnostic settings categories the IoT hub can emit (available log and metric categories)","min_provider_version":"13.30.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableDeviceSAS":{"name":"disableDeviceSAS","type":"\u0004","is_mandatory":true,"title":"Whether device-scoped SAS keys are disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether SAS-based local authentication is disabled (Hub-scoped SAS keys cannot authenticate)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableModuleSAS":{"name":"disableModuleSAS","type":"\u0004","is_mandatory":true,"title":"Whether module-scoped SAS keys are disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableDataResidency":{"name":"enableDataResidency","type":"\u0004","is_mandatory":true,"title":"Whether data residency is enabled (disables disaster recovery)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostName":{"name":"hostName","type":"\u0007","is_mandatory":true,"title":"Hostname (FQDN)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"IoT hub resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityType":{"name":"identityType","type":"\u0007","is_mandatory":true,"title":"Managed identity type (\"None\", \"SystemAssigned\", \"UserAssigned\", \"SystemAssigned, UserAssigned\")","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Azure region the IoT hub is deployed in","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minTlsVersion":{"name":"minTlsVersion","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version (e.g. \"1.2\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"IoT hub name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkRuleSet":{"name":"networkRuleSet","type":"\n","is_mandatory":true,"title":"Network rule set: defaultAction, applyToBuiltInEventHubEndpoint, ipRules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the system-assigned managed identity","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections to the IoT hub","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"restrictOutboundNetworkAccess":{"name":"restrictOutboundNetworkAccess","type":"\u0004","is_mandatory":true,"title":"Whether egress is restricted to AllowedFqdnList","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"SKU details","desc":"Pricing and scale keyed by `name` (edition, one of F1, B1, B2, B3, S1, S2, or S3), `tier` (Free, Basic, or Standard), and `capacity` (number of provisioned units).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Hub state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Tags applied to the IoT hub","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Tenant ID of the system-assigned managed identity","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities associated with the IoT hub","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure IoT hub","desc":"Single IoT Hub instance, the cloud endpoint that authenticates devices and ingests their telemetry. Security-relevant settings include the SAS-key authentication policy (`disableLocalAuth`, `disableDeviceSAS`, `disableModuleSAS`), `minTlsVersion`, `publicNetworkAccess`, outbound egress restrictions via `restrictOutboundNetworkAccess` and `allowedFqdnList`, the `networkRuleSet` IP filter, and managed identity assignment. The `id` field is the full resource ID.","private":true,"min_provider_version":"13.5.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService":{"id":"azure.subscription.keyVaultService","name":"azure.subscription.keyVaultService","fields":{"certificate":{"name":"certificate","type":"\u001bazure.subscription.keyVaultService.certificate","title":"Azure Key Vault certificate","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"key":{"name":"key","type":"\u001bazure.subscription.keyVaultService.key","title":"Azure Key Vault key","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"managedHsm":{"name":"managedHsm","type":"\u001bazure.subscription.keyVaultService.managedHsm","title":"Azure Managed HSM pool","desc":"Single-tenant, FIPS 140-2 Level 3 validated hardware security module pool for cryptographic key storage, provisioned separately from standard Key Vaults. Query it to audit who holds local HSM admin rights (initialAdminObjectIds), whether soft-delete and purge-protection guard against key loss, and how network reach is restricted (publicNetworkAccess and networkAcls). Data-plane key access is governed by Managed HSM local RBAC, distinct from the management-plane permission that lists the pool.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"managedHsms":{"name":"managedHsms","type":"\u0019\u001bazure.subscription.keyVaultService.managedHsm","title":"List of Azure Managed HSM pools","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secret":{"name":"secret","type":"\u001bazure.subscription.keyVaultService.secret","title":"Azure Key Vault secret","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vault":{"name":"vault","type":"\u001bazure.subscription.keyVaultService.vault","title":"Azure Key Vault vault","desc":"Managed store for cryptographic keys, secrets, and certificates that backs application encryption and TLS across Azure workloads. Query it to audit the authorization model (rbacAuthorizationEnabled versus accessPolicies), data-protection guarantees (enableSoftDelete, enablePurgeProtection, and softDeleteRetentionInDays), network exposure (publicNetworkAccess and networkAcls), and the keys, secrets, and certificates it holds. The skuName distinguishes standard vaults from premium, where premium adds HSM-backed keys.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"vaults":{"name":"vaults","type":"\u0019\u001bazure.subscription.keyVaultService.vault","title":"List of Azure key vaults","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Key Vault","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService.certificate":{"id":"azure.subscription.keyVaultService.certificate","name":"azure.subscription.keyVaultService.certificate","fields":{"certName":{"name":"certName","type":"\u0007","title":"Certificate name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Certificate creation time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the certificate is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expires":{"name":"expires","type":"\t","is_mandatory":true,"title":"Certificate expiration date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Certificate ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"notBefore":{"name":"notBefore","type":"\t","is_mandatory":true,"title":"Certificate not before date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policy":{"name":"policy","type":"\u001bazure.subscription.keyVaultService.certificate.policy","title":"Certificate policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"recoveryLevel":{"name":"recoveryLevel","type":"\u0007","is_mandatory":true,"title":"Certificate recovery level","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Certificate tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"updated":{"name":"updated","type":"\t","is_mandatory":true,"title":"Certificate last update time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","title":"Certificate version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"versions":{"name":"versions","type":"\u0019\u001bazure.subscription.keyVaultService.certificate","title":"List of certificate versions","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"x5t":{"name":"x5t","type":"\u0007","is_mandatory":true,"title":"Certificate x5t","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Key Vault certificate","private":true,"min_provider_version":"9.0.1","defaults":"id certName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService.certificate.policy":{"id":"azure.subscription.keyVaultService.certificate.policy","name":"azure.subscription.keyVaultService.certificate.policy","fields":{"issuerParameters":{"name":"issuerParameters","type":"\u001bazure.subscription.keyVaultService.certificate.policy.issuerParameters","title":"Issuer parameters (name, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyProperties":{"name":"keyProperties","type":"\u001bazure.subscription.keyVaultService.certificate.policy.keyProperties","title":"Key properties (keyType, keySize, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"x509CertificateProperties":{"name":"x509CertificateProperties","type":"\u001bazure.subscription.keyVaultService.certificate.policy.x509CertificateProperties","title":"X.509 certificate properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Key Vault certificate policy","private":true,"min_provider_version":"11.4.26","defaults":"x509CertificateProperties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService.certificate.policy.issuerParameters":{"id":"azure.subscription.keyVaultService.certificate.policy.issuerParameters","name":"azure.subscription.keyVaultService.certificate.policy.issuerParameters","fields":{"certificateTransparency":{"name":"certificateTransparency","type":"\u0004","is_mandatory":true,"title":"Whether certificates should be published to certificate transparency logs","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"certificateType":{"name":"certificateType","type":"\u0007","is_mandatory":true,"title":"Certificate type as supported by the provider (e.g., OV-SSL, EV-SSL)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the referenced issuer object or reserved names (e.g., Self, Unknown)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Key Vault certificate policy issuer parameters","private":true,"min_provider_version":"11.4.26","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService.certificate.policy.keyProperties":{"id":"azure.subscription.keyVaultService.certificate.policy.keyProperties","name":"azure.subscription.keyVaultService.certificate.policy.keyProperties","fields":{"curve":{"name":"curve","type":"\u0007","is_mandatory":true,"title":"Elliptic curve name (for EC keys)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"exportable":{"name":"exportable","type":"\u0004","is_mandatory":true,"title":"Whether the private key can be exported","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keySize":{"name":"keySize","type":"\u0005","is_mandatory":true,"title":"The key size in bits (e.g., 2048, 3072, 4096 for RSA)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyType":{"name":"keyType","type":"\u0007","is_mandatory":true,"title":"The type of key pair (e.g., RSA, EC)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"reuseKey":{"name":"reuseKey","type":"\u0004","is_mandatory":true,"title":"Whether the same key pair will be used on certificate renewal","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Key Vault certificate policy key properties","private":true,"min_provider_version":"11.4.26","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService.certificate.policy.x509CertificateProperties":{"id":"azure.subscription.keyVaultService.certificate.policy.x509CertificateProperties","name":"azure.subscription.keyVaultService.certificate.policy.x509CertificateProperties","fields":{"ekus":{"name":"ekus","type":"\u0019\u0007","is_mandatory":true,"title":"Extended key usage OIDs","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyUsage":{"name":"keyUsage","type":"\u0019\u0007","is_mandatory":true,"title":"Key usage types (e.g., digitalSignature, keyEncipherment)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sanDnsNames":{"name":"sanDnsNames","type":"\u0019\u0007","is_mandatory":true,"title":"Subject alternative name DNS domain names","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sanEmails":{"name":"sanEmails","type":"\u0019\u0007","is_mandatory":true,"title":"Subject alternative name email addresses","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sanIpAddresses":{"name":"sanIpAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Subject alternative name IP addresses (IPv4 and IPv6)","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sanUpns":{"name":"sanUpns","type":"\u0019\u0007","is_mandatory":true,"title":"Subject alternative name user principal names (UPNs)","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sanUris":{"name":"sanUris","type":"\u0019\u0007","is_mandatory":true,"title":"Subject alternative name URIs","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subject":{"name":"subject","type":"\u0007","is_mandatory":true,"title":"Certificate subject (e.g., CN=example.com)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"validityInMonths":{"name":"validityInMonths","type":"\u0005","is_mandatory":true,"title":"Certificate validity period in months","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Key Vault certificate policy X.509 properties","private":true,"min_provider_version":"11.4.26","defaults":"subject validityInMonths","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService.key":{"id":"azure.subscription.keyVaultService.key","name":"azure.subscription.keyVaultService.key","fields":{"autorotation":{"name":"autorotation","type":"\u001bazure.subscription.keyVaultService.key.autorotation","title":"Azure Key Vault key auto-rotation","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Key creation time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"curveName":{"name":"curveName","type":"\u0007","title":"Elliptic curve name for EC keys (P-256, P-256K, P-384, P-521)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the key is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expires":{"name":"expires","type":"\t","is_mandatory":true,"title":"Date the key expires","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyName":{"name":"keyName","type":"\u0007","title":"Key name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyOps":{"name":"keyOps","type":"\u0019\u0007","title":"Permitted key operations (sign, verify, encrypt, decrypt, wrapKey, unwrapKey)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keySize":{"name":"keySize","type":"\u0005","title":"Key size in bits (e.g. 2048, 3072, 4096 for RSA)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyType":{"name":"keyType","type":"\u0007","title":"Key type (RSA, EC, oct, RSA-HSM, EC-HSM, oct-HSM)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kid":{"name":"kid","type":"\u0007","is_mandatory":true,"title":"Key ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managed":{"name":"managed","type":"\u0004","is_mandatory":true,"title":"Whether the key is managed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"notBefore":{"name":"notBefore","type":"\t","is_mandatory":true,"title":"Date the key begins to be usable","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"recoveryLevel":{"name":"recoveryLevel","type":"\u0007","is_mandatory":true,"title":"Key recovery level","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rotationPolicy":{"name":"rotationPolicy","type":"\u001bazure.subscription.keyVaultService.key.rotationPolicyObject","title":"Key rotation policy","min_provider_version":"11.4.23","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rotationPolicyObject":{"name":"rotationPolicyObject","type":"\u001bazure.subscription.keyVaultService.key.rotationPolicyObject","title":"Azure Key Vault key rotation policy","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Key tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"updated":{"name":"updated","type":"\t","is_mandatory":true,"title":"Key last update time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","title":"Key version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"versions":{"name":"versions","type":"\u0019\u001bazure.subscription.keyVaultService.key","title":"List of key versions","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Key Vault key","private":true,"min_provider_version":"9.0.1","defaults":"kid keyName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService.key.autorotation":{"id":"azure.subscription.keyVaultService.key.autorotation","name":"azure.subscription.keyVaultService.key.autorotation","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Auto-rotation enabled status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kid":{"name":"kid","type":"\u0007","is_mandatory":true,"title":"Key ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Key Vault key auto-rotation","private":true,"min_provider_version":"11.3.1","defaults":"enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService.key.rotationPolicyObject":{"id":"azure.subscription.keyVaultService.key.rotationPolicyObject","name":"azure.subscription.keyVaultService.key.rotationPolicyObject","fields":{"attributes":{"name":"attributes","type":"\n","is_mandatory":true,"title":"Attributes of the rotation policy","desc":"Keys: `expiryTime` (ISO 8601 duration giving the lifetime of newly rotated key versions, such as \"P90D\"), `created`, and `updated` (timestamps for the policy itself).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether automatic key rotation is enabled (true if rotationPolicy exists with Rotate action)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lifetimeActions":{"name":"lifetimeActions","type":"\u0019\n","is_mandatory":true,"title":"Lifetime actions for the rotation policy","desc":"Each entry has `action` (`{type}`, where type is \"Rotate\" or \"Notify\") and `trigger` (`{timeAfterCreate, timeBeforeExpiry}`, ISO 8601 durations such as \"P90D\" that schedule the action relative to key creation or expiry).","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Key Vault key rotation policy","private":true,"min_provider_version":"11.4.23","defaults":"enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService.managedHsm":{"id":"azure.subscription.keyVaultService.managedHsm","name":"azure.subscription.keyVaultService.managedHsm","fields":{"enablePurgeProtection":{"name":"enablePurgeProtection","type":"\u0004","is_mandatory":true,"title":"Whether purge protection is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableSoftDelete":{"name":"enableSoftDelete","type":"\u0004","is_mandatory":true,"title":"Whether soft delete is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hsmUri":{"name":"hsmUri","type":"\u0007","is_mandatory":true,"title":"HSM URI","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Managed HSM ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"initialAdminObjectIds":{"name":"initialAdminObjectIds","type":"\u0019\u0007","is_mandatory":true,"title":"Initial admin object IDs","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keys":{"name":"keys","type":"\u0019\u001bazure.subscription.keyVaultService.key","title":"Cryptographic keys stored in the Managed HSM pool","desc":"Keys held in the hardware security module, each exposing its key type, key size, and elliptic curve. Reading keys requires data-plane access to the HSM (a Managed HSM local RBAC role such as \"Managed HSM Crypto User\"), which is separate from the management-plane permission that lists the pool.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Managed HSM location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Managed HSM name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkAcls":{"name":"networkAcls","type":"\n","is_mandatory":true,"title":"Inbound network rule set","desc":"Keys: `bypass` (\"AzureServices\" or \"None\"), `defaultAction` (\"Allow\" or \"Deny\", applied when no rule matches), `ipRules` (a list of `{value}` allowed CIDR ranges), `virtualNetworkRules` (a list of `{id}` allowed subnet resource IDs), and `serviceTags`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access setting","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"regions":{"name":"regions","type":"\u0019\n","is_mandatory":true,"title":"Geo-replicated regions","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scheduledPurgeDate":{"name":"scheduledPurgeDate","type":"\t","is_mandatory":true,"title":"Scheduled purge date (if soft-deleted)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"SKU name (Standard_B1, Custom_B32, Custom_B6)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"softDeleteRetentionInDays":{"name":"softDeleteRetentionInDays","type":"\u0005","is_mandatory":true,"title":"Soft delete retention in days (7-90)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Managed HSM tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Tenant ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Managed HSM type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Managed HSM pool","desc":"Single-tenant, FIPS 140-2 Level 3 validated hardware security module pool for cryptographic key storage, provisioned separately from standard Key Vaults. Query it to audit who holds local HSM admin rights (initialAdminObjectIds), whether soft-delete and purge-protection guard against key loss, and how network reach is restricted (publicNetworkAccess and networkAcls). Data-plane key access is governed by Managed HSM local RBAC, distinct from the management-plane permission that lists the pool.","min_provider_version":"13.3.3","defaults":"name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService.secret":{"id":"azure.subscription.keyVaultService.secret","name":"azure.subscription.keyVaultService.secret","fields":{"contentType":{"name":"contentType","type":"\u0007","is_mandatory":true,"title":"Secret content type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Secret creation date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the secret is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expires":{"name":"expires","type":"\t","is_mandatory":true,"title":"Secret expiration date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Secret ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managed":{"name":"managed","type":"\u0004","is_mandatory":true,"title":"Whether the secret is managed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"notBefore":{"name":"notBefore","type":"\t","is_mandatory":true,"title":"Date the secret begins to be usable","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"previousVersion":{"name":"previousVersion","type":"\u001bazure.subscription.keyVaultService.secret","title":"Previous version of the secret","desc":"Set for certificate-backed secrets created after 2025-06-01.","min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secretName":{"name":"secretName","type":"\u0007","title":"Secret name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Secret tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"updated":{"name":"updated","type":"\t","is_mandatory":true,"title":"Secret last updated date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","title":"Secret version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"versions":{"name":"versions","type":"\u0019\u001bazure.subscription.keyVaultService.secret","title":"List of secret versions","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Key Vault secret","private":true,"min_provider_version":"9.0.1","defaults":"id secretName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService.vault":{"id":"azure.subscription.keyVaultService.vault","name":"azure.subscription.keyVaultService.vault","fields":{"accessPolicies":{"name":"accessPolicies","type":"\u0019\u001bazure.subscription.keyVaultService.vault.accessPolicy","title":"Vault access policies","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"accessPolicy":{"name":"accessPolicy","type":"\u001bazure.subscription.keyVaultService.vault.accessPolicy","title":"Azure Key Vault vault access policy","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"autorotation":{"name":"autorotation","type":"\u0019\u001bazure.subscription.keyVaultService.key.autorotation","title":"Auto-rotation enabled status for all keys","min_provider_version":"11.3.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"certificates":{"name":"certificates","type":"\u0019\u001bazure.subscription.keyVaultService.certificate","title":"Vault certificates","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettings":{"name":"diagnosticSettings","type":"\u0019\u001bazure.subscription.monitorService.diagnosticsetting","title":"Vault diagnostic settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettingsCategories":{"name":"diagnosticSettingsCategories","type":"\u0019\u001bazure.subscription.monitorService.diagnosticSettingsCategory","title":"Diagnostic settings categories the vault can emit (available log and metric categories)","min_provider_version":"13.30.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablePurgeProtection":{"name":"enablePurgeProtection","type":"\u0004","title":"Whether purge protection is enabled for the vault","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableSoftDelete":{"name":"enableSoftDelete","type":"\u0004","title":"Whether soft delete is enabled for the vault","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabledForDeployment":{"name":"enabledForDeployment","type":"\u0004","title":"Whether the vault can be used for Azure Resource Manager deployment","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabledForDiskEncryption":{"name":"enabledForDiskEncryption","type":"\u0004","title":"Whether the vault can be used for Azure Disk Encryption","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabledForTemplateDeployment":{"name":"enabledForTemplateDeployment","type":"\u0004","title":"Whether the vault can be used for Azure Resource Manager template deployment","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Vault ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keys":{"name":"keys","type":"\u0019\u001bazure.subscription.keyVaultService.key","title":"Vault keys","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Vault location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkAcls":{"name":"networkAcls","type":"\u001bazure.subscription.keyVaultService.vault.networkAcls","title":"Vault network ACL rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections for the vault","min_provider_version":"11.4.24","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","title":"Raw vault properties","desc":"The unprocessed vault property bag from Azure Resource Manager, with keys including `sku`, `tenantId`, `enableRbacAuthorization`, `enableSoftDelete`, `enablePurgeProtection`, `enabledForDeployment`, `enabledForDiskEncryption`, `enabledForTemplateDeployment`, `publicNetworkAccess`, `networkAcls`, and `accessPolicies`. Most values are also exposed as dedicated fields on this resource (skuName, rbacAuthorizationEnabled, accessPolicies, networkAcls); prefer those for audits.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","title":"Public network access setting (\"Enabled\" or \"Disabled\")","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rbacAuthorizationEnabled":{"name":"rbacAuthorizationEnabled","type":"\u0004","title":"Whether RBAC access to the vault is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secrets":{"name":"secrets","type":"\u0019\u001bazure.subscription.keyVaultService.secret","title":"Vault secrets","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","title":"Vault SKU name (\"standard\" or \"premium\"; premium supports HSM-backed keys)","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"softDeleteRetentionInDays":{"name":"softDeleteRetentionInDays","type":"\u0005","title":"Number of days that deleted vaults and vault objects are retained","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Vault tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Vault type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vaultName":{"name":"vaultName","type":"\u0007","is_mandatory":true,"title":"Vault name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vaultUri":{"name":"vaultUri","type":"\u0007","title":"Vault URL","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Key Vault vault","desc":"Managed store for cryptographic keys, secrets, and certificates that backs application encryption and TLS across Azure workloads. Query it to audit the authorization model (rbacAuthorizationEnabled versus accessPolicies), data-protection guarantees (enableSoftDelete, enablePurgeProtection, and softDeleteRetentionInDays), network exposure (publicNetworkAccess and networkAcls), and the keys, secrets, and certificates it holds. The skuName distinguishes standard vaults from premium, where premium adds HSM-backed keys.","private":true,"min_provider_version":"9.0.1","defaults":"vaultName type vaultUri location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService.vault.accessPolicy":{"id":"azure.subscription.keyVaultService.vault.accessPolicy","name":"azure.subscription.keyVaultService.vault.accessPolicy","fields":{"applicationId":{"name":"applicationId","type":"\u0007","is_mandatory":true,"title":"Application ID of the client making request on behalf of a principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"certificatePermissions":{"name":"certificatePermissions","type":"\u0019\u0007","is_mandatory":true,"title":"Permissions to certificates","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Access policy ID (vault ID + object ID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyPermissions":{"name":"keyPermissions","type":"\u0019\u0007","is_mandatory":true,"title":"Permissions to keys","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"objectId":{"name":"objectId","type":"\u0007","is_mandatory":true,"title":"Azure Active Directory object ID of the principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secretPermissions":{"name":"secretPermissions","type":"\u0019\u0007","is_mandatory":true,"title":"Permissions to secrets","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storagePermissions":{"name":"storagePermissions","type":"\u0019\u0007","is_mandatory":true,"title":"Permissions to storage accounts","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Azure Active Directory tenant ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Key Vault vault access policy","private":true,"min_provider_version":"11.4.28","defaults":"objectId","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.keyVaultService.vault.networkAcls":{"id":"azure.subscription.keyVaultService.vault.networkAcls","name":"azure.subscription.keyVaultService.vault.networkAcls","fields":{"bypass":{"name":"bypass","type":"\u0007","is_mandatory":true,"title":"Whether traffic can bypass network rules (\"AzureServices\" or \"None\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultAction":{"name":"defaultAction","type":"\u0007","is_mandatory":true,"title":"Default action when no rule matches (\"Allow\" or \"Deny\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Network ACLs ID (vault ID + /networkAcls)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipRules":{"name":"ipRules","type":"\u0019\u0007","is_mandatory":true,"title":"List of allowed IP address ranges (CIDR notation)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkSubnetIds":{"name":"virtualNetworkSubnetIds","type":"\u0019\u0007","is_mandatory":true,"title":"List of virtual network subnet resource IDs","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Key Vault vault network ACL rules","private":true,"min_provider_version":"11.4.28","defaults":"defaultAction bypass","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.kustoService":{"id":"azure.subscription.kustoService","name":"azure.subscription.kustoService","fields":{"cluster":{"name":"cluster","type":"\u001bazure.subscription.kustoService.cluster","title":"Azure Data Explorer cluster","desc":"Single Azure Data Explorer (Kusto) cluster, the compute and storage unit that hosts databases for fast analytics over large data volumes. The `publicNetworkAccess` and `publicIpType` fields confirm internet exposure, `restrictOutboundNetworkAccess` covers data-exfiltration control, `allowedIpRangeList` and `allowedFqdnList` give the inbound and outbound allow-lists, `enableDiskEncryption` and `enableDoubleEncryption` cover encryption at rest, `cmkKeyName` and `cmkKeyVaultUri` carry the customer-managed key, `trustedExternalTenants` lists which external Microsoft Entra tenants may authenticate, and `enablePurge` reports whether hard-delete is allowed.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"clusters":{"name":"clusters","type":"\u0019\u001bazure.subscription.kustoService.cluster","title":"Azure Data Explorer clusters in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Explorer (Kusto)","desc":"Azure Data Explorer (Kusto) clusters in the subscription. Enumerate `clusters` to audit real-time analytics deployments for public network exposure, encryption at rest, and the principals granted access.","private":true,"min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.kustoService.cluster":{"id":"azure.subscription.kustoService.cluster","name":"azure.subscription.kustoService.cluster","fields":{"allowedFqdnList":{"name":"allowedFqdnList","type":"\u0019\u0007","is_mandatory":true,"title":"Outbound FQDN allow-list applied to the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"allowedIpRangeList":{"name":"allowedIpRangeList","type":"\u0019\u0007","is_mandatory":true,"title":"Inbound IP/CIDR allow-list applied to the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"calloutPolicies":{"name":"calloutPolicies","type":"\u0019\u001bazure.subscription.kustoService.cluster.calloutPolicy","title":"Outbound callout policies governing which external endpoints the cluster may reach","min_provider_version":"13.17.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"calloutPolicy":{"name":"calloutPolicy","type":"\u001bazure.subscription.kustoService.cluster.calloutPolicy","title":"Azure Data Explorer cluster callout policy","desc":"Outbound callout policy that governs which external endpoints an Azure Data Explorer cluster may reach from queries and plugins. The `calloutType` field gives the external service category (for example `kusto`, `sql`, `cosmosdb`, `azure_openai`, `webapi`, or `external_data`), `calloutUriRegex` the destination pattern the policy matches, and `outboundAccess` whether matching calls are allowed or denied, the key control for limiting data exfiltration paths.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"cmkFederatedIdentityClientId":{"name":"cmkFederatedIdentityClientId","type":"\u0007","is_mandatory":true,"title":"Client ID of the multi-tenant Microsoft Entra application used for cross-tenant customer-managed key access; empty for same-tenant keys","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeyName":{"name":"cmkKeyName","type":"\u0007","is_mandatory":true,"title":"Name of the customer-managed Key Vault key encrypting the cluster; empty for platform-managed keys","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeyVaultUri":{"name":"cmkKeyVaultUri","type":"\u0007","is_mandatory":true,"title":"Key Vault URI holding the customer-managed encryption key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeyVersion":{"name":"cmkKeyVersion","type":"\u0007","is_mandatory":true,"title":"Version of the customer-managed encryption key; empty means the latest version is used","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataIngestionUri":{"name":"dataIngestionUri","type":"\u0007","is_mandatory":true,"title":"Cluster data ingestion URI","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"database":{"name":"database","type":"\u001bazure.subscription.kustoService.cluster.database","title":"Azure Data Explorer database","desc":"Single database hosted on an Azure Data Explorer cluster. The `kind` field distinguishes a read-write database from a read-only follower, `hotCachePeriod` and `softDeletePeriod` give the cache and retention windows, `cmkKeyName` and `cmkKeyVaultUri` carry a database-scoped customer-managed encryption key, and `leaderClusterResourceId` with `originalDatabaseName` trace a follower back to its source. `principalAssignments` reveals who can read or administer the database and `dataConnections` shows which external sources feed ingestion.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"databases":{"name":"databases","type":"\u0019\u001bazure.subscription.kustoService.cluster.database","title":"Databases hosted on the cluster","min_provider_version":"13.17.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableDiskEncryption":{"name":"enableDiskEncryption","type":"\u0004","is_mandatory":true,"title":"Whether disk encryption is enabled on the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableDoubleEncryption":{"name":"enableDoubleEncryption","type":"\u0004","is_mandatory":true,"title":"Whether infrastructure (double) encryption is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablePurge":{"name":"enablePurge","type":"\u0004","is_mandatory":true,"title":"Whether hard-delete (purge) of data is permitted","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableStreamingIngest":{"name":"enableStreamingIngest","type":"\u0004","is_mandatory":true,"title":"Whether streaming ingestion is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cluster resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Identity configuration (SystemAssigned, UserAssigned, principalId, tenantId)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Cluster location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedPrivateEndpoint":{"name":"managedPrivateEndpoint","type":"\u001bazure.subscription.kustoService.cluster.managedPrivateEndpoint","title":"Azure Data Explorer cluster managed private endpoint","desc":"Managed private endpoint created by an Azure Data Explorer cluster to reach another Azure resource over a private link. The `privateLinkResourceId` field gives the target resource, `groupId` the sub-resource it connects to, and `requestMessage` the approval message sent to the resource owner.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"managedPrivateEndpoints":{"name":"managedPrivateEndpoints","type":"\u0019\u001bazure.subscription.kustoService.cluster.managedPrivateEndpoint","title":"Managed private endpoints created by the cluster toward other Azure services","min_provider_version":"13.17.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cluster name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalAssignment":{"name":"principalAssignment","type":"\u001bazure.subscription.kustoService.cluster.principalAssignment","title":"Azure Data Explorer cluster principal assignment","desc":"Microsoft Entra principal granted cluster-wide access to an Azure Data Explorer cluster. The `role` field gives the level of access (`AllDatabasesAdmin`, `AllDatabasesViewer`, or `AllDatabasesMonitor`), `principalType` reports whether the principal is an `App`, `Group`, or `User`, and `principalId` with `principalName` identify it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"principalAssignments":{"name":"principalAssignments","type":"\u0019\u001bazure.subscription.kustoService.cluster.principalAssignment","title":"Microsoft Entra principals granted cluster-wide access","min_provider_version":"13.17.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnection":{"name":"privateEndpointConnection","type":"\u001bazure.subscription.kustoService.cluster.privateEndpointConnection","title":"Azure Data Explorer cluster private endpoint connection","desc":"Private endpoint connection terminating on an Azure Data Explorer cluster. The `status` field gives the approval state (`Approved`, `Pending`, or `Rejected`), `groupId` the targeted sub-resource, and `privateEndpoint` the connecting private endpoint.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.kustoService.cluster.privateEndpointConnection","title":"Private endpoint connections terminating on the cluster","min_provider_version":"13.17.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpType":{"name":"publicIpType","type":"\u0007","is_mandatory":true,"title":"Public IP exposure type (\"IPv4\" or \"DualStack\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether the cluster is reachable from the public internet, one of \"Enabled\", \"Disabled\", or \"SecuredByPerimeter\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"restrictOutboundNetworkAccess":{"name":"restrictOutboundNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether outbound network access is restricted (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"SKU details (name, tier, capacity)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Cluster lifecycle state (e.g., \"Running\", \"Stopped\", \"Starting\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Cluster tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trustedExternalTenants":{"name":"trustedExternalTenants","type":"\u0019\u0007","is_mandatory":true,"title":"External Microsoft Entra tenant IDs trusted to authenticate to the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"uri":{"name":"uri","type":"\u0007","is_mandatory":true,"title":"Cluster query endpoint URI","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Explorer cluster","desc":"Single Azure Data Explorer (Kusto) cluster, the compute and storage unit that hosts databases for fast analytics over large data volumes. The `publicNetworkAccess` and `publicIpType` fields confirm internet exposure, `restrictOutboundNetworkAccess` covers data-exfiltration control, `allowedIpRangeList` and `allowedFqdnList` give the inbound and outbound allow-lists, `enableDiskEncryption` and `enableDoubleEncryption` cover encryption at rest, `cmkKeyName` and `cmkKeyVaultUri` carry the customer-managed key, `trustedExternalTenants` lists which external Microsoft Entra tenants may authenticate, and `enablePurge` reports whether hard-delete is allowed.","min_provider_version":"13.16.2","defaults":"id name location publicNetworkAccess state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.kustoService.cluster.calloutPolicy":{"id":"azure.subscription.kustoService.cluster.calloutPolicy","name":"azure.subscription.kustoService.cluster.calloutPolicy","fields":{"calloutId":{"name":"calloutId","type":"\u0007","is_mandatory":true,"title":"Identifier of the callout policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"calloutType":{"name":"calloutType","type":"\u0007","is_mandatory":true,"title":"External service category the policy governs","desc":"One of \"kusto\", \"sql\", \"cosmosdb\", \"azure_openai\", \"external_data\", \"genevametrics\", \"mysql\", \"postgresql\", \"sandbox_artifacts\", \"azure_digital_twins\", or \"webapi\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"calloutUriRegex":{"name":"calloutUriRegex","type":"\u0007","is_mandatory":true,"title":"Regular expression matched against the destination URI the policy applies to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"outboundAccess":{"name":"outboundAccess","type":"\u0007","is_mandatory":true,"title":"Whether matching outbound calls are allowed, one of \"Allow\" or \"Deny\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Explorer cluster callout policy","desc":"Outbound callout policy that governs which external endpoints an Azure Data Explorer cluster may reach from queries and plugins. The `calloutType` field gives the external service category (for example `kusto`, `sql`, `cosmosdb`, `azure_openai`, `webapi`, or `external_data`), `calloutUriRegex` the destination pattern the policy matches, and `outboundAccess` whether matching calls are allowed or denied, the key control for limiting data exfiltration paths.","private":true,"min_provider_version":"13.17.1","defaults":"calloutType outboundAccess calloutUriRegex","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.kustoService.cluster.database":{"id":"azure.subscription.kustoService.cluster.database","name":"azure.subscription.kustoService.cluster.database","fields":{"cmkKeyName":{"name":"cmkKeyName","type":"\u0007","is_mandatory":true,"title":"Name of the customer-managed Key Vault key encrypting the database; empty for cluster- or platform-managed keys","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeyVaultUri":{"name":"cmkKeyVaultUri","type":"\u0007","is_mandatory":true,"title":"Key Vault URI holding the database's customer-managed encryption key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeyVersion":{"name":"cmkKeyVersion","type":"\u0007","is_mandatory":true,"title":"Version of the database's customer-managed encryption key; empty means the latest version is used","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataConnection":{"name":"dataConnection","type":"\u001bazure.subscription.kustoService.cluster.database.dataConnection","title":"Azure Data Explorer database data connection","desc":"Ingestion data connection feeding an Azure Data Explorer database. The `kind` field gives the source type (`EventHub`, `EventGrid`, `IotHub`, or `CosmosDb`), `sourceResourceId` the Azure resource supplying the data, `tableName`, `dataFormat`, and `mappingRuleName` the ingestion target and shape, and `managedIdentity` the identity used to authenticate to the source.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"dataConnections":{"name":"dataConnections","type":"\u0019\u001bazure.subscription.kustoService.cluster.database.dataConnection","title":"Ingestion data connections feeding the database","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hotCachePeriod":{"name":"hotCachePeriod","type":"\u0007","is_mandatory":true,"title":"Hot-cache retention window as an ISO 8601 duration; data within it stays on local SSD for fast queries","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Database resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Database kind, either \"ReadWrite\" or \"ReadOnlyFollowing\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"leaderCluster":{"name":"leaderCluster","type":"\u001bazure.subscription.kustoService.cluster","title":"For a read-only following database, the leader cluster sharing the data","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"leaderClusterResourceId":{"name":"leaderClusterResourceId","type":"\u0007","is_mandatory":true,"title":"For a read-only following database, the resource ID of the leader cluster sharing the data","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Database location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Database name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"originalDatabaseName":{"name":"originalDatabaseName","type":"\u0007","is_mandatory":true,"title":"For a read-only following database, the database name as it exists on the leader cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalAssignment":{"name":"principalAssignment","type":"\u001bazure.subscription.kustoService.cluster.database.principalAssignment","title":"Azure Data Explorer database principal assignment","desc":"Microsoft Entra principal granted access to a single Azure Data Explorer database. The `role` field gives the database-scoped permission (`Admin`, `Ingestor`, `Monitor`, `UnrestrictedViewer`, `User`, or `Viewer`), `principalType` reports whether the principal is an `App`, `Group`, or `User`, and `principalId` with `principalName` identify it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"principalAssignments":{"name":"principalAssignments","type":"\u0019\u001bazure.subscription.kustoService.cluster.database.principalAssignment","title":"Microsoft Entra principals granted access to the database","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"softDeletePeriod":{"name":"softDeletePeriod","type":"\u0007","is_mandatory":true,"title":"Soft-delete retention window as an ISO 8601 duration for which data remains queryable and recoverable","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Explorer database","desc":"Single database hosted on an Azure Data Explorer cluster. The `kind` field distinguishes a read-write database from a read-only follower, `hotCachePeriod` and `softDeletePeriod` give the cache and retention windows, `cmkKeyName` and `cmkKeyVaultUri` carry a database-scoped customer-managed encryption key, and `leaderClusterResourceId` with `originalDatabaseName` trace a follower back to its source. `principalAssignments` reveals who can read or administer the database and `dataConnections` shows which external sources feed ingestion.","min_provider_version":"13.17.1","defaults":"name kind hotCachePeriod softDeletePeriod","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.kustoService.cluster.database.dataConnection":{"id":"azure.subscription.kustoService.cluster.database.dataConnection","name":"azure.subscription.kustoService.cluster.database.dataConnection","fields":{"consumerGroup":{"name":"consumerGroup","type":"\u0007","is_mandatory":true,"title":"Event consumer group, for Event Hub, IoT Hub, and Event Grid sources","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataFormat":{"name":"dataFormat","type":"\u0007","is_mandatory":true,"title":"Ingestion data format, for example \"JSON\", \"MULTIJSON\", \"CSV\", or \"AVRO\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"databaseRouting":{"name":"databaseRouting","type":"\u0007","is_mandatory":true,"title":"How ingestion routes across databases, one of \"Single\" or \"Multi\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Data connection resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Source kind","desc":"One of \"EventHub\", \"EventGrid\", \"IotHub\", \"CosmosDb\", \"EventHubWithManagedIdentity\", or \"EventGridWithManagedIdentity\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Data connection location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedIdentity":{"name":"managedIdentity","type":"\u001bazure.subscription.managedIdentity","title":"Managed identity used to authenticate to the source, if any","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mappingRuleName":{"name":"mappingRuleName","type":"\u0007","is_mandatory":true,"title":"Name of the ingestion mapping rule applied to incoming data","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Data connection name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceResourceId":{"name":"sourceResourceId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the source feeding ingestion: the Event Hub, IoT Hub, Event Grid topic, or Cosmos DB account, depending on kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tableName":{"name":"tableName","type":"\u0007","is_mandatory":true,"title":"Target table the connection ingests into","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Explorer database data connection","desc":"Ingestion data connection feeding an Azure Data Explorer database. The `kind` field gives the source type (`EventHub`, `EventGrid`, `IotHub`, or `CosmosDb`), `sourceResourceId` the Azure resource supplying the data, `tableName`, `dataFormat`, and `mappingRuleName` the ingestion target and shape, and `managedIdentity` the identity used to authenticate to the source.","private":true,"min_provider_version":"13.17.1","defaults":"name kind tableName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.kustoService.cluster.database.principalAssignment":{"id":"azure.subscription.kustoService.cluster.database.principalAssignment","name":"azure.subscription.kustoService.cluster.database.principalAssignment","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Assignment resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Assignment name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Microsoft Entra object ID of the assigned principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalName":{"name":"principalName","type":"\u0007","is_mandatory":true,"title":"Display name of the assigned principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalType":{"name":"principalType","type":"\u0007","is_mandatory":true,"title":"Principal category, one of \"App\", \"Group\", or \"User\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Database-scoped role granted, one of \"Admin\", \"Ingestor\", \"Monitor\", \"UnrestrictedViewer\", \"User\", or \"Viewer\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Microsoft Entra tenant ID of the principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Explorer database principal assignment","desc":"Microsoft Entra principal granted access to a single Azure Data Explorer database. The `role` field gives the database-scoped permission (`Admin`, `Ingestor`, `Monitor`, `UnrestrictedViewer`, `User`, or `Viewer`), `principalType` reports whether the principal is an `App`, `Group`, or `User`, and `principalId` with `principalName` identify it.","private":true,"min_provider_version":"13.17.1","defaults":"principalName role principalType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.kustoService.cluster.managedPrivateEndpoint":{"id":"azure.subscription.kustoService.cluster.managedPrivateEndpoint","name":"azure.subscription.kustoService.cluster.managedPrivateEndpoint","fields":{"groupId":{"name":"groupId","type":"\u0007","is_mandatory":true,"title":"Sub-resource (group ID) targeted on the linked resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Managed private endpoint resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Managed private endpoint name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateLinkResourceId":{"name":"privateLinkResourceId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the Azure resource the endpoint connects to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateLinkResourceRegion":{"name":"privateLinkResourceRegion","type":"\u0007","is_mandatory":true,"title":"Region of the linked private-link resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requestMessage":{"name":"requestMessage","type":"\u0007","is_mandatory":true,"title":"Request message sent to the resource owner for approval","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Explorer cluster managed private endpoint","desc":"Managed private endpoint created by an Azure Data Explorer cluster to reach another Azure resource over a private link. The `privateLinkResourceId` field gives the target resource, `groupId` the sub-resource it connects to, and `requestMessage` the approval message sent to the resource owner.","private":true,"min_provider_version":"13.17.1","defaults":"name groupId provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.kustoService.cluster.principalAssignment":{"id":"azure.subscription.kustoService.cluster.principalAssignment","name":"azure.subscription.kustoService.cluster.principalAssignment","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Assignment resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Assignment name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Microsoft Entra object ID of the assigned principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalName":{"name":"principalName","type":"\u0007","is_mandatory":true,"title":"Display name of the assigned principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalType":{"name":"principalType","type":"\u0007","is_mandatory":true,"title":"Principal category, one of \"App\", \"Group\", or \"User\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Cluster-wide role granted, one of \"AllDatabasesAdmin\", \"AllDatabasesViewer\", or \"AllDatabasesMonitor\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Microsoft Entra tenant ID of the principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Explorer cluster principal assignment","desc":"Microsoft Entra principal granted cluster-wide access to an Azure Data Explorer cluster. The `role` field gives the level of access (`AllDatabasesAdmin`, `AllDatabasesViewer`, or `AllDatabasesMonitor`), `principalType` reports whether the principal is an `App`, `Group`, or `User`, and `principalId` with `principalName` identify it.","private":true,"min_provider_version":"13.17.1","defaults":"principalName role principalType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.kustoService.cluster.privateEndpointConnection":{"id":"azure.subscription.kustoService.cluster.privateEndpointConnection","name":"azure.subscription.kustoService.cluster.privateEndpointConnection","fields":{"groupId":{"name":"groupId","type":"\u0007","is_mandatory":true,"title":"Sub-resource (group ID) the private endpoint targets on the cluster","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connection resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpoint":{"name":"privateEndpoint","type":"\u001bazure.subscription.networkService.privateEndpoint","title":"The connecting private endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Connection approval status, one of \"Approved\", \"Pending\", or \"Rejected\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"statusDescription":{"name":"statusDescription","type":"\u0007","is_mandatory":true,"title":"Description accompanying the connection status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Data Explorer cluster private endpoint connection","desc":"Private endpoint connection terminating on an Azure Data Explorer cluster. The `status` field gives the approval state (`Approved`, `Pending`, or `Rejected`), `groupId` the targeted sub-resource, and `privateEndpoint` the connecting private endpoint.","private":true,"min_provider_version":"13.17.1","defaults":"name status groupId","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.lighthouseService":{"id":"azure.subscription.lighthouseService","name":"azure.subscription.lighthouseService","fields":{"registrationAssignment":{"name":"registrationAssignment","type":"\u001bazure.subscription.lighthouseService.registrationAssignment","title":"Azure Lighthouse registration assignment","desc":"A single attachment of a registration definition to this subscription or a resource group within it. The `scope` field is the delegated resource path the assignment applies to, `registrationDefinition` resolves the definition that grants the access, and `provisioningState` reflects whether the delegation is active. Select an assignment by its `name`, which is the assignment GUID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"registrationAssignments":{"name":"registrationAssignments","type":"\u0019\u001bazure.subscription.lighthouseService.registrationAssignment","title":"Registration assignments attaching definitions to this subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"registrationDefinition":{"name":"registrationDefinition","type":"\u001bazure.subscription.lighthouseService.registrationDefinition","title":"Azure Lighthouse registration definition","desc":"A single Lighthouse offer delegating access to an external managing tenant. The `managedByTenantId` and `managedByTenantName` fields identify the tenant whose principals gain access; `authorizations` lists each principal and the built-in role it holds on the delegated scope, and `eligibleAuthorizations` lists the just-in-time grants activated through Microsoft Entra Privileged Identity Management. Select a definition by its `name`, which is the registration GUID, for example `azure.subscription.lighthouseService.registrationDefinitions.where(name == \"26c128c2-fefa-4340-9bb1-6e081c90ada2\")`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"registrationDefinitions":{"name":"registrationDefinitions","type":"\u0019\u001bazure.subscription.lighthouseService.registrationDefinition","title":"Registration definitions delegating access to a managedBy tenant","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Lighthouse","desc":"Cross-tenant delegated resource management on the subscription, backed by the `Microsoft.ManagedServices` resource provider. Registration definitions describe an external (managedBy) tenant and the access its principals receive; registration assignments attach those definitions to this subscription or a resource group within it. A standing delegation grants an outside tenant persistent access, so this namespace is the entry point for detecting unexpected or overprivileged cross-tenant management. The `registrationDefinitions` field lists the offers and `registrationAssignments` the attachments in effect.","private":true,"min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.lighthouseService.registrationAssignment":{"id":"azure.subscription.lighthouseService.registrationAssignment","name":"azure.subscription.lighthouseService.registrationAssignment","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Fully qualified resource ID of the registration assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Registration assignment name, which is the assignment GUID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the assignment","desc":"One of Running, Ready, Creating, Created, Deleting, Deleted, Canceled, Failed, Succeeded, Updating, or NotSpecified.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"registrationDefinition":{"name":"registrationDefinition","type":"\u001bazure.subscription.lighthouseService.registrationDefinition","title":"Registration definition granting the delegated access","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Delegated scope (subscription or resource group) the assignment applies to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Lighthouse registration assignment","desc":"A single attachment of a registration definition to this subscription or a resource group within it. The `scope` field is the delegated resource path the assignment applies to, `registrationDefinition` resolves the definition that grants the access, and `provisioningState` reflects whether the delegation is active. Select an assignment by its `name`, which is the assignment GUID.","min_provider_version":"13.24.1","defaults":"name scope provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.lighthouseService.registrationDefinition":{"id":"azure.subscription.lighthouseService.registrationDefinition","name":"azure.subscription.lighthouseService.registrationDefinition","fields":{"authorization":{"name":"authorization","type":"\u001bazure.subscription.lighthouseService.registrationDefinition.authorization","title":"Azure Lighthouse authorization","desc":"A single grant within a registration definition, pairing a managedBy-tenant principal with the built-in role it receives on the delegated scope. The `principalId` and `principalIdDisplayName` fields identify the user, group, or service principal; `roleDefinition` resolves the granted role; and `delegatedRoleDefinitionIds` is populated when the role is User Access Administrator, listing the roles the principal may in turn assign to others. The `eligible` field distinguishes just-in-time grants from standing ones, and `justInTimeAccessPolicy` carries their activation constraints.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"authorizations":{"name":"authorizations","type":"\u0019\u001bazure.subscription.lighthouseService.registrationDefinition.authorization","is_mandatory":true,"title":"Standing authorizations granting managedBy-tenant principals access","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the registration definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name of the registration definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"eligibleAuthorizations":{"name":"eligibleAuthorizations","type":"\u0019\u001bazure.subscription.lighthouseService.registrationDefinition.authorization","is_mandatory":true,"title":"Just-in-time authorizations activated through Privileged Identity Management","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Fully qualified resource ID of the registration definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedByTenantId":{"name":"managedByTenantId","type":"\u0007","is_mandatory":true,"title":"Identifier of the managing (managedBy) tenant","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedByTenantName":{"name":"managedByTenantName","type":"\u0007","is_mandatory":true,"title":"Name of the managing (managedBy) tenant","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Registration definition name, which is the registration GUID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the definition","desc":"One of Running, Ready, Creating, Created, Deleting, Deleted, Canceled, Failed, Succeeded, Updating, or NotSpecified.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Lighthouse registration definition","desc":"A single Lighthouse offer delegating access to an external managing tenant. The `managedByTenantId` and `managedByTenantName` fields identify the tenant whose principals gain access; `authorizations` lists each principal and the built-in role it holds on the delegated scope, and `eligibleAuthorizations` lists the just-in-time grants activated through Microsoft Entra Privileged Identity Management. Select a definition by its `name`, which is the registration GUID, for example `azure.subscription.lighthouseService.registrationDefinitions.where(name == \"26c128c2-fefa-4340-9bb1-6e081c90ada2\")`.","min_provider_version":"13.24.1","defaults":"name managedByTenantName provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.lighthouseService.registrationDefinition.authorization":{"id":"azure.subscription.lighthouseService.registrationDefinition.authorization","name":"azure.subscription.lighthouseService.registrationDefinition.authorization","fields":{"delegatedRoleDefinitionIds":{"name":"delegatedRoleDefinitionIds","type":"\u0019\u0007","is_mandatory":true,"title":"Role definitions the principal may assign to others, set when the granted role is User Access Administrator","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"eligible":{"name":"eligible","type":"\u0004","is_mandatory":true,"title":"Whether this is a just-in-time (eligible) grant rather than a standing one","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"justInTimeAccessPolicy":{"name":"justInTimeAccessPolicy","type":"\n","is_mandatory":true,"title":"Just-in-time activation policy (multiFactorAuthProvider, managedByTenantApprovers, maximumActivationDuration); empty for standing grants","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Identifier of the Azure Active Directory principal in the managedBy tenant","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalIdDisplayName":{"name":"principalIdDisplayName","type":"\u0007","is_mandatory":true,"title":"Display name of the principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleDefinition":{"name":"roleDefinition","type":"\u001bazure.subscription.authorizationService.roleDefinition","title":"Granted Azure built-in role definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleDefinitionId":{"name":"roleDefinitionId","type":"\u0007","is_mandatory":true,"title":"Identifier of the granted Azure built-in role","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Lighthouse authorization","desc":"A single grant within a registration definition, pairing a managedBy-tenant principal with the built-in role it receives on the delegated scope. The `principalId` and `principalIdDisplayName` fields identify the user, group, or service principal; `roleDefinition` resolves the granted role; and `delegatedRoleDefinitionIds` is populated when the role is User Access Administrator, listing the roles the principal may in turn assign to others. The `eligible` field distinguishes just-in-time grants from standing ones, and `justInTimeAccessPolicy` carries their activation constraints.","min_provider_version":"13.24.1","defaults":"principalIdDisplayName roleDefinitionId eligible","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.logicService":{"id":"azure.subscription.logicService","name":"azure.subscription.logicService","fields":{"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workflow":{"name":"workflow","type":"\u001bazure.subscription.logicService.workflow","title":"Azure Logic Apps Consumption workflow","desc":"Single Consumption-tier Logic App, selectable by ARM id (for example `azure.subscription.logicService.workflow(id: \"/subscriptions/.../workflows/my-flow\")`). Fields cover lifecycle state, SKU, integration-account binding, access-control policies (per-policy IP allow lists and OAuth authentication policies), parameters (with secure-string detection), and the trigger and action lists parsed from the workflow definition.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"workflows":{"name":"workflows","type":"\u0019\u001bazure.subscription.logicService.workflow","title":"Consumption-tier workflows","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Logic Apps","desc":"Consumption-tier Logic Apps workflows in the subscription, enumerated through `workflows`. Auditing these surfaces workflow state, access-control policies, secret-typed parameters, and the trigger and action set defined in each workflow's JSON definition.","private":true,"min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.logicService.workflow":{"id":"azure.subscription.logicService.workflow","name":"azure.subscription.logicService.workflow","fields":{"accessControlActions":{"name":"accessControlActions","type":"\n","is_mandatory":true,"title":"Access-control policy for invoking workflow actions","desc":"Same shape as `accessControlTriggers`: `allowedCallerIpAddresses []` and `openAuthenticationPolicies {}`. Empty IP list means no IP restriction.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"accessControlContents":{"name":"accessControlContents","type":"\n","is_mandatory":true,"title":"Access-control policy for reading workflow run contents","desc":"Same shape as `accessControlTriggers`: `allowedCallerIpAddresses []` and `openAuthenticationPolicies {}`. Empty IP list means no IP restriction.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"accessControlTriggers":{"name":"accessControlTriggers","type":"\n","is_mandatory":true,"title":"Access-control policy for inbound triggers","desc":"Has `allowedCallerIpAddresses []` and `openAuthenticationPolicies {}`. Empty IP list means no IP restriction.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"accessControlWorkflowManagement":{"name":"accessControlWorkflowManagement","type":"\n","is_mandatory":true,"title":"Access-control policy for workflow management operations","desc":"Same shape as `accessControlTriggers`: `allowedCallerIpAddresses []` and `openAuthenticationPolicies {}`. Empty IP list means no IP restriction.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"accessEndpoint":{"name":"accessEndpoint","type":"\u0007","is_mandatory":true,"title":"Public access endpoint, when ingress is exposed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"actions":{"name":"actions","type":"\u0019\n","is_mandatory":true,"title":"Actions parsed from the workflow definition","desc":"Each entry has {name, type}. `type` examples: \"Http\", \"ApiConnection\", \"Compose\", \"Workflow\", \"If\", \"Foreach\", \"Until\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"changedTime":{"name":"changedTime","type":"\t","is_mandatory":true,"title":"Last changed time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionNames":{"name":"connectionNames","type":"\u0019\u0007","is_mandatory":true,"title":"Names of API connections referenced by triggers and actions (i.e., `parameters.$connections` keys)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdTime":{"name":"createdTime","type":"\t","is_mandatory":true,"title":"Created time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpointsConfiguration":{"name":"endpointsConfiguration","type":"\n","is_mandatory":true,"title":"Connector and workflow endpoint IP ranges","desc":"Has `connector` and `workflow`, each with `accessEndpointIpAddresses` and `outgoingIpAddresses` (lists of `{address}` entries). Use these to build network allow lists for traffic the workflow originates or receives.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hasIpRestrictions":{"name":"hasIpRestrictions","type":"\u0004","is_mandatory":true,"title":"Whether at least one access-control policy has an IP allow list configured","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity","desc":"Has `type` (\"SystemAssigned\", \"UserAssigned\", or \"None\"), `principalId`, `tenantId`, and `userAssignedIdentities` (map keyed by the identity's ARM resource id).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"integrationAccountId":{"name":"integrationAccountId","type":"\u0007","is_mandatory":true,"title":"ARM id of the linked integration account, if any","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"integrationServiceEnvironmentId":{"name":"integrationServiceEnvironmentId","type":"\u0007","is_mandatory":true,"title":"ARM id of the linked integration service environment (ISE), if any","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Azure region","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Workflow name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"parameters":{"name":"parameters","type":"\u0019\n","is_mandatory":true,"title":"Workflow parameters","desc":"Each entry has {name, type, hasDefaultValue, isSecure}. `isSecure` is true when type is `SecureString` or `SecureObject`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state (\"Succeeded\", \"Failed\", \"Canceled\", ...)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secureParameterNames":{"name":"secureParameterNames","type":"\u0019\u0007","is_mandatory":true,"title":"Names of parameters whose type is `SecureString` or `SecureObject`","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"SKU name (\"Free\", \"Shared\", \"Basic\", \"Standard\", \"Premium\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Workflow state (\"Enabled\", \"Disabled\", \"Suspended\", \"Completed\", \"Deleted\", \"NotSpecified\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"triggers":{"name":"triggers","type":"\u0019\n","is_mandatory":true,"title":"Triggers parsed from the workflow definition","desc":"Each entry has {name, type, kind?}. `type` examples: \"Request\" (HTTP), \"Recurrence\", \"ApiConnection\", \"ApiConnectionWebhook\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Workflow version (changes when the definition changes)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Logic Apps Consumption workflow","desc":"Single Consumption-tier Logic App, selectable by ARM id (for example `azure.subscription.logicService.workflow(id: \"/subscriptions/.../workflows/my-flow\")`). Fields cover lifecycle state, SKU, integration-account binding, access-control policies (per-policy IP allow lists and OAuth authentication policies), parameters (with secure-string detection), and the trigger and action lists parsed from the workflow definition.","min_provider_version":"13.10.2","defaults":"name location state provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.machineLearningService":{"id":"azure.subscription.machineLearningService","name":"azure.subscription.machineLearningService","fields":{"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workspace":{"name":"workspace","type":"\u001bazure.subscription.machineLearningService.workspace","title":"Azure Machine Learning workspace","desc":"Single Azure Machine Learning workspace, the top-level container for ML experiments, models, compute, and datastores, selected by `name` (for example `azure.subscription.machineLearningService.workspaces.where(name == \"my-ws\")`). `publicNetworkAccess` confirms whether the workspace is reachable from the public internet, `managedNetworkIsolationMode` reports the managed-VNet outbound policy, `hbiWorkspace` flags whether it is high-business-impact (which restricts the diagnostic data Microsoft collects), `allowPublicAccessWhenBehindVnet` reports whether public access is permitted despite a private endpoint, `v1LegacyMode` reports whether the older v1 API surface is still enabled, and `encryptionKey` resolves the customer-managed key encrypting workspace data (null when platform-managed). The `keyVault`, `storageAccount`, `applicationInsights`, and `containerRegistry` references resolve the linked resources whose own posture the workspace inherits.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"workspaces":{"name":"workspaces","type":"\u0019\u001bazure.subscription.machineLearningService.workspace","title":"Azure Machine Learning workspaces in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Machine Learning","desc":"Machine Learning namespace covering the Azure Machine Learning workspaces in the subscription, backed by the `Microsoft.MachineLearningServices` resource provider. A workspace is the top-level container for ML assets (experiments, models, compute, and datastores) and binds to a Key Vault, Storage account, Application Insights component, and Container Registry, so the namespace is the entry point for auditing their public-network exposure, network isolation, customer-managed-key encryption, and authentication posture. The `workspaces` field returns the per-workspace records.","private":true,"min_provider_version":"13.14.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.machineLearningService.workspace":{"id":"azure.subscription.machineLearningService.workspace","name":"azure.subscription.machineLearningService.workspace","fields":{"allowPublicAccessWhenBehindVnet":{"name":"allowPublicAccessWhenBehindVnet","type":"\u0004","is_mandatory":true,"title":"Whether public network access is allowed even when the workspace is behind a virtual network","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"applicationInsights":{"name":"applicationInsights","type":"\u001bazure.subscription.monitorService.applicationInsight","title":"Application Insights component linked to the workspace for telemetry","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"applicationInsightsId":{"name":"applicationInsightsId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the linked Application Insights component","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"batchEndpoint":{"name":"batchEndpoint","type":"\u001bazure.subscription.machineLearningService.workspace.batchEndpoint","title":"Batch inference endpoint in an Azure Machine Learning workspace","desc":"Single batch endpoint, which scores a whole dataset on a schedule or on demand rather than serving requests in real time, selected by `name`. `authMode` reports how callers authenticate, `scoringUri` the invocation URL, `defaultDeploymentName` which deployment an unqualified invocation runs, and `deployments` the model deployments behind the endpoint.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"batchEndpoints":{"name":"batchEndpoints","type":"\u0019\u001bazure.subscription.machineLearningService.workspace.batchEndpoint","title":"Batch inference endpoints serving models from the workspace","min_provider_version":"13.33.6","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"compute":{"name":"compute","type":"\u001bazure.subscription.machineLearningService.workspace.compute","title":"Compute target in an Azure Machine Learning workspace","desc":"Single compute target, the cluster, instance, or attached resource that runs jobs and model deployments, selected by `name`. `computeType` reports the kind of compute (\"AmlCompute\", \"ComputeInstance\", \"Kubernetes\", \"AKS\", and others), `disableLocalAuth` reports whether SSH / local authentication is turned off in favor of Microsoft Entra ID, `isAttachedCompute` reports whether the resource was brought from outside the workspace, and `resourceId` identifies the underlying ARM compute it maps to.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"computes":{"name":"computes","type":"\u0019\u001bazure.subscription.machineLearningService.workspace.compute","title":"Compute targets attached to or managed by the workspace","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connection":{"name":"connection","type":"\u001bazure.subscription.machineLearningService.workspace.connection","title":"Connection on an Azure Machine Learning workspace","desc":"Single workspace-scoped connection, the link a job or endpoint uses to reach an external resource, selected by `name`. `category` shows what the connection points at, `authType` how it authenticates, `target` the endpoint URL, and `isSharedToAll` whether every workspace member may use it. The stored credential itself is deliberately not exposed.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"connections":{"name":"connections","type":"\u0019\u001bazure.subscription.machineLearningService.workspace.connection","title":"Workspace-scoped connections to external resources, model providers, and data sources","min_provider_version":"13.33.6","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"containerRegistry":{"name":"containerRegistry","type":"\u001bazure.subscription.containerRegistryService.registry","title":"Container Registry linked to the workspace, holding its environment images","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"containerRegistryId":{"name":"containerRegistryId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the linked Container Registry","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"datastore":{"name":"datastore","type":"\u001bazure.subscription.machineLearningService.workspace.datastore","title":"Datastore in an Azure Machine Learning workspace","desc":"Registered pointer to an Azure storage backend the workspace reads training and inference data from, selected by `name`. `credentialsType` reports how the workspace authenticates: \"None\" means the workspace's own identity is used, while \"AccountKey\", \"Sas\", \"ServicePrincipal\", and \"Certificate\" mean a credential is stored with the datastore. `serviceDataAccessAuthIdentity` reports the identity used for the service's own access to the data. `storageAccount` resolves the account behind the datastore, so its network and encryption posture can be audited alongside the datastore.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"datastores":{"name":"datastores","type":"\u0019\u001bazure.subscription.machineLearningService.workspace.datastore","title":"Datastores the workspace reads training and inference data from","desc":"Each datastore points at an Azure storage backend and records how the workspace authenticates to it, so `credentialsType` is what distinguishes a datastore reached with a stored account key or SAS token from one reached with the workspace's managed identity.","min_provider_version":"13.33.6","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Workspace description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"discoveryUrl":{"name":"discoveryUrl","type":"\u0007","is_mandatory":true,"title":"URL of the discovery service that clients use to resolve workspace-scoped endpoints","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionKey":{"name":"encryptionKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Customer-managed Key Vault key encrypting workspace data (null when Microsoft-managed)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionStatus":{"name":"encryptionStatus","type":"\u0007","is_mandatory":true,"title":"Whether workspace data is encrypted with a customer-managed key (\"Enabled\") or a Microsoft-managed key (\"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"friendlyName":{"name":"friendlyName","type":"\u0007","is_mandatory":true,"title":"Friendly (display) name of the workspace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hbiWorkspace":{"name":"hbiWorkspace","type":"\u0004","is_mandatory":true,"title":"Whether the workspace is flagged high-business-impact, which limits the diagnostic data Microsoft collects","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Workspace resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Identity configuration (SystemAssigned, UserAssigned, principalId, tenantId)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"imageBuildCompute":{"name":"imageBuildCompute","type":"\u0007","is_mandatory":true,"title":"Compute resource (by name) used to build environment images; empty when the default managed build compute is used","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVault":{"name":"keyVault","type":"\u001bazure.subscription.keyVaultService.vault","title":"Key Vault linked to the workspace, holding its secrets","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultId":{"name":"keyVaultId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the linked Key Vault","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Workspace kind (e.g., Default, Hub, Project, FeatureStore)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Workspace location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedNetworkIsolationMode":{"name":"managedNetworkIsolationMode","type":"\u0007","is_mandatory":true,"title":"Outbound isolation mode of the managed virtual network","desc":"One of \"Disabled\", \"AllowInternetOutbound\", or \"AllowOnlyApprovedOutbound\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedNetworkOutboundRule":{"name":"managedNetworkOutboundRule","type":"\u001bazure.subscription.machineLearningService.workspace.managedNetworkOutboundRule","title":"Machine Learning workspace managed-network outbound rule","desc":"A single approved-outbound rule of a workspace's managed virtual network, selected by `name`. When the workspace runs in AllowOnlyApprovedOutbound isolation, these rules are the entire allow-list of destinations its compute may reach, so auditing them is what makes the isolation mode meaningful. Which fields carry values depends on `type`: an FQDN rule populates `destinationFqdn`; a PrivateEndpoint rule populates the `privateEndpoint` fields; a ServiceTag rule populates the `serviceTag` fields.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"managedNetworkOutboundRules":{"name":"managedNetworkOutboundRules","type":"\u0019\u001bazure.subscription.machineLearningService.workspace.managedNetworkOutboundRule","title":"Approved-outbound rules of the managed virtual network","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mlFlowTrackingUri":{"name":"mlFlowTrackingUri","type":"\u0007","is_mandatory":true,"title":"MLflow tracking URI for the workspace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"model":{"name":"model","type":"\u001bazure.subscription.machineLearningService.workspace.model","title":"Registered model in an Azure Machine Learning workspace","desc":"Single registered model container, the named entry that groups all versions of a model, selected by `name`. `latestVersion` gives the most recent registered version, `nextVersion` gives the version the next registration will receive, `isArchived` reports whether the model is archived, and `description` and `tags` carry the model's metadata.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"models":{"name":"models","type":"\u0019\u001bazure.subscription.machineLearningService.workspace.model","title":"Models registered in the workspace","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Workspace name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"onlineEndpoint":{"name":"onlineEndpoint","type":"\u001bazure.subscription.machineLearningService.workspace.onlineEndpoint","title":"Real-time inference endpoint in an Azure Machine Learning workspace","desc":"Single online endpoint, the HTTPS endpoint that serves one or more model deployments for real-time scoring, selected by `name`. `authMode` reports how callers authenticate (\"Key\" or \"AMLToken\"), `scoringUri` gives the inference URL, `publicNetworkAccess` reports whether the endpoint is reachable from the public internet, `traffic` shows how live traffic is split across deployments, and `deployments` returns the model deployments behind the endpoint.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"onlineEndpoints":{"name":"onlineEndpoints","type":"\u0019\u001bazure.subscription.machineLearningService.workspace.onlineEndpoint","title":"Real-time inference (online) endpoints serving models from the workspace","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\n","is_mandatory":true,"title":"Private endpoint connections to the workspace","desc":"Each entry carries `id`, `name`, `type`, and a `properties` object holding `provisioningState`, `privateEndpoint` (with the connected private endpoint's `id`), and `privateLinkServiceConnectionState` (with `status`, `description`, and `actionsRequired`).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the workspace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether the workspace is reachable from the public internet (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serverlessEndpoint":{"name":"serverlessEndpoint","type":"\u001bazure.subscription.machineLearningService.workspace.serverlessEndpoint","title":"Serverless (Models-as-a-Service) endpoint in an Azure Machine Learning workspace","desc":"Single serverless endpoint, a pay-as-you-go model API consumed without provisioning compute, selected by `name`. `modelId` names the model being served, `inferenceUri` gives the inference URL, `authMode` and `endpointState` report the authentication mode and lifecycle state, `marketplaceSubscriptionId` identifies the backing Marketplace subscription, and `contentSafetyStatus` reports whether content safety filtering is enabled.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"serverlessEndpoints":{"name":"serverlessEndpoints","type":"\u0019\u001bazure.subscription.machineLearningService.workspace.serverlessEndpoint","title":"Serverless (Models-as-a-Service) endpoints in the workspace","min_provider_version":"13.15.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"SKU details (name and tier)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAccount":{"name":"storageAccount","type":"\u001bazure.subscription.storageService.account","title":"Storage account linked to the workspace, holding its datastores","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAccountId":{"name":"storageAccountId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the linked Storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Workspace tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"v1LegacyMode":{"name":"v1LegacyMode","type":"\u0004","is_mandatory":true,"title":"Whether the legacy v1 API surface (v1LegacyMode) is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workspaceId":{"name":"workspaceId","type":"\u0007","is_mandatory":true,"title":"Immutable workspace identifier assigned by Azure","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Machine Learning workspace","desc":"Single Azure Machine Learning workspace, the top-level container for ML experiments, models, compute, and datastores, selected by `name` (for example `azure.subscription.machineLearningService.workspaces.where(name == \"my-ws\")`). `publicNetworkAccess` confirms whether the workspace is reachable from the public internet, `managedNetworkIsolationMode` reports the managed-VNet outbound policy, `hbiWorkspace` flags whether it is high-business-impact (which restricts the diagnostic data Microsoft collects), `allowPublicAccessWhenBehindVnet` reports whether public access is permitted despite a private endpoint, `v1LegacyMode` reports whether the older v1 API surface is still enabled, and `encryptionKey` resolves the customer-managed key encrypting workspace data (null when platform-managed). The `keyVault`, `storageAccount`, `applicationInsights`, and `containerRegistry` references resolve the linked resources whose own posture the workspace inherits.","min_provider_version":"13.14.1","defaults":"id name location publicNetworkAccess","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.machineLearningService.workspace.batchEndpoint":{"id":"azure.subscription.machineLearningService.workspace.batchEndpoint","name":"azure.subscription.machineLearningService.workspace.batchEndpoint","fields":{"authMode":{"name":"authMode","type":"\u0007","is_mandatory":true,"title":"How callers authenticate to the endpoint","desc":"One of \"AADToken\", \"AMLToken\", or \"Key\". \"Key\" means a shared key grants invocation, rather than a Microsoft Entra identity.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultDeploymentName":{"name":"defaultDeploymentName","type":"\u0007","is_mandatory":true,"title":"Deployment an invocation runs when it names none","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deployment":{"name":"deployment","type":"\u001bazure.subscription.machineLearningService.workspace.batchEndpoint.deployment","title":"Deployment on an Azure Machine Learning batch endpoint","desc":"Single batch deployment, pairing a registered model with the compute that scores against it, selected by `name`. `modelId` identifies the model, `compute` the cluster the scoring job runs on, `environmentId` the container image it runs in, and `outputAction` and `outputFileName` where the scored results are written. `loggingLevel` and `errorThreshold` report how much the job records and how many failures it tolerates.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"deployments":{"name":"deployments","type":"\u0019\u001bazure.subscription.machineLearningService.workspace.batchEndpoint.deployment","title":"Model deployments behind the endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Batch endpoint resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity configuration","desc":"Keys: `type` (\"None\", \"SystemAssigned\", \"UserAssigned\", or \"SystemAssigned, UserAssigned\"), `userAssignedIdentities`, and the read-only `principalId` and `tenantId` of the system-assigned identity.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Endpoint kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Endpoint location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Endpoint name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Endpoint-specific settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scoringUri":{"name":"scoringUri","type":"\u0007","is_mandatory":true,"title":"URL batch scoring jobs are submitted to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"swaggerUri":{"name":"swaggerUri","type":"\u0007","is_mandatory":true,"title":"URL of the endpoint's OpenAPI description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Endpoint tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Batch inference endpoint in an Azure Machine Learning workspace","desc":"Single batch endpoint, which scores a whole dataset on a schedule or on demand rather than serving requests in real time, selected by `name`. `authMode` reports how callers authenticate, `scoringUri` the invocation URL, `defaultDeploymentName` which deployment an unqualified invocation runs, and `deployments` the model deployments behind the endpoint.","min_provider_version":"13.33.6","defaults":"name authMode provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.machineLearningService.workspace.batchEndpoint.deployment":{"id":"azure.subscription.machineLearningService.workspace.batchEndpoint.deployment","name":"azure.subscription.machineLearningService.workspace.batchEndpoint.deployment","fields":{"compute":{"name":"compute","type":"\u0007","is_mandatory":true,"title":"Resource ID of the compute the scoring job runs on","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the deployment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"environmentId":{"name":"environmentId","type":"\u0007","is_mandatory":true,"title":"ARM ID of the environment (container image) the job runs in","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"environmentVariables":{"name":"environmentVariables","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Environment variables set on the scoring job","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"errorThreshold":{"name":"errorThreshold","type":"\u0005","is_mandatory":true,"title":"Number of record failures tolerated before the job is failed","desc":"A value of -1 tolerates any number of failures.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Batch deployment resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Deployment location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"loggingLevel":{"name":"loggingLevel","type":"\u0007","is_mandatory":true,"title":"How much the scoring job logs","desc":"One of \"Info\", \"Warning\", or \"Debug\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxConcurrencyPerInstance":{"name":"maxConcurrencyPerInstance","type":"\u0005","is_mandatory":true,"title":"Maximum mini batches scored concurrently on each instance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"miniBatchSize":{"name":"miniBatchSize","type":"\u0005","is_mandatory":true,"title":"Number of records processed per mini batch","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"modelId":{"name":"modelId","type":"\u0007","is_mandatory":true,"title":"ARM ID or asset reference of the model being scored","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Deployment name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"outputAction":{"name":"outputAction","type":"\u0007","is_mandatory":true,"title":"How scored results are written","desc":"One of \"SummaryOnly\" or \"AppendRow\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"outputFileName":{"name":"outputFileName","type":"\u0007","is_mandatory":true,"title":"File the scored results are written to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Deployment-specific settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the deployment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resources":{"name":"resources","type":"\n","is_mandatory":true,"title":"Compute resources requested for the scoring job","desc":"Keys: `instanceCount`, `instanceType`, and `properties`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retrySettings":{"name":"retrySettings","type":"\n","is_mandatory":true,"title":"Retry settings applied to a failed mini batch","desc":"Keys: `maxRetries` and `timeout`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Deployment tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Deployment on an Azure Machine Learning batch endpoint","desc":"Single batch deployment, pairing a registered model with the compute that scores against it, selected by `name`. `modelId` identifies the model, `compute` the cluster the scoring job runs on, `environmentId` the container image it runs in, and `outputAction` and `outputFileName` where the scored results are written. `loggingLevel` and `errorThreshold` report how much the job records and how many failures it tolerates.","min_provider_version":"13.33.6","defaults":"name provisioningState compute","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.machineLearningService.workspace.compute":{"id":"azure.subscription.machineLearningService.workspace.compute","name":"azure.subscription.machineLearningService.workspace.compute","fields":{"computeLocation":{"name":"computeLocation","type":"\u0007","is_mandatory":true,"title":"Location of the underlying compute resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"computeType":{"name":"computeType","type":"\u0007","is_mandatory":true,"title":"Kind of compute","desc":"Examples include \"AmlCompute\", \"ComputeInstance\", \"Kubernetes\", \"AKS\", \"VirtualMachine\", \"DataFactory\", \"Databricks\", \"HDInsight\", and \"SynapseSpark\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdOn":{"name":"createdOn","type":"\t","is_mandatory":true,"title":"When the compute was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the compute","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether local (SSH) authentication is disabled, leaving Microsoft Entra ID as the only method","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Compute resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Identity configuration (SystemAssigned, UserAssigned, principalId, tenantId)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isAttachedCompute":{"name":"isAttachedCompute","type":"\u0004","is_mandatory":true,"title":"Whether the compute was provisioned outside the workspace and attached, rather than created by the workspace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Compute location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"modifiedOn":{"name":"modifiedOn","type":"\t","is_mandatory":true,"title":"When the compute was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Compute name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the compute (e.g., \"Succeeded\", \"Provisioning\", \"Failed\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceId":{"name":"resourceId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the underlying compute resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Compute tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Compute target in an Azure Machine Learning workspace","desc":"Single compute target, the cluster, instance, or attached resource that runs jobs and model deployments, selected by `name`. `computeType` reports the kind of compute (\"AmlCompute\", \"ComputeInstance\", \"Kubernetes\", \"AKS\", and others), `disableLocalAuth` reports whether SSH / local authentication is turned off in favor of Microsoft Entra ID, `isAttachedCompute` reports whether the resource was brought from outside the workspace, and `resourceId` identifies the underlying ARM compute it maps to.","min_provider_version":"13.15.2","defaults":"name computeType provisioningState disableLocalAuth","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.machineLearningService.workspace.connection":{"id":"azure.subscription.machineLearningService.workspace.connection","name":"azure.subscription.machineLearningService.workspace.connection","fields":{"authType":{"name":"authType","type":"\u0007","is_mandatory":true,"title":"How the connection authenticates","desc":"One of \"AAD\", \"ApiKey\", \"AccessKey\", \"AccountKey\", \"CustomKeys\", \"ManagedIdentity\", \"None\", \"OAuth2\", \"PAT\", \"SAS\", \"ServicePrincipal\", or \"UsernamePassword\". Every value other than \"AAD\" and \"ManagedIdentity\" means a credential is stored with the connection.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"What the connection points at (e.g., \"AzureOpenAI\", \"CognitiveSearch\", \"AzureBlob\", \"Git\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdByWorkspaceArmId":{"name":"createdByWorkspaceArmId","type":"\u0007","is_mandatory":true,"title":"ARM ID of the workspace the connection was created in","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expiryTime":{"name":"expiryTime","type":"\t","is_mandatory":true,"title":"When the stored credential expires","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"Connection group the category belongs to (e.g., \"Azure\", \"AzureAI\", \"Database\", \"File\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connection resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isSharedToAll":{"name":"isSharedToAll","type":"\u0004","is_mandatory":true,"title":"Whether every member of the workspace may use the connection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Connection-specific settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sharedUserList":{"name":"sharedUserList","type":"\u0019\u0007","is_mandatory":true,"title":"Users the connection is shared with when it is not shared to all","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"Endpoint URL the connection points at","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Connection on an Azure Machine Learning workspace","desc":"Single workspace-scoped connection, the link a job or endpoint uses to reach an external resource, selected by `name`. `category` shows what the connection points at, `authType` how it authenticates, `target` the endpoint URL, and `isSharedToAll` whether every workspace member may use it. The stored credential itself is deliberately not exposed.","min_provider_version":"13.33.6","defaults":"name category authType target","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.machineLearningService.workspace.datastore":{"id":"azure.subscription.machineLearningService.workspace.datastore","name":"azure.subscription.machineLearningService.workspace.datastore","fields":{"accountName":{"name":"accountName","type":"\u0007","is_mandatory":true,"title":"Name of the storage account holding the data","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"containerName":{"name":"containerName","type":"\u0007","is_mandatory":true,"title":"Blob container the datastore points at, for an AzureBlob datastore","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"credentialsType":{"name":"credentialsType","type":"\u0007","is_mandatory":true,"title":"How the workspace authenticates to the storage backend","desc":"One of \"None\" (the workspace's managed identity is used), \"AccountKey\", \"Sas\", \"ServicePrincipal\", or \"Certificate\". Every value other than \"None\" means a long-lived credential is stored with the datastore.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"datastoreType":{"name":"datastoreType","type":"\u0007","is_mandatory":true,"title":"Storage backend the datastore points at","desc":"One of \"AzureBlob\", \"AzureDataLakeGen1\", \"AzureDataLakeGen2\", \"AzureFile\", or \"OneLake\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the datastore","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpoint":{"name":"endpoint","type":"\u0007","is_mandatory":true,"title":"Storage endpoint suffix (e.g., \"core.windows.net\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fileShareName":{"name":"fileShareName","type":"\u0007","is_mandatory":true,"title":"File share the datastore points at, for an AzureFile datastore","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"filesystem":{"name":"filesystem","type":"\u0007","is_mandatory":true,"title":"Filesystem the datastore points at, for an AzureDataLakeGen2 datastore","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Datastore resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether this is the workspace's default datastore","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Datastore name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol used to reach the storage backend (e.g., \"https\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceGroup":{"name":"resourceGroup","type":"\u0007","is_mandatory":true,"title":"Resource group of the storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceDataAccessAuthIdentity":{"name":"serviceDataAccessAuthIdentity","type":"\u0007","is_mandatory":true,"title":"Identity used for the service's own access to the data","desc":"One of \"None\", \"WorkspaceSystemAssignedIdentity\", or \"WorkspaceUserAssignedIdentity\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAccount":{"name":"storageAccount","type":"\u001bazure.subscription.storageService.account","title":"Storage account holding the data","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription holding the storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Datastore tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Datastore in an Azure Machine Learning workspace","desc":"Registered pointer to an Azure storage backend the workspace reads training and inference data from, selected by `name`. `credentialsType` reports how the workspace authenticates: \"None\" means the workspace's own identity is used, while \"AccountKey\", \"Sas\", \"ServicePrincipal\", and \"Certificate\" mean a credential is stored with the datastore. `serviceDataAccessAuthIdentity` reports the identity used for the service's own access to the data. `storageAccount` resolves the account behind the datastore, so its network and encryption posture can be audited alongside the datastore.","min_provider_version":"13.33.6","defaults":"name datastoreType credentialsType isDefault","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.machineLearningService.workspace.managedNetworkOutboundRule":{"id":"azure.subscription.machineLearningService.workspace.managedNetworkOutboundRule","name":"azure.subscription.machineLearningService.workspace.managedNetworkOutboundRule","fields":{"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Rule category (Dependency, Required, UserDefined)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"destinationFqdn":{"name":"destinationFqdn","type":"\u0007","is_mandatory":true,"title":"FQDN rule: the allowed fully-qualified domain name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name (the allow-list entry key)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointResourceId":{"name":"privateEndpointResourceId","type":"\u0007","is_mandatory":true,"title":"PrivateEndpoint rule: ARM resource ID of the target service","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointSparkEnabled":{"name":"privateEndpointSparkEnabled","type":"\u0004","is_mandatory":true,"title":"PrivateEndpoint rule: whether Spark workloads may use the private endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointSubresourceTarget":{"name":"privateEndpointSubresourceTarget","type":"\u0007","is_mandatory":true,"title":"PrivateEndpoint rule: sub-resource (group ID) targeted on the service","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceTag":{"name":"serviceTag","type":"\u0007","is_mandatory":true,"title":"ServiceTag rule: the Azure service tag allowed as a destination","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceTagPortRanges":{"name":"serviceTagPortRanges","type":"\u0007","is_mandatory":true,"title":"ServiceTag rule: port ranges allowed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceTagProtocol":{"name":"serviceTagProtocol","type":"\u0007","is_mandatory":true,"title":"ServiceTag rule: protocol allowed (TCP, UDP, ICMP, or *)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Rule status (Active, Inactive)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Rule type (FQDN, PrivateEndpoint, ServiceTag)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Machine Learning workspace managed-network outbound rule","desc":"A single approved-outbound rule of a workspace's managed virtual network, selected by `name`. When the workspace runs in AllowOnlyApprovedOutbound isolation, these rules are the entire allow-list of destinations its compute may reach, so auditing them is what makes the isolation mode meaningful. Which fields carry values depends on `type`: an FQDN rule populates `destinationFqdn`; a PrivateEndpoint rule populates the `privateEndpoint` fields; a ServiceTag rule populates the `serviceTag` fields.","private":true,"min_provider_version":"13.32.1","defaults":"name type category status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.machineLearningService.workspace.model":{"id":"azure.subscription.machineLearningService.workspace.model","name":"azure.subscription.machineLearningService.workspace.model","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Model description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Model container resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isArchived":{"name":"isArchived","type":"\u0004","is_mandatory":true,"title":"Whether the model is archived","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"latestVersion":{"name":"latestVersion","type":"\u0007","is_mandatory":true,"title":"Latest registered version of the model","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Model name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nextVersion":{"name":"nextVersion","type":"\u0007","is_mandatory":true,"title":"Version the next registration will receive","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the model container","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Model tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Registered model in an Azure Machine Learning workspace","desc":"Single registered model container, the named entry that groups all versions of a model, selected by `name`. `latestVersion` gives the most recent registered version, `nextVersion` gives the version the next registration will receive, `isArchived` reports whether the model is archived, and `description` and `tags` carry the model's metadata.","min_provider_version":"13.15.2","defaults":"name latestVersion provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.machineLearningService.workspace.onlineEndpoint":{"id":"azure.subscription.machineLearningService.workspace.onlineEndpoint","name":"azure.subscription.machineLearningService.workspace.onlineEndpoint","fields":{"authMode":{"name":"authMode","type":"\u0007","is_mandatory":true,"title":"Authentication mode: \"Key\" (non-expiring keys) or \"AMLToken\" (expiring Azure Machine Learning tokens)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"compute":{"name":"compute","type":"\u001bazure.subscription.machineLearningService.workspace.compute","title":"Compute serving the endpoint (null for managed compute, where Azure provisions the infrastructure)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deployment":{"name":"deployment","type":"\u001bazure.subscription.machineLearningService.workspace.onlineEndpoint.deployment","title":"Model deployment behind an online endpoint","desc":"Single online deployment, the model, environment, and compute that serve a share of an online endpoint's traffic, selected by `name`. `model` names the registered model being served, `instanceType` and `skuCapacity` give the compute size and instance count, `endpointComputeType` reports the hosting type (\"Managed\", \"Kubernetes\", or \"AzureMLCompute\"), `environmentId` identifies the inference environment, and `egressPublicNetworkAccess` reports whether the container has unrestricted outbound network access.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"deployments":{"name":"deployments","type":"\u0019\u001bazure.subscription.machineLearningService.workspace.onlineEndpoint.deployment","title":"Model deployments behind the endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Online endpoint resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Identity configuration (SystemAssigned, UserAssigned, principalId, tenantId)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Resource kind metadata used by tooling","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Endpoint location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mirrorTraffic":{"name":"mirrorTraffic","type":"\u001a\u0007\u0005","is_mandatory":true,"title":"Mirror-traffic percentage per deployment name, sent without returning scores (values sum to at most 50)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Endpoint name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether the endpoint allows public access when Private Link is enabled (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scoringUri":{"name":"scoringUri","type":"\u0007","is_mandatory":true,"title":"Scoring (inference) URL of the endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"swaggerUri":{"name":"swaggerUri","type":"\u0007","is_mandatory":true,"title":"Swagger (OpenAPI) URL of the endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Endpoint tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"traffic":{"name":"traffic","type":"\u001a\u0007\u0005","is_mandatory":true,"title":"Live-traffic split percentage per deployment name (values sum to 100)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Real-time inference endpoint in an Azure Machine Learning workspace","desc":"Single online endpoint, the HTTPS endpoint that serves one or more model deployments for real-time scoring, selected by `name`. `authMode` reports how callers authenticate (\"Key\" or \"AMLToken\"), `scoringUri` gives the inference URL, `publicNetworkAccess` reports whether the endpoint is reachable from the public internet, `traffic` shows how live traffic is split across deployments, and `deployments` returns the model deployments behind the endpoint.","min_provider_version":"13.15.2","defaults":"name authMode provisioningState publicNetworkAccess","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.machineLearningService.workspace.onlineEndpoint.deployment":{"id":"azure.subscription.machineLearningService.workspace.onlineEndpoint.deployment","name":"azure.subscription.machineLearningService.workspace.onlineEndpoint.deployment","fields":{"appInsightsEnabled":{"name":"appInsightsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Application Insights logging is enabled for the deployment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the deployment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"egressPublicNetworkAccess":{"name":"egressPublicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether the container has unrestricted outbound (egress) public network access (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpointComputeType":{"name":"endpointComputeType","type":"\u0007","is_mandatory":true,"title":"Hosting compute type: \"Managed\", \"Kubernetes\", or \"AzureMLCompute\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"environmentId":{"name":"environmentId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID or asset ID of the inference environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Online deployment resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"instanceType":{"name":"instanceType","type":"\u0007","is_mandatory":true,"title":"Compute instance type (VM size) backing the deployment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Deployment location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"model":{"name":"model","type":"\u0007","is_mandatory":true,"title":"URI or asset ID of the registered model being served","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Deployment name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the deployment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuCapacity":{"name":"skuCapacity","type":"\u0005","is_mandatory":true,"title":"Number of provisioned instances","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"SKU name for autoscaling (e.g., \"Default\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Deployment tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Model deployment behind an online endpoint","desc":"Single online deployment, the model, environment, and compute that serve a share of an online endpoint's traffic, selected by `name`. `model` names the registered model being served, `instanceType` and `skuCapacity` give the compute size and instance count, `endpointComputeType` reports the hosting type (\"Managed\", \"Kubernetes\", or \"AzureMLCompute\"), `environmentId` identifies the inference environment, and `egressPublicNetworkAccess` reports whether the container has unrestricted outbound network access.","min_provider_version":"13.15.2","defaults":"name model instanceType provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.machineLearningService.workspace.serverlessEndpoint":{"id":"azure.subscription.machineLearningService.workspace.serverlessEndpoint","name":"azure.subscription.machineLearningService.workspace.serverlessEndpoint","fields":{"authMode":{"name":"authMode","type":"\u0007","is_mandatory":true,"title":"Authentication mode for the endpoint (e.g., \"Key\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"contentSafetyStatus":{"name":"contentSafetyStatus","type":"\u0007","is_mandatory":true,"title":"Content-safety filtering status (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpointState":{"name":"endpointState","type":"\u0007","is_mandatory":true,"title":"Lifecycle state of the endpoint (e.g., \"Creating\", \"Online\", \"Deleting\", \"Failed\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Serverless endpoint resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Identity configuration (SystemAssigned, UserAssigned, principalId, tenantId)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inferenceUri":{"name":"inferenceUri","type":"\u0007","is_mandatory":true,"title":"Inference URL to target when calling the endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Endpoint location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"marketplaceSubscriptionId":{"name":"marketplaceSubscriptionId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the Marketplace subscription backing the endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"modelId":{"name":"modelId","type":"\u0007","is_mandatory":true,"title":"Unique model identifier served by the endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Endpoint name, used as the selection key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Endpoint tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Serverless (Models-as-a-Service) endpoint in an Azure Machine Learning workspace","desc":"Single serverless endpoint, a pay-as-you-go model API consumed without provisioning compute, selected by `name`. `modelId` names the model being served, `inferenceUri` gives the inference URL, `authMode` and `endpointState` report the authentication mode and lifecycle state, `marketplaceSubscriptionId` identifies the backing Marketplace subscription, and `contentSafetyStatus` reports whether content safety filtering is enabled.","min_provider_version":"13.15.2","defaults":"name modelId endpointState provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.managedIdentity":{"id":"azure.subscription.managedIdentity","name":"azure.subscription.managedIdentity","fields":{"clientId":{"name":"clientId","type":"\u0007","is_mandatory":true,"title":"Client ID (application ID) of the identity's service principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"federatedIdentityCredentials":{"name":"federatedIdentityCredentials","type":"\u0019\n","title":"Federated identity credentials (workload identity federation)","desc":"Each entry trusts an external OIDC issuer to mint tokens for this identity, with `name`, `issuer`, `subject`, and the allowed token `audiences`. A broad or unexpected issuer/subject is a privilege- escalation path worth auditing.","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the managed identity","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Object ID of the identity's service principal, referenced by role assignments","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"roleAssignments":{"name":"roleAssignments","type":"\u0019\u001bazure.subscription.authorizationService.roleAssignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Entra ID tenant that owns the identity","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure managed identity","desc":"Azure managed identity that a resource uses to authenticate to other Azure services without an embedded secret, either system-assigned (tied to a single resource's lifecycle) or user-assigned (a standalone identity attachable to many resources). The `roleAssignments` show the privileges granted to the identity across scopes, and `federatedIdentityCredentials` reveal external OIDC issuers trusted to obtain tokens for it (workload identity federation), a common privilege-escalation path worth auditing.","private":true,"min_provider_version":"11.2.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService":{"id":"azure.subscription.monitorService","name":"azure.subscription.monitorService","fields":{"actionGroup":{"name":"actionGroup","type":"\u001bazure.subscription.monitorService.actionGroup","title":"Azure Monitor action group","desc":"A named set of notification and automation targets that alert rules fire when they trigger: emails, SMS messages, voice calls, webhooks, Azure Functions, Logic Apps, automation runbooks, and ITSM connectors. Surfaces whether the group is enabled and each configured receiver, so audits can confirm that critical alerts actually reach a responder. Select by the action group's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"actionGroups":{"name":"actionGroups","type":"\u0019\u001bazure.subscription.monitorService.actionGroup","title":"Action groups (notification and automation targets referenced by alert rules)","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"activityLog":{"name":"activityLog","type":"\u001bazure.subscription.monitorService.activityLog","title":"Monitor activity log","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"applicationInsight":{"name":"applicationInsight","type":"\u001bazure.subscription.monitorService.applicationInsight","title":"Azure Monitor application insights","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"applicationInsights":{"name":"applicationInsights","type":"\u0019\u001bazure.subscription.monitorService.applicationInsight","title":"Application insights for the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettings":{"name":"diagnosticSettings","type":"\u0019\u001bazure.subscription.monitorService.diagnosticsetting","title":"List of diagnostic settings for the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettingsCategory":{"name":"diagnosticSettingsCategory","type":"\u001bazure.subscription.monitorService.diagnosticSettingsCategory","title":"Azure Monitor diagnostic settings category","desc":"One log or metric category that a resource is capable of emitting through diagnostic settings, independent of whether any diagnostic setting currently collects it. Comparing the available categories against the enabled categories on a resource's `diagnosticSettings` surfaces telemetry a resource could emit but isn't. The `name` field is the category name (for example `AuditEvent` or `AllMetrics`).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"diagnosticsetting":{"name":"diagnosticsetting","type":"\u001bazure.subscription.monitorService.diagnosticsetting","title":"Azure Monitor diagnostic setting","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"logProfiles":{"name":"logProfiles","type":"\u0019\u001bazure.subscription.monitorService.logprofile","title":"List of log profiles","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"logprofile":{"name":"logprofile","type":"\u001bazure.subscription.monitorService.logprofile","title":"Azure Monitor log profile","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"metricAlert":{"name":"metricAlert","type":"\u001bazure.subscription.monitorService.metricAlert","title":"Azure Monitor metric alert rule","desc":"An alert rule that fires when a resource metric crosses a threshold. Surfaces whether the rule is enabled, its severity, the resources it watches, how often it evaluates and over what window, and the action groups it notifies. Audit these to confirm that critical resources have active metric alerting wired to a responder. Select by the rule's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"metricAlerts":{"name":"metricAlerts","type":"\u0019\u001bazure.subscription.monitorService.metricAlert","title":"Metric alert rules in the subscription","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"queryPack":{"name":"queryPack","type":"\u001bazure.subscription.monitorService.queryPack","title":"Log Analytics QueryPack","desc":"Share-and-version unit for curated KQL queries. Surfaces the query-pack `queryPackId`, the `provisioningState`, time created and modified, and the resource tags applied. The saved queries inside the pack are available through `queries`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"queryPacks":{"name":"queryPacks","type":"\u0019\u001bazure.subscription.monitorService.queryPack","title":"Log Analytics QueryPacks (saved KQL query collections)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scheduledQueryRule":{"name":"scheduledQueryRule","type":"\u001bazure.subscription.monitorService.scheduledQueryRule","title":"Azure Monitor scheduled query (log) alert rule","desc":"An alert rule that runs a KQL query on Log Analytics or resource logs on a schedule and fires when the results meet its criteria. Surfaces whether the rule is enabled, its severity, the resources it queries, the evaluation cadence and window, and the action groups it notifies. Audit these to confirm log-based detections are active and wired to a responder. Select by the rule's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"scheduledQueryRules":{"name":"scheduledQueryRules","type":"\u0019\u001bazure.subscription.monitorService.scheduledQueryRule","title":"Scheduled query (log) alert rules in the subscription","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workspace":{"name":"workspace","type":"\u001bazure.subscription.monitorService.workspace","title":"Azure Log Analytics workspace","desc":"Underlying log and data store for Azure Monitor, Microsoft Sentinel, and Defender for Cloud. Surfaces the workspace SKU (PerGB2018, CapacityReservation, Free, Standalone, etc.), retention period, daily-quota cap and reset time, the public network access state for ingestion and query, the linked Application Insights workspaces, the customer-managed-key reference, identity assignments, and the `created`/`modified` timestamps tying the workspace's lifecycle to its tenant.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"workspaces":{"name":"workspaces","type":"\u0019\u001bazure.subscription.monitorService.workspace","title":"Log Analytics workspaces","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Monitor","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.actionGroup":{"id":"azure.subscription.monitorService.actionGroup","name":"azure.subscription.monitorService.actionGroup","fields":{"armRoleReceivers":{"name":"armRoleReceivers","type":"\u0019\n","is_mandatory":true,"title":"Entra role receivers (notify all principals holding a role at the scope)","desc":"Each entry has keys `name`, `roleId`, and `useCommonAlertSchema`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"automationRunbookReceivers":{"name":"automationRunbookReceivers","type":"\u0019\n","is_mandatory":true,"title":"Automation runbook receivers","desc":"Each entry has keys `automationAccountId`, `runbookName`, `webhookResourceId`, `isGlobalRunbook`, `name`, and `useCommonAlertSchema`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azureFunctionReceivers":{"name":"azureFunctionReceivers","type":"\u0019\n","is_mandatory":true,"title":"Azure Function receivers","desc":"Each entry has keys `name`, `functionAppResourceId`, `functionName`, `httpTriggerUrl`, and `useCommonAlertSchema`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"emailReceivers":{"name":"emailReceivers","type":"\u0019\n","is_mandatory":true,"title":"Email receivers","desc":"Each entry has keys `name`, `emailAddress`, `useCommonAlertSchema`, and `status`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the action group is enabled; a disabled group receives no notifications","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"groupShortName":{"name":"groupShortName","type":"\u0007","is_mandatory":true,"title":"Short name shown as the source of SMS and other length-limited notifications","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"logicAppReceivers":{"name":"logicAppReceivers","type":"\u0019\n","is_mandatory":true,"title":"Logic Apps receivers","desc":"Each entry has keys `name`, `resourceId`, `callbackUrl`, and `useCommonAlertSchema`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Action group name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"smsReceivers":{"name":"smsReceivers","type":"\u0019\n","is_mandatory":true,"title":"SMS receivers","desc":"Each entry has keys `name`, `countryCode`, `phoneNumber`, and `status`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"voiceReceivers":{"name":"voiceReceivers","type":"\u0019\n","is_mandatory":true,"title":"Voice-call receivers","desc":"Each entry has keys `name`, `countryCode`, and `phoneNumber`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"webhookReceivers":{"name":"webhookReceivers","type":"\u0019\n","is_mandatory":true,"title":"Webhook receivers","desc":"Each entry has keys `name`, `serviceUri`, `useCommonAlertSchema`, and the Entra auth settings when secured.","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Monitor action group","desc":"A named set of notification and automation targets that alert rules fire when they trigger: emails, SMS messages, voice calls, webhooks, Azure Functions, Logic Apps, automation runbooks, and ITSM connectors. Surfaces whether the group is enabled and each configured receiver, so audits can confirm that critical alerts actually reach a responder. Select by the action group's Azure resource ID.","private":true,"min_provider_version":"13.32.1","defaults":"name groupShortName enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.activityLog":{"id":"azure.subscription.monitorService.activityLog","name":"azure.subscription.monitorService.activityLog","fields":{"alert":{"name":"alert","type":"\u001bazure.subscription.monitorService.activityLog.alert","title":"Azure Monitor activity log alert","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"alerts":{"name":"alerts","type":"\u0019\u001bazure.subscription.monitorService.activityLog.alert","title":"List of activity log alerts","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"entries":{"name":"entries","type":"\u0019\u001bazure.subscription.monitorService.activityLog.entry","title":"Management events recorded over the last seven days","desc":"Management-plane operations Azure recorded for the subscription: who performed each operation, when, against which resource, and whether it succeeded. The list covers the most recent seven days, the practical window for change attribution.","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"entry":{"name":"entry","type":"\u001bazure.subscription.monitorService.activityLog.entry","title":"Azure Monitor activity log event","desc":"Single management-plane event from the subscription activity log. Each event records the operation that was performed, the identity that initiated it through `caller`, the affected resource, the outcome, and the `correlationId` that ties together all events belonging to one operation (for example every event emitted by a single deployment).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Monitor activity log","private":true,"min_provider_version":"9.0.1","defaults":"alerts","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.activityLog.alert":{"id":"azure.subscription.monitorService.activityLog.alert","name":"azure.subscription.monitorService.activityLog.alert","fields":{"actions":{"name":"actions","type":"\u0019\n","is_mandatory":true,"title":"Actions that activate when the conditions are met","desc":"Each entry has keys: actionGroupId (ARM ID of the action group to notify) and webhookProperties (custom key/value pairs sent to the action group's webhook receivers).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"conditions":{"name":"conditions","type":"\u0019\n","is_mandatory":true,"title":"Conditions for the activity log alert, all of which must be met","desc":"Each entry has keys: fieldName; equals; containsAny (list of accepted values); and anyOf (nested leaf conditions, each with its own fieldName, equals, and containsAny) forming a match-any group.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the activity log alert","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the activity log alert","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Location of the alert","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the activity log alert","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"List of resource IDs that must be present to trigger the alert","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Tags of the alert","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type of the activity log alert","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Monitor activity log alert","private":true,"min_provider_version":"9.0.1","defaults":"name type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.activityLog.entry":{"id":"azure.subscription.monitorService.activityLog.entry","name":"azure.subscription.monitorService.activityLog.entry","fields":{"authorization":{"name":"authorization","type":"\n","is_mandatory":true,"title":"Authorization scope, action, and role evaluated for the operation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"caller":{"name":"caller","type":"\u0007","is_mandatory":true,"title":"Identity that initiated the operation (user principal name, object ID, or service principal)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Event category","desc":"One of Administrative, ServiceHealth, ResourceHealth, Alert, Autoscale, Recommendation, Security, or Policy.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"claims":{"name":"claims","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Claims from the token of the identity that initiated the operation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"correlationId":{"name":"correlationId","type":"\u0007","is_mandatory":true,"title":"Correlation identifier shared by all events of a single operation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description of the event","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"eventTimestamp":{"name":"eventTimestamp","type":"\t","is_mandatory":true,"title":"When the event was generated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"httpRequest":{"name":"httpRequest","type":"\n","is_mandatory":true,"title":"HTTP request details, including the client IP address, method, and URI","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique event data identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"level":{"name":"level","type":"\u0007","is_mandatory":true,"title":"Event severity level","desc":"One of Critical, Error, Warning, Informational, or Verbose.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"operationId":{"name":"operationId","type":"\u0007","is_mandatory":true,"title":"Operation identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"operationName":{"name":"operationName","type":"\u0007","is_mandatory":true,"title":"Operation that was performed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Additional event details","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceGroupName":{"name":"resourceGroupName","type":"\u0007","is_mandatory":true,"title":"Name of the resource group containing the affected resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceId":{"name":"resourceId","type":"\u0007","is_mandatory":true,"title":"ID of the resource affected by the operation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceProviderName":{"name":"resourceProviderName","type":"\u0007","is_mandatory":true,"title":"Resource provider that handled the operation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceType":{"name":"resourceType","type":"\u0007","is_mandatory":true,"title":"Type of the resource affected by the operation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Operation outcome","desc":"Typical values are Started, In Progress, Succeeded, Failed, and Resolved.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subStatus":{"name":"subStatus","type":"\u0007","is_mandatory":true,"title":"Detailed operation outcome, usually the HTTP status of the underlying REST call","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Monitor activity log event","desc":"Single management-plane event from the subscription activity log. Each event records the operation that was performed, the identity that initiated it through `caller`, the affected resource, the outcome, and the `correlationId` that ties together all events belonging to one operation (for example every event emitted by a single deployment).","private":true,"min_provider_version":"13.19.2","defaults":"operationName caller status eventTimestamp","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.applicationInsight":{"id":"azure.subscription.monitorService.applicationInsight","name":"azure.subscription.monitorService.applicationInsight","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the Application Insights component was created","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableIpMasking":{"name":"disableIpMasking","type":"\u0004","is_mandatory":true,"title":"Whether IP masking is disabled","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Application insight ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Application insight kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Application insight location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Application insight name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Application insight properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccessForIngestion":{"name":"publicNetworkAccessForIngestion","type":"\u0007","is_mandatory":true,"title":"Public network access for ingestion (\"Enabled\", \"Disabled\", or \"SecuredByPerimeter\")","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccessForQuery":{"name":"publicNetworkAccessForQuery","type":"\u0007","is_mandatory":true,"title":"Public network access for query (\"Enabled\", \"Disabled\", or \"SecuredByPerimeter\")","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionInDays":{"name":"retentionInDays","type":"\u0005","is_mandatory":true,"title":"Data retention period in days","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Application insight tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Application insight type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workspace":{"name":"workspace","type":"\u001bazure.subscription.monitorService.workspace","title":"Log Analytics workspace where the diagnostic data is sent","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workspaceResourceId":{"name":"workspaceResourceId","type":"\u0007","is_mandatory":true,"title":"Log Analytics workspace resource ID","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Monitor application insights","private":true,"min_provider_version":"9.0.1","defaults":"name location type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.diagnosticSettingsCategory":{"id":"azure.subscription.monitorService.diagnosticSettingsCategory","name":"azure.subscription.monitorService.diagnosticSettingsCategory","fields":{"categoryGroups":{"name":"categoryGroups","type":"\u0019\u0007","is_mandatory":true,"title":"Category groups this category belongs to (for example \"allLogs\" or \"audit\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"categoryType":{"name":"categoryType","type":"\u0007","is_mandatory":true,"title":"Category type (\"Logs\" or \"Metrics\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Diagnostic category name","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Monitor diagnostic settings category","desc":"One log or metric category that a resource is capable of emitting through diagnostic settings, independent of whether any diagnostic setting currently collects it. Comparing the available categories against the enabled categories on a resource's `diagnosticSettings` surfaces telemetry a resource could emit but isn't. The `name` field is the category name (for example `AuditEvent` or `AllMetrics`).","private":true,"min_provider_version":"13.30.1","defaults":"name categoryType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.diagnosticsetting":{"id":"azure.subscription.monitorService.diagnosticsetting","name":"azure.subscription.monitorService.diagnosticsetting","fields":{"enabledLogCategories":{"name":"enabledLogCategories","type":"\u0019\u0007","is_mandatory":true,"title":"Log categories (or category groups) that are enabled and forwarded by this diagnostic setting","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabledMetricCategories":{"name":"enabledMetricCategories","type":"\u0019\u0007","is_mandatory":true,"title":"Metric categories that are enabled and forwarded by this diagnostic setting","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"eventHubAuthorizationRuleId":{"name":"eventHubAuthorizationRuleId","type":"\u0007","is_mandatory":true,"title":"Authorization rule ID for the Event Hub destination","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"eventHubName":{"name":"eventHubName","type":"\u0007","is_mandatory":true,"title":"Name of the Event Hub logs are streamed to; empty when no Event Hub destination is configured","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Diagnostic setting ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"logAnalyticsDestinationType":{"name":"logAnalyticsDestinationType","type":"\u0007","is_mandatory":true,"title":"Destination table layout in Log Analytics (\"Dedicated\" or \"AzureDiagnostics\")","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"logs":{"name":"logs","type":"\u0019\n","is_mandatory":true,"title":"Per-category log settings","desc":"Each entry describes one log stream with its `category` (or `categoryGroup`), whether it is `enabled`, and the legacy `retentionPolicy` (retention is now managed at the destination).","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metrics":{"name":"metrics","type":"\u0019\n","is_mandatory":true,"title":"Per-category metric settings","desc":"Each entry describes one metric stream with its `category`, whether it is `enabled`, and the legacy `retentionPolicy`.","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Diagnostic setting name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Diagnostic setting properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAccount":{"name":"storageAccount","type":"\u001bazure.subscription.storageService.account","title":"Diagnostic setting storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAccountId":{"name":"storageAccountId","type":"\u0007","is_mandatory":true,"title":"ID of the diagnostic setting storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Diagnostic setting type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workspaceId":{"name":"workspaceId","type":"\u0007","is_mandatory":true,"title":"ID of the Log Analytics workspace logs are sent to; empty when no workspace destination is configured","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Monitor diagnostic setting","private":true,"min_provider_version":"9.0.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.logprofile":{"id":"azure.subscription.monitorService.logprofile","name":"azure.subscription.monitorService.logprofile","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Log profile ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Log profile location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Log profile name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Log profile properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAccount":{"name":"storageAccount","type":"\u001bazure.subscription.storageService.account","title":"Log profile storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAccountId":{"name":"storageAccountId","type":"\u0007","is_mandatory":true,"title":"ID of the log profile storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Log profile tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Log profile type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Monitor log profile","private":true,"min_provider_version":"9.0.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.metricAlert":{"id":"azure.subscription.monitorService.metricAlert","name":"azure.subscription.monitorService.metricAlert","fields":{"actionGroups":{"name":"actionGroups","type":"\u0019\u001bazure.subscription.monitorService.actionGroup","title":"Action groups notified when the rule fires","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"autoMitigate":{"name":"autoMitigate","type":"\u0004","is_mandatory":true,"title":"Whether the alert auto-resolves when the condition clears","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"criteria":{"name":"criteria","type":"\n","is_mandatory":true,"title":"Alert criteria","desc":"The threshold conditions. Keys vary by criteria type (single- or multi-resource, static or dynamic thresholds); each condition carries a `metricName`, `operator`, `threshold`, and `timeAggregation`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"evaluationFrequency":{"name":"evaluationFrequency","type":"\u0007","is_mandatory":true,"title":"How often the rule evaluates its criteria (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastUpdatedTime":{"name":"lastUpdatedTime","type":"\t","is_mandatory":true,"title":"When the rule was last updated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"Resource IDs the rule monitors","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"severity":{"name":"severity","type":"\u0005","is_mandatory":true,"title":"Severity (0 = Critical through 4 = Verbose)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"targetResourceRegion":{"name":"targetResourceRegion","type":"\u0007","is_mandatory":true,"title":"Region of the monitored scopes (set for multi-resource alerts)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"targetResourceType":{"name":"targetResourceType","type":"\u0007","is_mandatory":true,"title":"Resource type of the monitored scopes (set for multi-resource alerts)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"windowSize":{"name":"windowSize","type":"\u0007","is_mandatory":true,"title":"Time window over which metrics are aggregated (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Monitor metric alert rule","desc":"An alert rule that fires when a resource metric crosses a threshold. Surfaces whether the rule is enabled, its severity, the resources it watches, how often it evaluates and over what window, and the action groups it notifies. Audit these to confirm that critical resources have active metric alerting wired to a responder. Select by the rule's Azure resource ID.","private":true,"min_provider_version":"13.32.1","defaults":"name enabled severity","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.queryPack":{"id":"azure.subscription.monitorService.queryPack","name":"azure.subscription.monitorService.queryPack","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"QueryPack resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"QueryPack location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"QueryPack name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"queries":{"name":"queries","type":"\u0019\u001bazure.subscription.monitorService.queryPack.query","title":"Saved KQL queries in this QueryPack","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"query":{"name":"query","type":"\u001bazure.subscription.monitorService.queryPack.query","title":"Saved KQL query in a Log Analytics QueryPack","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"queryPackId":{"name":"queryPackId","type":"\u0007","is_mandatory":true,"title":"Unique ID of the QueryPack (immutable)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"QueryPack tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeCreated":{"name":"timeCreated","type":"\t","is_mandatory":true,"title":"QueryPack creation time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeModified":{"name":"timeModified","type":"\t","is_mandatory":true,"title":"QueryPack last modified time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Log Analytics QueryPack","desc":"Share-and-version unit for curated KQL queries. Surfaces the query-pack `queryPackId`, the `provisioningState`, time created and modified, and the resource tags applied. The saved queries inside the pack are available through `queries`.","min_provider_version":"13.5.1","defaults":"id name location queryPackId","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.queryPack.query":{"id":"azure.subscription.monitorService.queryPack.query","name":"azure.subscription.monitorService.queryPack.query","fields":{"author":{"name":"author","type":"\u0007","is_mandatory":true,"title":"Object ID of the query author","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"body":{"name":"body","type":"\u0007","is_mandatory":true,"title":"Query body (KQL)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the query","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name shown in the QueryPack","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Query resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Query name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\n","is_mandatory":true,"title":"Tags associated with the query","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeCreated":{"name":"timeCreated","type":"\t","is_mandatory":true,"title":"Query creation time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeModified":{"name":"timeModified","type":"\t","is_mandatory":true,"title":"Query last modified time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Saved KQL query in a Log Analytics QueryPack","private":true,"min_provider_version":"13.5.1","defaults":"id name displayName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.scheduledQueryRule":{"id":"azure.subscription.monitorService.scheduledQueryRule","name":"azure.subscription.monitorService.scheduledQueryRule","fields":{"actionGroups":{"name":"actionGroups","type":"\u0019\u001bazure.subscription.monitorService.actionGroup","title":"Action groups notified when the rule fires","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"autoMitigate":{"name":"autoMitigate","type":"\u0004","is_mandatory":true,"title":"Whether the alert auto-resolves when the condition clears","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"criteria":{"name":"criteria","type":"\n","is_mandatory":true,"title":"Alert criteria","desc":"The `allOf` conditions evaluated against the query results; each carries the KQL `query`, a `timeAggregation`, an `operator`, a `threshold`, and optional `dimensions`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"evaluationFrequency":{"name":"evaluationFrequency","type":"\u0007","is_mandatory":true,"title":"How often the rule evaluates its query (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"muteActionsDuration":{"name":"muteActionsDuration","type":"\u0007","is_mandatory":true,"title":"Duration for which actions are muted after firing (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"Resource IDs the rule queries","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"severity":{"name":"severity","type":"\u0005","is_mandatory":true,"title":"Severity (0 = Critical through 4 = Verbose)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"targetResourceTypes":{"name":"targetResourceTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Resource types the rule queries","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"windowSize":{"name":"windowSize","type":"\u0007","is_mandatory":true,"title":"Time window the query covers (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Monitor scheduled query (log) alert rule","desc":"An alert rule that runs a KQL query on Log Analytics or resource logs on a schedule and fires when the results meet its criteria. Surfaces whether the rule is enabled, its severity, the resources it queries, the evaluation cadence and window, and the action groups it notifies. Audit these to confirm log-based detections are active and wired to a responder. Select by the rule's Azure resource ID.","private":true,"min_provider_version":"13.32.1","defaults":"name displayName enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.workspace":{"id":"azure.subscription.monitorService.workspace","name":"azure.subscription.monitorService.workspace","fields":{"capping":{"name":"capping","type":"\u001bazure.subscription.monitorService.workspace.capping","title":"Daily data volume capping","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdDate":{"name":"createdDate","type":"\t","is_mandatory":true,"title":"Workspace creation date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"customerId":{"name":"customerId","type":"\u0007","is_mandatory":true,"title":"Workspace GUID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataExport":{"name":"dataExport","type":"\u001bazure.subscription.monitorService.workspace.dataExport","title":"Data export rule for a Log Analytics workspace","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"dataExports":{"name":"dataExports","type":"\u0019\u001bazure.subscription.monitorService.workspace.dataExport","title":"Data export rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultDataCollectionRuleResourceId":{"name":"defaultDataCollectionRuleResourceId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the default Data Collection Rule for this workspace","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"failover":{"name":"failover","type":"\u001bazure.subscription.monitorService.workspace.failover","title":"Workspace failover state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"features":{"name":"features","type":"\u001bazure.subscription.monitorService.workspace.features","title":"Workspace feature flags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"forceCmkForQuery":{"name":"forceCmkForQuery","type":"\u0004","is_mandatory":true,"title":"Whether customer-managed key is required for query","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Workspace resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity configuration (type, principalId, tenantId, userAssignedIdentities)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"linkedService":{"name":"linkedService","type":"\u001bazure.subscription.monitorService.workspace.linkedService","title":"Linked service for a Log Analytics workspace","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"linkedServices":{"name":"linkedServices","type":"\u0019\u001bazure.subscription.monitorService.workspace.linkedService","title":"Linked services","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Workspace location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"modifiedDate":{"name":"modifiedDate","type":"\t","is_mandatory":true,"title":"Workspace last modified date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Workspace name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkSecurityPerimeterConfigurations":{"name":"networkSecurityPerimeterConfigurations","type":"\u0019\u001bazure.subscription.monitorService.workspace.nspConfiguration","title":"Network Security Perimeter configurations","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nspConfiguration":{"name":"nspConfiguration","type":"\u001bazure.subscription.monitorService.workspace.nspConfiguration","title":"Network Security Perimeter configuration for a Log Analytics workspace","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"privateLinkScopedResources":{"name":"privateLinkScopedResources","type":"\u0019\n","title":"Private link scoped resources","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccessForIngestion":{"name":"publicNetworkAccessForIngestion","type":"\u0007","is_mandatory":true,"title":"Public network access for ingestion (\"Enabled\", \"Disabled\", or \"SecuredByPerimeter\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccessForQuery":{"name":"publicNetworkAccessForQuery","type":"\u0007","is_mandatory":true,"title":"Public network access for query (\"Enabled\", \"Disabled\", or \"SecuredByPerimeter\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replication":{"name":"replication","type":"\u001bazure.subscription.monitorService.workspace.replication","title":"Workspace replication configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionInDays":{"name":"retentionInDays","type":"\u0005","is_mandatory":true,"title":"Data retention period in days","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuCapacityReservationLevel":{"name":"skuCapacityReservationLevel","type":"\u0005","is_mandatory":true,"title":"Capacity reservation level in GB/day (for CapacityReservation SKU)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"SKU name (\"Free\", \"Standard\", \"Premium\", \"PerNode\", \"PerGB2018\", \"Standalone\", \"CapacityReservation\", \"LACluster\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"table":{"name":"table","type":"\u001bazure.subscription.monitorService.workspace.table","title":"Table within a Log Analytics workspace","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"tables":{"name":"tables","type":"\u0019\u001bazure.subscription.monitorService.workspace.table","title":"Workspace tables (per-table plan/retention)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Workspace tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Log Analytics workspace","desc":"Underlying log and data store for Azure Monitor, Microsoft Sentinel, and Defender for Cloud. Surfaces the workspace SKU (PerGB2018, CapacityReservation, Free, Standalone, etc.), retention period, daily-quota cap and reset time, the public network access state for ingestion and query, the linked Application Insights workspaces, the customer-managed-key reference, identity assignments, and the `created`/`modified` timestamps tying the workspace's lifecycle to its tenant.","min_provider_version":"13.3.3","defaults":"id name location skuName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.workspace.capping":{"id":"azure.subscription.monitorService.workspace.capping","name":"azure.subscription.monitorService.workspace.capping","fields":{"dailyQuotaGb":{"name":"dailyQuotaGb","type":"\u0006","is_mandatory":true,"title":"Daily quota in GB (-1 means unlimited)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataIngestionStatus":{"name":"dataIngestionStatus","type":"\u0007","is_mandatory":true,"title":"Data ingestion status (\"RespectQuota\", \"ForceOn\", \"ForceOff\", etc.)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Capping identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"quotaNextResetTime":{"name":"quotaNextResetTime","type":"\u0007","is_mandatory":true,"title":"Next quota reset time","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Daily data volume capping for a Log Analytics workspace","private":true,"min_provider_version":"13.3.3","defaults":"dailyQuotaGb","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.workspace.dataExport":{"id":"azure.subscription.monitorService.workspace.dataExport","name":"azure.subscription.monitorService.workspace.dataExport","fields":{"createdDate":{"name":"createdDate","type":"\t","is_mandatory":true,"title":"Creation date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"destinationResourceId":{"name":"destinationResourceId","type":"\u0007","is_mandatory":true,"title":"Destination resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the export rule is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Data export resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedDate":{"name":"lastModifiedDate","type":"\t","is_mandatory":true,"title":"Last modified date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Data export name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tableNames":{"name":"tableNames","type":"\u0019\u0007","is_mandatory":true,"title":"Table names to export","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Data export rule for a Log Analytics workspace","private":true,"min_provider_version":"13.3.3","defaults":"id name enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.workspace.failover":{"id":"azure.subscription.monitorService.workspace.failover","name":"azure.subscription.monitorService.workspace.failover","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Failover identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedDate":{"name":"lastModifiedDate","type":"\t","is_mandatory":true,"title":"Last time the failover state was updated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Failover state (\"Active\", \"Inactive\", \"Activating\", \"Deactivating\", \"Failed\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Failover state for a Log Analytics workspace","private":true,"min_provider_version":"13.5.1","defaults":"state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.workspace.features":{"id":"azure.subscription.monitorService.workspace.features","name":"azure.subscription.monitorService.workspace.features","fields":{"associations":{"name":"associations","type":"\u0019\u0007","is_mandatory":true,"title":"List of associations indicating Microsoft Defender for Cloud, Sentinel, etc. attachments","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"clusterResourceId":{"name":"clusterResourceId","type":"\u0007","is_mandatory":true,"title":"Dedicated cluster resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether local authentication is disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableDataExport":{"name":"enableDataExport","type":"\u0004","is_mandatory":true,"title":"Whether data export is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableLogAccessUsingOnlyResourcePermissions":{"name":"enableLogAccessUsingOnlyResourcePermissions","type":"\u0004","is_mandatory":true,"title":"Whether log access uses only resource permissions","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Features identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immediatePurgeDataOn30Days":{"name":"immediatePurgeDataOn30Days","type":"\u0004","is_mandatory":true,"title":"Whether data is immediately purged after 30 days","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"unifiedSentinelBillingOnly":{"name":"unifiedSentinelBillingOnly","type":"\u0004","is_mandatory":true,"title":"Whether the workspace is restricted to Sentinel's unified billing model","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Feature flags for a Log Analytics workspace","private":true,"min_provider_version":"13.3.3","defaults":"disableLocalAuth enableDataExport","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.workspace.linkedService":{"id":"azure.subscription.monitorService.workspace.linkedService","name":"azure.subscription.monitorService.workspace.linkedService","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Linked service resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Linked service name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceId":{"name":"resourceId","type":"\u0007","is_mandatory":true,"title":"Linked resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"writeAccessResourceId":{"name":"writeAccessResourceId","type":"\u0007","is_mandatory":true,"title":"Write access resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Linked service for a Log Analytics workspace","private":true,"min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.workspace.nspConfiguration":{"id":"azure.subscription.monitorService.workspace.nspConfiguration","name":"azure.subscription.monitorService.workspace.nspConfiguration","fields":{"accessRules":{"name":"accessRules","type":"\u0019\n","is_mandatory":true,"title":"Access rules attached to the profile","desc":"Each entry has keys: name; direction (\"Inbound\" or \"Outbound\"); addressPrefixes (inbound CIDRs); subscriptions (inbound, each with an ARM subscription id); fullyQualifiedDomainNames (outbound FQDNs); and networkSecurityPerimeters (inbound, each with id, location, perimeterGuid).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"accessRulesVersion":{"name":"accessRulesVersion","type":"\u0005","is_mandatory":true,"title":"Current access rules version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"associationAccessMode":{"name":"associationAccessMode","type":"\u0007","is_mandatory":true,"title":"Resource association access mode","desc":"One of \"Learning\", \"Audit\", or \"Enforced\". \"Learning\" and \"Audit\" only log access that violates the perimeter rules; \"Enforced\" blocks it.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"associationName":{"name":"associationName","type":"\u0007","is_mandatory":true,"title":"Resource association name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettingsVersion":{"name":"diagnosticSettingsVersion","type":"\u0005","is_mandatory":true,"title":"Current diagnostic settings version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabledLogCategories":{"name":"enabledLogCategories","type":"\u0019\u0007","is_mandatory":true,"title":"Log categories enabled on the profile","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"NSP configuration resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"NSP configuration name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"perimeterGuid":{"name":"perimeterGuid","type":"\u0007","is_mandatory":true,"title":"Globally unique identifier of the network security perimeter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"perimeterId":{"name":"perimeterId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the network security perimeter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"perimeterLocation":{"name":"perimeterLocation","type":"\u0007","is_mandatory":true,"title":"Location of the network security perimeter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"profileName":{"name":"profileName","type":"\u0007","is_mandatory":true,"title":"Profile name on the perimeter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningIssues":{"name":"provisioningIssues","type":"\u0019\n","is_mandatory":true,"title":"Issues that prevented the configuration from propagating","desc":"Each entry has keys: name; issueType (\"ConfigurationPropagationFailure\" or \"Unknown\"); severity (\"Error\" or \"Warning\"); and description.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the NSP configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network Security Perimeter configuration for a Log Analytics workspace","private":true,"min_provider_version":"13.5.1","defaults":"id name provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.workspace.replication":{"id":"azure.subscription.monitorService.workspace.replication","name":"azure.subscription.monitorService.workspace.replication","fields":{"createdDate":{"name":"createdDate","type":"\t","is_mandatory":true,"title":"Last time replication was enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether replication is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Replication identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedDate":{"name":"lastModifiedDate","type":"\t","is_mandatory":true,"title":"Last time replication configuration was updated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Location of the replica","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Replication provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Replication configuration for a Log Analytics workspace","private":true,"min_provider_version":"13.5.1","defaults":"enabled location provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.monitorService.workspace.table":{"id":"azure.subscription.monitorService.workspace.table","name":"azure.subscription.monitorService.workspace.table","fields":{"archiveRetentionInDays":{"name":"archiveRetentionInDays","type":"\u0005","is_mandatory":true,"title":"Long-term archive retention in days (totalRetentionInDays - retentionInDays)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Table resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastPlanModifiedDate":{"name":"lastPlanModifiedDate","type":"\u0007","is_mandatory":true,"title":"Timestamp when the table plan was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Table name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"plan":{"name":"plan","type":"\u0007","is_mandatory":true,"title":"Ingestion/billing plan (\"Analytics\", \"Basic\", or \"Auxiliary\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"restoredLogs":{"name":"restoredLogs","type":"\n","is_mandatory":true,"title":"Restored logs configuration if the table was created via restore","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resultStatistics":{"name":"resultStatistics","type":"\n","is_mandatory":true,"title":"Search job execution statistics","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionInDays":{"name":"retentionInDays","type":"\u0005","is_mandatory":true,"title":"Active retention in days (-1 means \"use workspace default\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionInDaysAsDefault":{"name":"retentionInDaysAsDefault","type":"\u0004","is_mandatory":true,"title":"Whether retentionInDays is inherited from the workspace default","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"schema":{"name":"schema","type":"\n","is_mandatory":true,"title":"Table schema (columns, description, source, categories)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"searchResults":{"name":"searchResults","type":"\n","is_mandatory":true,"title":"Search results configuration if the table was created from a search job","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"totalRetentionInDays":{"name":"totalRetentionInDays","type":"\u0005","is_mandatory":true,"title":"Total retention in days including archive (-1 means \"default to retentionInDays\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"totalRetentionInDaysAsDefault":{"name":"totalRetentionInDaysAsDefault","type":"\u0004","is_mandatory":true,"title":"Whether totalRetentionInDays is inherited from the workspace default","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Table within a Log Analytics workspace","private":true,"min_provider_version":"13.5.1","defaults":"name plan retentionInDays totalRetentionInDays","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.mySqlService":{"id":"azure.subscription.mySqlService","name":"azure.subscription.mySqlService","fields":{"database":{"name":"database","type":"\u001bazure.subscription.mySqlService.database","title":"Azure Database for MySQL database","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"flexibleServer":{"name":"flexibleServer","type":"\u001bazure.subscription.mySqlService.flexibleServer","title":"Azure Database for MySQL flexible server","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"flexibleServers":{"name":"flexibleServers","type":"\u0019\u001bazure.subscription.mySqlService.flexibleServer","title":"List of Flexible MySQL servers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"server":{"name":"server","type":"\u001bazure.subscription.mySqlService.server","title":"Azure Database for MySQL server","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"servers":{"name":"servers","type":"\u0019\u001bazure.subscription.mySqlService.server","title":"List of MySQL servers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Database for MySQL","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.mySqlService.database":{"id":"azure.subscription.mySqlService.database","name":"azure.subscription.mySqlService.database","fields":{"charset":{"name":"charset","type":"\u0007","is_mandatory":true,"title":"MySQL database character set","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"collation":{"name":"collation","type":"\u0007","is_mandatory":true,"title":"MySQL database collation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"MySQL database ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"MySQL database name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"MySQL database type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Database for MySQL database","private":true,"min_provider_version":"9.0.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.mySqlService.flexibleServer":{"id":"azure.subscription.mySqlService.flexibleServer","name":"azure.subscription.mySqlService.flexibleServer","fields":{"administrator":{"name":"administrator","type":"\u001bazure.subscription.mySqlService.flexibleServer.administrator","title":"Azure Database for MySQL flexible server Microsoft Entra administrator","desc":"A Microsoft Entra ID (Azure AD) administrator configured on a MySQL flexible server. Presence of an administrator indicates Entra-based authentication is configured; the administratorType, login, and object ID (sid) identify the principal granted administrative access.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"azureAdAdministrators":{"name":"azureAdAdministrators","type":"\u0019\u001bazure.subscription.mySqlService.flexibleServer.administrator","title":"Microsoft Entra ID (Azure AD) administrators configured on the server","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"backupIntervalHours":{"name":"backupIntervalHours","type":"\u0005","is_mandatory":true,"title":"Interval between automatic backups, in hours","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"backupRetentionDays":{"name":"backupRetentionDays","type":"\u0005","is_mandatory":true,"title":"Backup retention period in days","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"configuration":{"name":"configuration","type":"\u0019\u001bazure.subscription.sqlService.configuration","title":"MySQL flexible server configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataEncryptionKey":{"name":"dataEncryptionKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used for data encryption (null if system-managed)","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataEncryptionType":{"name":"dataEncryptionType","type":"\u0007","is_mandatory":true,"title":"Data encryption type (\"SystemManaged\" or \"AzureKeyVault\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"databasePort":{"name":"databasePort","type":"\u0005","is_mandatory":true,"title":"Custom database port the server listens on","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"databases":{"name":"databases","type":"\u0019\u001bazure.subscription.mySqlService.database","title":"MySQL flexible server databases","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"firewallRules":{"name":"firewallRules","type":"\u0019\u001bazure.subscription.sqlService.firewallrule","title":"MySQL flexible server firewall rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fullVersion":{"name":"fullVersion","type":"\u0007","is_mandatory":true,"title":"Exact MySQL engine version, including the patch level (for example \"8.0.37\")","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"geoBackupEncryptionKey":{"name":"geoBackupEncryptionKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used for geo-backup encryption (null if system-managed or single-region)","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"geoRedundantBackup":{"name":"geoRedundantBackup","type":"\u0007","is_mandatory":true,"title":"Whether geo-redundant backup is enabled (\"Enabled\" or \"Disabled\")","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"highAvailabilityMode":{"name":"highAvailabilityMode","type":"\u0007","is_mandatory":true,"title":"High availability mode (\"Disabled\", \"ZoneRedundant\", or \"SameZone\")","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"highAvailabilityState":{"name":"highAvailabilityState","type":"\u0007","is_mandatory":true,"title":"High availability state (\"NotEnabled\", \"CreatingStandby\", \"ReplicatingData\", \"FailingOver\", \"Healthy\", or \"RemovingStandby\")","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"MySQL flexible server ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityType":{"name":"identityType","type":"\u0007","is_mandatory":true,"title":"Type of managed identity configured on the server (for example \"UserAssigned\")","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"internetReachable":{"name":"internetReachable","type":"\u0004","title":"Whether the MySQL flexible server is reachable from the public internet","desc":"True when `publicNetworkAccess` is enabled AND at least one firewall rule opens the server to the entire public internet: a rule whose range spans 0.0.0.0-255.255.255.255. The special \"allow all Azure services\" rule (0.0.0.0-0.0.0.0) does not count, since it admits only Azure-internal IPs.","min_provider_version":"13.20.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"MySQL flexible server location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maintenancePatchStrategy":{"name":"maintenancePatchStrategy","type":"\u0007","is_mandatory":true,"title":"Maintenance patch strategy (\"Regular\" or \"VirtualCanary\")","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"MySQL flexible server name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the server's managed identity","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections that attach the server to private networks","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"MySQL flexible server properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access state (\"Enabled\" or \"Disabled\")","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslEnforcement":{"name":"sslEnforcement","type":"\u0004","title":"Whether SSL enforcement is enabled (queries the require_secure_transport server parameter)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAutoIoScaling":{"name":"storageAutoIoScaling","type":"\u0004","is_mandatory":true,"title":"Whether storage IOPS auto-scaling is enabled","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageLogOnDisk":{"name":"storageLogOnDisk","type":"\u0004","is_mandatory":true,"title":"Whether the server keeps its logs on the data disk","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageRedundancy":{"name":"storageRedundancy","type":"\u0007","is_mandatory":true,"title":"Storage redundancy type (\"LocalRedundancy\" or \"ZoneRedundancy\")","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"MySQL flexible server tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Tenant ID of the server's managed identity","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"threatProtectionState":{"name":"threatProtectionState","type":"\u0007","title":"Microsoft Defender for Cloud advanced threat protection state (\"Enabled\", \"Disabled\", or \"\" when never configured)","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"MySQL flexible server type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities attached to the server","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"MySQL flexible server engine version","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Database for MySQL flexible server","private":true,"min_provider_version":"9.0.1","defaults":"name location properties.version properties.state properties.fullyQualifiedDomainName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.mySqlService.flexibleServer.administrator":{"id":"azure.subscription.mySqlService.flexibleServer.administrator","name":"azure.subscription.mySqlService.flexibleServer.administrator","fields":{"administratorType":{"name":"administratorType","type":"\u0007","is_mandatory":true,"title":"Administrator type (for example \"ActiveDirectory\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Administrator resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"login":{"name":"login","type":"\u0007","is_mandatory":true,"title":"Login name of the server administrator","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Administrator resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sid":{"name":"sid","type":"\u0007","is_mandatory":true,"title":"Object ID (SID) of the administrator principal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Tenant ID of the administrator","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Administrator resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Database for MySQL flexible server Microsoft Entra administrator","desc":"A Microsoft Entra ID (Azure AD) administrator configured on a MySQL flexible server. Presence of an administrator indicates Entra-based authentication is configured; the administratorType, login, and object ID (sid) identify the principal granted administrative access.","private":true,"min_provider_version":"13.23.1","defaults":"login administratorType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.mySqlService.server":{"id":"azure.subscription.mySqlService.server","name":"azure.subscription.mySqlService.server","fields":{"backupRetentionDays":{"name":"backupRetentionDays","type":"\u0005","is_mandatory":true,"title":"Backup retention period in days","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"configuration":{"name":"configuration","type":"\u0019\u001bazure.subscription.sqlService.configuration","title":"MySQL server configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"databases":{"name":"databases","type":"\u0019\u001bazure.subscription.mySqlService.database","title":"MySQL server databases","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"firewallRules":{"name":"firewallRules","type":"\u0019\u001bazure.subscription.sqlService.firewallrule","title":"MySQL server firewall rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"geoRedundantBackup":{"name":"geoRedundantBackup","type":"\u0007","is_mandatory":true,"title":"Whether geo-redundant backup is enabled (\"Enabled\" or \"Disabled\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"MySQL server ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"infrastructureEncryption":{"name":"infrastructureEncryption","type":"\u0004","is_mandatory":true,"title":"Whether infrastructure encryption is enabled (double encryption)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"internetReachable":{"name":"internetReachable","type":"\u0004","title":"Whether the MySQL server is reachable from the public internet","desc":"True when `publicNetworkAccess` is enabled AND at least one firewall rule opens the server to the entire public internet: a rule whose range spans 0.0.0.0-255.255.255.255. The special \"allow all Azure services\" rule (0.0.0.0-0.0.0.0) does not count, since it admits only Azure-internal IPs.","min_provider_version":"13.20.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"MySQL server location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minimalTlsVersion":{"name":"minimalTlsVersion","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version enforced on the server","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"MySQL server name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"MySQL server properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access state (\"Enabled\" or \"Disabled\")","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslEnforcement":{"name":"sslEnforcement","type":"\u0004","is_mandatory":true,"title":"Whether SSL enforcement is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"MySQL server tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"MySQL server type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"MySQL server engine version","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Database for MySQL server","private":true,"min_provider_version":"9.0.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService":{"id":"azure.subscription.networkService","name":"azure.subscription.networkService","fields":{"appSecurityGroup":{"name":"appSecurityGroup","type":"\u001bazure.subscription.networkService.appSecurityGroup","title":"Azure application security group","desc":"Application security group (ASG), the logical grouping used inside Network Security Group rules so traffic can be allowed or denied based on application identity rather than IP. Surfaces the resource GUID and the provisioning state of the group.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"applicationFirewallPolicies":{"name":"applicationFirewallPolicies","type":"\u0019\u001bazure.subscription.networkService.applicationFirewallPolicy","title":"List of application firewall policies","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"applicationFirewallPolicy":{"name":"applicationFirewallPolicy","type":"\u001bazure.subscription.networkService.applicationFirewallPolicy","title":"Azure Web Application Firewall (WAF) policy","desc":"Reusable WAF policy that Application Gateway, Front Door, or other PaaS endpoints reference for L7 protection. Surfaces the `policySettings` (mode, request body limits, file upload limits, state, log scrubbing), the `customRules` list, the `managedRules` configuration (rule sets and per-rule overrides), and the resources the policy is currently bound to.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"applicationGateway":{"name":"applicationGateway","type":"\u001bazure.subscription.networkService.applicationGateway","title":"Azure Application Gateway","desc":"Azure Application Gateway, the regional L7 load balancer that fronts web workloads. Surfaces the SKU and tier (Standard_v2, WAF_v2), TLS settings (frontend/backend TLS, certificates, root certs), HTTP listeners, request-routing rules, URL path maps, redirect configurations, backend address pools and HTTP settings, autoscale configuration, the WAF mode and rule set when the gateway is WAF-enabled, and the linked `firewallPolicy()`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"applicationGateways":{"name":"applicationGateways","type":"\u0019\u001bazure.subscription.networkService.applicationGateway","title":"List of application gateways","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"applicationSecurityGroups":{"name":"applicationSecurityGroups","type":"\u0019\u001bazure.subscription.networkService.appSecurityGroup","title":"List of application security groups","min_provider_version":"9.0.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"backendAddressPool":{"name":"backendAddressPool","type":"\u001bazure.subscription.networkService.backendAddressPool","title":"Azure network backend address pool","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"bastionHost":{"name":"bastionHost","type":"\u001bazure.subscription.networkService.bastionHost","title":"Azure Network Bastion host","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"bastionHosts":{"name":"bastionHosts","type":"\u0019\u001bazure.subscription.networkService.bastionHost","title":"List of Bastion hosts","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bgpSettings":{"name":"bgpSettings","type":"\u001bazure.subscription.networkService.bgpSettings","title":"Azure network BGP settings","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"customIpPrefix":{"name":"customIpPrefix","type":"\u001bazure.subscription.networkService.customIpPrefix","title":"Azure custom IP prefix","desc":"A customer-owned public IP range brought to Azure (BYOIP) and advertised from Microsoft's network. Surfaces the CIDR range, advertising ASN and geo, the commissioned state, the advertise flags, and the WAN-validation messages. Select by the prefix's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"customIpPrefixes":{"name":"customIpPrefixes","type":"\u0019\u001bazure.subscription.networkService.customIpPrefix","title":"List of custom IP prefixes","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ddosProtectionPlan":{"name":"ddosProtectionPlan","type":"\u001bazure.subscription.networkService.ddosProtectionPlan","title":"Azure DDoS protection plan","desc":"DDoS Network Protection plan that virtual networks bind to for enhanced volumetric and protocol DDoS mitigation. Surfaces the plan resource GUID, the public IP addresses currently protected by the plan, and the linked virtual networks subscribing to its mitigation policies.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"ddosProtectionPlans":{"name":"ddosProtectionPlans","type":"\u0019\u001bazure.subscription.networkService.ddosProtectionPlan","title":"List of DDoS protection plans","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"exposure":{"name":"exposure","type":"\u001bazure.subscription.networkService.exposure","title":"Internet-exposure summary for a network-reachable Azure resource","desc":"Combines whether the resource has a public IP with whether its effective network security rules permit inbound traffic from the internet. A resource is considered internet-reachable only when it has a public IP AND its effective network security group chain admits ingress from any source (0.0.0.0/0, ::/0, *, or the \"Internet\" service tag). The effective rules merge the NSG on the NIC, the NSG on its subnet, and application security groups. Inbound traffic must be admitted by every NSG in the chain, and rule priority is honored so a higher-priority Deny that shadows an Allow closes the exposure.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"expressRouteCircuit":{"name":"expressRouteCircuit","type":"\u001bazure.subscription.networkService.expressRouteCircuit","title":"Azure ExpressRoute circuit","desc":"ExpressRoute circuit, the dedicated private link between an on-prem network and Microsoft's backbone, provisioned either through a connectivity provider or on a customer-owned ExpressRoute port. Surfaces the SKU triplet (`skuName`/`skuTier`/`skuFamily`), the `serviceProviderName`/`peeringLocation`/`bandwidthInMbps` of the connectivity-provider plan (or `bandwidthInGbps` for ExpressRoute Direct), the `serviceProviderProvisioningState` (the provider's view), the `circuitProvisioningState` (Microsoft's view), the `globalReachEnabled` flag, `allowClassicOperations`, the `authorizationStatus`, and the `stag` (the outer QinQ tag). Peerings, BGP configuration, and authorizations are reachable through the typed sub-resources [[azure.subscription.networkService.expressRouteCircuit.peering]] and [[azure.subscription.networkService.expressRouteCircuit.authorization]].","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"expressRouteCircuits":{"name":"expressRouteCircuits","type":"\u0019\u001bazure.subscription.networkService.expressRouteCircuit","title":"List of ExpressRoute circuits","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expressRouteGateway":{"name":"expressRouteGateway","type":"\u001bazure.subscription.networkService.expressRouteGateway","title":"Azure Virtual WAN ExpressRoute gateway","desc":"An ExpressRoute gateway deployed inside a Virtual WAN hub that connects the hub to ExpressRoute circuits. Surfaces the auto-scale bounds, whether non-Virtual-WAN traffic is allowed, the virtual hub it belongs to, and the ExpressRoute connections it terminates. Select by the gateway's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"expressRouteGateways":{"name":"expressRouteGateways","type":"\u0019\u001bazure.subscription.networkService.expressRouteGateway","title":"List of Virtual WAN ExpressRoute gateways","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expressRoutePort":{"name":"expressRoutePort","type":"\u001bazure.subscription.networkService.expressRoutePort","title":"Azure ExpressRoute Direct port","desc":"A physical ExpressRoute Direct port pair procured at a peering location. Surfaces the procured and provisioned bandwidth, the encapsulation and billing model, the peering location, the physical link details, and the ExpressRoute circuits provisioned on the port. Select by the port's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"expressRoutePorts":{"name":"expressRoutePorts","type":"\u0019\u001bazure.subscription.networkService.expressRoutePort","title":"List of ExpressRoute Direct ports","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"firewall":{"name":"firewall","type":"\u001bazure.subscription.networkService.firewall","title":"Azure Firewall","desc":"Azure Firewall instance, the L4/L7 stateful service firewall deployed at the network edge. Surfaces the firewall SKU (Standard, Premium, or Basic), threat-intel mode, attached firewall policy, IP configurations and management IP, application/network/NAT rule collections, hub IP addresses for Secure Virtual Hub deployments, the public IP and virtual hub linkage, and the `additionalProperties` exposing autoscale and DNS settings.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"firewallPolicies":{"name":"firewallPolicies","type":"\u0019\u001bazure.subscription.networkService.firewallPolicy","title":"List of firewall policies","min_provider_version":"9.0.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"firewallPolicy":{"name":"firewallPolicy","type":"\u001bazure.subscription.networkService.firewallPolicy","title":"Azure Firewall policy","desc":"Reusable Azure Firewall policy, the rule-set parent that firewall instances reference. Surfaces the policy SKU, threat-intel mode and allow-list, DNS settings, intrusion detection settings, TLS inspection certificate, the explicit-proxy configuration, the child policy chain (`basePolicy`), and the rule collection groups that hold the actual application/network/NAT rules.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"firewalls":{"name":"firewalls","type":"\u0019\u001bazure.subscription.networkService.firewall","title":"List of network firewalls","min_provider_version":"9.0.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"frontendIpConfig":{"name":"frontendIpConfig","type":"\u001bazure.subscription.networkService.frontendIpConfig","title":"Azure network frontend IP configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"inboundNatPool":{"name":"inboundNatPool","type":"\u001bazure.subscription.networkService.inboundNatPool","title":"Azure network inbound NAT pool","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"inboundNatRule":{"name":"inboundNatRule","type":"\u001bazure.subscription.networkService.inboundNatRule","title":"Azure network inbound NAT rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"interface":{"name":"interface","type":"\u001bazure.subscription.networkService.interface","title":"Azure network interface","desc":"Azure network interface (NIC) attached to a VM, scale set, or private endpoint. Surfaces the IP configurations (private IP allocation, public IP, subnet binding), MAC address, the associated network security group, accelerated-networking and IP-forwarding flags, DNS settings, the NIC type (Standard, Elastic), the migration phase, and the auxiliary mode/SKU when the NIC is in an accelerated-connection configuration.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"interfaces":{"name":"interfaces","type":"\u0019\u001bazure.subscription.networkService.interface","title":"List of network interfaces","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipAddress":{"name":"ipAddress","type":"\u001bazure.subscription.networkService.ipAddress","title":"Azure network IP address","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"ipAllocation":{"name":"ipAllocation","type":"\u001bazure.subscription.networkService.ipAllocation","title":"Azure IP allocation","desc":"A reserved address prefix managed outside of a virtual network that a subnet or virtual network can later consume. Surfaces the allocation type, the address prefix and length, allocation tags, and the subnet and virtual network consuming the prefix. Select by the allocation's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"ipAllocations":{"name":"ipAllocations","type":"\u0019\u001bazure.subscription.networkService.ipAllocation","title":"List of IP allocations","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipGroup":{"name":"ipGroup","type":"\u001bazure.subscription.networkService.ipGroup","title":"Azure IP group","desc":"A reusable, named collection of IP addresses and CIDR prefixes that firewall and firewall-policy rules reference in bulk instead of listing individual addresses. Surfaces the contained addresses and prefixes along with the firewalls and firewall policies that consume the group. Select by the IP group's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"ipGroups":{"name":"ipGroups","type":"\u0019\u001bazure.subscription.networkService.ipGroup","title":"List of IP groups","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"loadBalancer":{"name":"loadBalancer","type":"\u001bazure.subscription.networkService.loadBalancer","title":"Azure Load Balancer","desc":"Azure Load Balancer and the front-end / back-end configuration that determines how traffic is distributed. Surfaces the SKU (Basic, Standard, Gateway), tier (Regional or Global), the `frontendIPConfigurations`, `backendAddressPools`, `loadBalancingRules`, `inboundNatRules`, `inboundNatPools`, `outboundRules`, and `probes`. The `extendedLocation`, attached `virtualNetwork` for Standard private LBs, and the resource GUID help correlate the LB to its surrounding network.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"loadBalancerRule":{"name":"loadBalancerRule","type":"\u001bazure.subscription.networkService.loadBalancerRule","title":"Azure Load Balancer rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"loadBalancers":{"name":"loadBalancers","type":"\u0019\u001bazure.subscription.networkService.loadBalancer","title":"List of load balancers","min_provider_version":"9.0.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"localNetworkGateway":{"name":"localNetworkGateway","type":"\u001bazure.subscription.networkService.localNetworkGateway","title":"Azure local network gateway","desc":"Local network gateway, the Azure resource that represents an on-premises network endpoint paired with a virtual network gateway to form a site-to-site VPN. Surfaces the on-premises device IP (`gatewayIpAddress`) or `fqdn`, the address prefixes that describe the on-premises network (`localNetworkAddressSpacePrefixes`), and any configured BGP settings (`bgpSettings`) used to exchange routes with Azure. Use alongside `azure.subscription.networkService.virtualNetworkGateway` and `virtualNetworkGateway.connections` to audit the full site-to-site VPN topology.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"localNetworkGateways":{"name":"localNetworkGateways","type":"\u0019\u001bazure.subscription.networkService.localNetworkGateway","title":"List of local network gateways","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"natGateway":{"name":"natGateway","type":"\u001bazure.subscription.networkService.natGateway","title":"Azure NAT gateway","desc":"NAT gateway that provides outbound SNAT for resources in one or more subnets. Surfaces the SKU and zone placement, the configured idle-timeout, the public IP addresses and prefixes allocated for outbound translation, the subnets currently consuming the gateway, and the resource GUID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"natGateways":{"name":"natGateways","type":"\u0019\u001bazure.subscription.networkService.natGateway","title":"List of NAT gateways","min_provider_version":"9.0.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkManager":{"name":"networkManager","type":"\u001bazure.subscription.networkService.networkManager","title":"Azure Virtual Network Manager","desc":"A management scope that applies security admin rules and connectivity configurations across many virtual networks at once. Its security admin rules take precedence over network security group rules, so this is where a tenant's enforced network posture is defined. Surfaces the manager's scope (subscriptions and management groups), the configuration types it is allowed to apply, the network groups it targets, and its security-admin and connectivity configurations. Select by the manager's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"networkManagers":{"name":"networkManagers","type":"\u0019\u001bazure.subscription.networkService.networkManager","title":"List of Azure Virtual Network Managers","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"outboundRule":{"name":"outboundRule","type":"\u001bazure.subscription.networkService.outboundRule","title":"Azure network outbound rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"privateEndpoint":{"name":"privateEndpoint","type":"\u001bazure.subscription.networkService.privateEndpoint","title":"Azure network private endpoint","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"privateEndpoints":{"name":"privateEndpoints","type":"\u0019\u001bazure.subscription.networkService.privateEndpoint","title":"List of private endpoints","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateLinkService":{"name":"privateLinkService","type":"\u001bazure.subscription.networkService.privateLinkService","title":"Azure Private Link service (provider-side resource that exposes a service via Private Link)","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"privateLinkServices":{"name":"privateLinkServices","type":"\u0019\u001bazure.subscription.networkService.privateLinkService","title":"List of Private Link services (provider-side resources exposing services through Private Link)","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"probe":{"name":"probe","type":"\u001bazure.subscription.networkService.probe","title":"Azure network probe","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"publicIpAddresses":{"name":"publicIpAddresses","type":"\u0019\u001bazure.subscription.networkService.ipAddress","title":"List of public IP addresses","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpPrefix":{"name":"publicIpPrefix","type":"\u001bazure.subscription.networkService.publicIpPrefix","title":"Azure public IP prefix","desc":"A reserved contiguous range of static public IP addresses that individual public IPs are allocated from. Surfaces the prefix length and allocated prefix, the IP version, the SKU, IP tags, and the custom IP prefix (BYOIP) the range is drawn from. Select by the prefix's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"publicIpPrefixes":{"name":"publicIpPrefixes","type":"\u0019\u001bazure.subscription.networkService.publicIpPrefix","title":"List of public IP prefixes","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"route":{"name":"route","type":"\u001bazure.subscription.networkService.route","title":"Azure network route","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"routeFilter":{"name":"routeFilter","type":"\u001bazure.subscription.networkService.routeFilter","title":"Azure route filter","desc":"A filter that controls which ExpressRoute BGP community route advertisements are accepted, used with Microsoft peering. Surfaces the filter rules that allow or deny specific BGP community values. Select by the filter's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"routeFilters":{"name":"routeFilters","type":"\u0019\u001bazure.subscription.networkService.routeFilter","title":"List of route filters","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"routeTable":{"name":"routeTable","type":"\u001bazure.subscription.networkService.routeTable","title":"Azure network route table","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"routeTables":{"name":"routeTables","type":"\u0019\u001bazure.subscription.networkService.routeTable","title":"List of route tables","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityGroup":{"name":"securityGroup","type":"\u001bazure.subscription.networkService.securityGroup","title":"Azure network security group","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"securityGroups":{"name":"securityGroups","type":"\u0019\u001bazure.subscription.networkService.securityGroup","title":"List of network security groups","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityPerimeter":{"name":"securityPerimeter","type":"\u001bazure.subscription.networkService.securityPerimeter","title":"Azure Network Security Perimeter","desc":"A logical isolation boundary that lets PaaS resources such as storage accounts and key vaults communicate inside an explicit perimeter while controlling traffic that crosses it. Surfaces the perimeter GUID and provisioning state, the profiles that group inbound and outbound access rules, and the resource associations that place PaaS resources inside the perimeter along with the access mode enforced on each. Select by the perimeter's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"securityPerimeters":{"name":"securityPerimeters","type":"\u0019\u001bazure.subscription.networkService.securityPerimeter","title":"List of network security perimeters","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityrule":{"name":"securityrule","type":"\u001bazure.subscription.networkService.securityrule","title":"Azure network security rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"serviceEndpointPolicies":{"name":"serviceEndpointPolicies","type":"\u0019\u001bazure.subscription.networkService.serviceEndpointPolicy","title":"List of service endpoint policies","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceEndpointPolicy":{"name":"serviceEndpointPolicy","type":"\u001bazure.subscription.networkService.serviceEndpointPolicy","title":"Azure service endpoint policy","desc":"Service-endpoint policy that restricts which Azure service resources can be reached from a subnet using service endpoints. Surfaces the policy's service-endpoint-policy definitions (the allowed Azure resource IDs), the contextual service alias, the subnets the policy is applied to, and the resource GUID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Azure VNet subnet","desc":"Subnet inside an Azure Virtual Network. Surfaces the IPv4 and IPv6 address prefixes, the attached network security group and route table, NAT gateway, service endpoints and service-endpoint policies, delegations to PaaS services, the `privateEndpointNetworkPolicies` and `privateLinkServiceNetworkPolicies` flags, and the IP allocation method.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trafficManagerProfile":{"name":"trafficManagerProfile","type":"\u001bazure.subscription.networkService.trafficManagerProfile","title":"Azure Traffic Manager profile","desc":"Traffic Manager profile, the DNS-level global load balancer that resolves a single hostname to one of many backends based on a routing method. Surfaces the `trafficRoutingMethod` (Performance, Weighted, Priority, Geographic, MultiValue, Subnet), the `status` of the profile, the `dnsConfig` (relativeName, ttl, fqdn) that controls the resolver-facing record, the `monitorConfig` (protocol, port, path, intervals, expected status codes, custom headers) that governs endpoint probing, and the per-endpoint configuration through [[azure.subscription.networkService.trafficManagerProfile.endpoint]].","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"trafficManagerProfiles":{"name":"trafficManagerProfiles","type":"\u0019\u001bazure.subscription.networkService.trafficManagerProfile","title":"List of Traffic Manager profiles","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualAppliance":{"name":"virtualAppliance","type":"\u001bazure.subscription.networkService.virtualAppliance","title":"Azure network virtual appliance","desc":"A third-party network virtual appliance (NVA) deployed into a Virtual WAN hub, such as a partner firewall or SD-WAN device. Surfaces the appliance vendor, version and scale unit, its BGP ASN, deployment type, and the virtual hub it runs in. Select by the appliance's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualAppliances":{"name":"virtualAppliances","type":"\u0019\u001bazure.subscription.networkService.virtualAppliance","title":"List of network virtual appliances","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualHub":{"name":"virtualHub","type":"\u001bazure.subscription.networkService.virtualHub","title":"Azure Virtual Hub","desc":"Virtual Hub, the regional core of a Virtual WAN deployment that provides routing, transit, and gateway hosting. Surfaces the `addressPrefix` CIDR carved out for the hub, the `sku` and `kind` (regular hub or Route Server), the `allowBranchToBranchTraffic` policy, the `hubRoutingPreference` (ExpressRoute / VPN / ASPath), the BGP-router parameters (`virtualRouterAsn`, `virtualRouterIps`), the linked `virtualWan()`, the linked `azureFirewall()` for Secure Virtual Hub deployments, and the routing surfaces through [[azure.subscription.networkService.virtualHub.routeTable]] and [[azure.subscription.networkService.virtualHub.vnetConnection]].","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualHubs":{"name":"virtualHubs","type":"\u0019\u001bazure.subscription.networkService.virtualHub","title":"List of Virtual WAN virtual hubs","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetwork":{"name":"virtualNetwork","type":"\u001bazure.subscription.networkService.virtualNetwork","title":"Azure Virtual Network (VNet)","desc":"Azure Virtual Network and its connectivity surface. Surfaces the IPv4 and IPv6 address spaces, configured DNS servers, the linked DDoS protection plan, encryption settings, BGP communities, the `enableVmProtection` and `enableDdosProtection` flags, the `subnets()` defined inside the VNet, and the `peerings()` to other virtual networks.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualNetworkGateway":{"name":"virtualNetworkGateway","type":"\u001bazure.subscription.networkService.virtualNetworkGateway","title":"Azure VPN/ExpressRoute gateway","desc":"Virtual network gateway used for VPN, ExpressRoute, or LocalGateway connectivity. Surfaces the gateway type, VPN type (RouteBased or PolicyBased), generation, SKU, IP configuration, BGP settings (ASN, peering address), VPN client configuration (address pool, root and revoked certificates, RADIUS server), the active-active flag, and any associated VPN connections and disaster-recovery settings.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualNetworkGateways":{"name":"virtualNetworkGateways","type":"\u0019\u001bazure.subscription.networkService.virtualNetworkGateway","title":"List of virtual network gateways","min_provider_version":"9.0.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkTap":{"name":"virtualNetworkTap","type":"\u001bazure.subscription.networkService.virtualNetworkTap","title":"Azure virtual network tap","desc":"A traffic-mirroring configuration that copies the traffic of tapped network interface IP configurations to a collector destination. Surfaces the VXLAN destination port and provisioning state. Select by the tap's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualNetworkTaps":{"name":"virtualNetworkTaps","type":"\u0019\u001bazure.subscription.networkService.virtualNetworkTap","title":"List of virtual network taps","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworks":{"name":"virtualNetworks","type":"\u0019\u001bazure.subscription.networkService.virtualNetwork","title":"List of virtual networks","min_provider_version":"9.0.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualRouter":{"name":"virtualRouter","type":"\u001bazure.subscription.networkService.virtualRouter","title":"Azure virtual router","desc":"A BGP-capable virtual router hosted on a subnet or gateway that exchanges routes with peered network virtual appliances. Surfaces the router ASN, its router IPs, and the subnet it is hosted on. Select by the router's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualRouters":{"name":"virtualRouters","type":"\u0019\u001bazure.subscription.networkService.virtualRouter","title":"List of virtual routers","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualWan":{"name":"virtualWan","type":"\u001bazure.subscription.networkService.virtualWan","title":"Azure Virtual WAN","desc":"Virtual WAN, the global transit-network construct that stitches together Virtual Hubs across regions, on-premises sites, and ExpressRoute circuits. Surfaces the `allowBranchToBranchTraffic` and `allowVnetToVnetTraffic` permissions, the `disableVpnEncryption` flag, the `office365LocalBreakoutCategory` for Office 365 traffic, the `virtualWanType` (\"Standard\" or \"Basic\"), and the `provisioningState`. The hubs that belong to the WAN are reachable through [[azure.subscription.networkService.virtualHub]] filtered by `virtualWan.id`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualWans":{"name":"virtualWans","type":"\u0019\u001bazure.subscription.networkService.virtualWan","title":"List of Virtual WANs","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vpnGateway":{"name":"vpnGateway","type":"\u001bazure.subscription.networkService.vpnGateway","title":"Azure Virtual WAN VPN gateway","desc":"A site-to-site VPN gateway deployed inside a Virtual WAN hub that terminates IPsec tunnels from on-premises VPN sites. Surfaces the scale unit, BGP and NAT settings, the virtual hub it belongs to, and the individual VPN connections it terminates. Select by the gateway's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"vpnGateways":{"name":"vpnGateways","type":"\u0019\u001bazure.subscription.networkService.vpnGateway","title":"List of Virtual WAN site-to-site VPN gateways","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vpnServerConfiguration":{"name":"vpnServerConfiguration","type":"\u001bazure.subscription.networkService.vpnServerConfiguration","title":"Azure point-to-site VPN server configuration","desc":"A reusable point-to-site VPN server configuration that P2S gateways reference to authenticate and tunnel remote client connections. Surfaces the enabled tunneling protocols, the accepted authentication types, and the RADIUS server address used for client authentication. Select by the configuration's Azure resource ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"vpnServerConfigurations":{"name":"vpnServerConfigurations","type":"\u0019\u001bazure.subscription.networkService.vpnServerConfiguration","title":"List of point-to-site VPN server configurations","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vpnSite":{"name":"vpnSite","type":"\u001bazure.subscription.networkService.vpnSite","title":"Azure Virtual WAN VPN site","desc":"VPN site, the registered on-prem branch endpoint that terminates a site-to-site IPsec tunnel into a Virtual WAN's VPN gateway. Surfaces the `ipAddress` (the public IP the gateway peers with), the `addressPrefixes` advertised by the branch, the BGP settings (`bgpAsn`, `bgpPeeringAddress`, `bgpPeerWeight`), device metadata (`deviceVendor`, `deviceModel`, `linkSpeedInMbps`), the `isSecuritySite` flag identifying the site as a security-partner site, the `o365Policy` controlling Office 365 traffic categories, `siteKeySet` indicating whether a pre-shared key is configured (the secret itself is not exposed), the typed `virtualWan()` ref to the parent WAN, and the per-link detail in `vpnSiteLinks` (each carrying its own IP, link connection speed, and BGP properties).","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"vpnSites":{"name":"vpnSites","type":"\u0019\u001bazure.subscription.networkService.vpnSite","title":"List of VPN sites (on-prem branch endpoints registered with Virtual WAN)","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"wafConfig":{"name":"wafConfig","type":"\u001bazure.subscription.networkService.wafConfig","title":"Azure Application Gateway WAF config","desc":"Legacy WAF configuration attached directly to an Application Gateway (used by older v1 SKUs). Surfaces the WAF `mode` (Detection / Prevention), the rule set type and version, firewall mode flags, the `enabled` state, request-body limits, and disabled rule groups. Newer deployments use a typed `applicationFirewallPolicy` resource instead.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"watcher":{"name":"watcher","type":"\u001bazure.subscription.networkService.watcher","title":"Azure Network Watcher","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"watchers":{"name":"watchers","type":"\u0019\u001bazure.subscription.networkService.watcher","title":"List of network watchers","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.appSecurityGroup":{"id":"azure.subscription.networkService.appSecurityGroup","name":"azure.subscription.networkService.appSecurityGroup","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Application security group etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Application security group ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Application security group location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Application security group name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Application security group properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Application security group tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Application security group type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure application security group","desc":"Application security group (ASG), the logical grouping used inside Network Security Group rules so traffic can be allowed or denied based on application identity rather than IP. Surfaces the resource GUID and the provisioning state of the group.","min_provider_version":"9.0.8","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.applicationFirewallPolicy":{"id":"azure.subscription.networkService.applicationFirewallPolicy","name":"azure.subscription.networkService.applicationFirewallPolicy","fields":{"customRulesCount":{"name":"customRulesCount","type":"\u0005","is_mandatory":true,"title":"Number of custom rules defined on the policy","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the policy is enabled","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabledState":{"name":"enabledState","type":"\u0007","is_mandatory":true,"title":"Policy enabled state","desc":"Deprecated in favor of enabled, which exposes this as a boolean.","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Application firewall policy etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fileUploadLimitInMb":{"name":"fileUploadLimitInMb","type":"\u0005","is_mandatory":true,"title":"Maximum allowed file upload size, in megabytes","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"gateways":{"name":"gateways","type":"\u0019\u001bazure.subscription.networkService.applicationGateway","title":"List of associated application gateways","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Application firewall policy ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Application firewall policy location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedRuleSets":{"name":"managedRuleSets","type":"\u0019\n","is_mandatory":true,"title":"Managed rule sets applied by the policy","desc":"Each entry carries the `ruleSetType` (e.g. \"OWASP\", \"Microsoft_DefaultRuleSet\", \"Microsoft_BotManagerRuleSet\") and its `ruleSetVersion`, the core inputs for \"is a current managed ruleset attached\" audits.","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxRequestBodySizeInKb":{"name":"maxRequestBodySizeInKb","type":"\u0005","is_mandatory":true,"title":"Maximum inspected request body size, in kilobytes","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Policy enforcement mode (\"Prevention\" blocks matching requests; \"Detection\" only logs them)","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Application firewall policy name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Application firewall policy properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requestBodyCheck":{"name":"requestBodyCheck","type":"\u0004","is_mandatory":true,"title":"Whether the request body is inspected by the WAF","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Application firewall policy tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Application firewall policy resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Web Application Firewall (WAF) policy","desc":"Reusable WAF policy that Application Gateway, Front Door, or other PaaS endpoints reference for L7 protection. Surfaces the `policySettings` (mode, request body limits, file upload limits, state, log scrubbing), the `customRules` list, the `managedRules` configuration (rule sets and per-rule overrides), and the resources the policy is currently bound to.","min_provider_version":"9.0.13","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.applicationGateway":{"id":"azure.subscription.networkService.applicationGateway","name":"azure.subscription.networkService.applicationGateway","fields":{"backendHttpSettings":{"name":"backendHttpSettings","type":"\u0019\u001bazure.subscription.networkService.applicationGateway.backendHttpSettings","is_mandatory":true,"title":"Backend HTTP settings that define how the gateway connects to backend pools, including TLS to the backend and certificate validation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Application Gateway etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"frontendIpConfig":{"name":"frontendIpConfig","type":"\u001bazure.subscription.networkService.applicationGateway.frontendIpConfig","title":"Azure Application Gateway frontend IP configuration","desc":"Single frontend IP configuration on an Application Gateway. A configuration bound to a `subnetId` is an internal (private) frontend; one with a `publicIpAddressId` is internet-facing. Use this to audit whether a gateway exposes a public entry point.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"frontendIpConfigs":{"name":"frontendIpConfigs","type":"\u0019\u001bazure.subscription.networkService.applicationGateway.frontendIpConfig","is_mandatory":true,"title":"Frontend IP configurations on the application gateway (a config with a subnet is internal/private; one with a public IP is internet-facing)","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"gatewayIpConfig":{"name":"gatewayIpConfig","type":"\u001bazure.subscription.networkService.applicationGateway.gatewayIpConfig","title":"Azure Application Gateway IP configuration","desc":"Gateway IP configuration on an Application Gateway. Each entry binds the gateway into a subnet, from which the gateway draws its private addresses. The `subnet` reference traces the network the gateway is deployed into.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"gatewayIpConfigs":{"name":"gatewayIpConfigs","type":"\u0019\u001bazure.subscription.networkService.applicationGateway.gatewayIpConfig","title":"Gateway IP configurations that bind the application gateway into a subnet","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Application Gateway ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityType":{"name":"identityType","type":"\u0007","is_mandatory":true,"title":"Managed identity type: None, SystemAssigned, UserAssigned, or \"SystemAssigned, UserAssigned\"","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"listener":{"name":"listener","type":"\u001bazure.subscription.networkService.applicationGateway.listener","title":"Azure Application Gateway HTTP listener","desc":"Single HTTP/HTTPS listener configured on an Application Gateway. Surfaces the `protocol` (Http / Https) and `port` the listener binds to, the `hostName` (or `hostNames` wildcard list), whether SNI is required (`requireServerNameIndication`), and the SSL certificate the listener presents (`sslCertificate()` resolves to the typed [[azure.subscription.networkService.applicationGateway.sslCertificate]] declared on the parent gateway). A listener bound to `Http` with no `sslCertificate` indicates plaintext traffic acceptance.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"listeners":{"name":"listeners","type":"\u0019\u001bazure.subscription.networkService.applicationGateway.listener","is_mandatory":true,"title":"HTTP listeners configured on the application gateway","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Application Gateway location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Application Gateway name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policy":{"name":"policy","type":"\u001bazure.subscription.networkService.applicationFirewallPolicy","title":"Gets the attached application firewall policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Object ID (principal ID) of the system-assigned managed identity, when one is configured","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Application Gateway properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslCertificate":{"name":"sslCertificate","type":"\u001bazure.subscription.networkService.applicationGateway.sslCertificate","title":"Azure Application Gateway SSL certificate","desc":"Single SSL certificate uploaded to or referenced from Key Vault by an Application Gateway. Surfaces the source: when `keyVaultSecretId` is non-empty, the certificate is referenced from a Key Vault secret (the recommended path); when empty, the certificate data was uploaded directly to the gateway. `publicCertData` holds the base64-encoded public certificate (no private key).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"sslCertificates":{"name":"sslCertificates","type":"\u0019\u001bazure.subscription.networkService.applicationGateway.sslCertificate","is_mandatory":true,"title":"SSL certificates uploaded or referenced from Key Vault on the application gateway","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslCipherSuites":{"name":"sslCipherSuites","type":"\u0019\u0007","is_mandatory":true,"title":"SSL cipher suites enabled on the application gateway","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslMinProtocolVersion":{"name":"sslMinProtocolVersion","type":"\u0007","is_mandatory":true,"title":"Minimum SSL/TLS protocol version (\"TLSv1_0\", \"TLSv1_1\", \"TLSv1_2\", \"TLSv1_3\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslPolicyType":{"name":"sslPolicyType","type":"\u0007","is_mandatory":true,"title":"SSL policy type (\"Predefined\", \"Custom\", \"CustomV2\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslProfile":{"name":"sslProfile","type":"\u001bazure.subscription.networkService.applicationGateway.sslProfile","title":"Azure Application Gateway SSL profile","desc":"Single SSL profile on an Application Gateway, which defines the TLS policy and mutual-TLS client authentication for the listeners bound to it. `sslPolicyType`, `sslPolicyName`, `sslMinProtocolVersion`, and `sslCipherSuites` describe the negotiated TLS parameters. `verifyClientAuthMode`, `verifyClientCertIssuerDN`, and `verifyClientRevocation` describe how client certificates are checked against the authorities named in `trustedClientCertificateNames`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"sslProfiles":{"name":"sslProfiles","type":"\u0019\u001bazure.subscription.networkService.applicationGateway.sslProfile","is_mandatory":true,"title":"SSL profiles that define per-listener TLS policy and mutual-TLS client authentication","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Application Gateway tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Tenant ID of the system-assigned managed identity, when one is configured","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trustedClientCertificate":{"name":"trustedClientCertificate","type":"\u001bazure.subscription.networkService.applicationGateway.trustedClientCertificate","title":"Azure Application Gateway trusted client certificate","desc":"Single trusted client certificate authority on an Application Gateway, used to validate client certificates presented during mutual TLS. `data` holds the base64-encoded certificate chain, `clientCertIssuerDN` the issuer distinguished name, and `validatedCertData` the validated certificate data computed by Azure.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"trustedClientCertificates":{"name":"trustedClientCertificates","type":"\u0019\u001bazure.subscription.networkService.applicationGateway.trustedClientCertificate","is_mandatory":true,"title":"Trusted client certificate authorities used to validate client certificates in mutual TLS","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trustedRootCertificate":{"name":"trustedRootCertificate","type":"\u001bazure.subscription.networkService.applicationGateway.trustedRootCertificate","title":"Azure Application Gateway trusted root certificate","desc":"Single trusted root certificate on an Application Gateway, used to validate the backend server certificate for end-to-end TLS. The certificate is sourced either from inline `data` (base64-encoded public certificate) or from a Key Vault secret resolved through `keyVaultSecret`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"trustedRootCertificates":{"name":"trustedRootCertificates","type":"\u0019\u001bazure.subscription.networkService.applicationGateway.trustedRootCertificate","is_mandatory":true,"title":"Trusted root certificates used to validate backend server certificates for end-to-end TLS","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Application Gateway resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities associated with the application gateway","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"wafConfiguration":{"name":"wafConfiguration","type":"\u0019\u001bazure.subscription.networkService.wafConfig","title":"WAF configurations","min_provider_version":"11.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Application Gateway","desc":"Azure Application Gateway, the regional L7 load balancer that fronts web workloads. Surfaces the SKU and tier (Standard_v2, WAF_v2), TLS settings (frontend/backend TLS, certificates, root certs), HTTP listeners, request-routing rules, URL path maps, redirect configurations, backend address pools and HTTP settings, autoscale configuration, the WAF mode and rule set when the gateway is WAF-enabled, and the linked `firewallPolicy()`.","min_provider_version":"9.0.13","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.applicationGateway.backendHttpSettings":{"id":"azure.subscription.networkService.applicationGateway.backendHttpSettings","name":"azure.subscription.networkService.applicationGateway.backendHttpSettings","fields":{"cookieBasedAffinity":{"name":"cookieBasedAffinity","type":"\u0007","is_mandatory":true,"title":"Cookie-based session affinity setting (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostName":{"name":"hostName","type":"\u0007","is_mandatory":true,"title":"Host header sent to the backend; empty when derived from the backend address","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Backend HTTP settings name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pickHostNameFromBackendAddress":{"name":"pickHostNameFromBackendAddress","type":"\u0004","is_mandatory":true,"title":"Whether the host header is picked from the backend address instead of `hostName`","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Port used to connect to the backend","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol used to connect to the backend (\"Http\", \"Https\", \"Tcp\", or \"Tls\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the backend HTTP settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requestTimeout":{"name":"requestTimeout","type":"\u0005","is_mandatory":true,"title":"Request timeout in seconds for connections to the backend","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sniName":{"name":"sniName","type":"\u0007","is_mandatory":true,"title":"Server Name Indication presented to the backend during the TLS handshake","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trustedRootCertificateIds":{"name":"trustedRootCertificateIds","type":"\u0019\u0007","is_mandatory":true,"title":"ARM resource IDs of trusted root certificates used to validate the backend server certificate","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trustedRootCertificateNames":{"name":"trustedRootCertificateNames","type":"\u0019\u0007","is_mandatory":true,"title":"Names of trusted root certificates used to validate the backend server certificate","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"validateCertChainAndExpiry":{"name":"validateCertChainAndExpiry","type":"\u0004","is_mandatory":true,"title":"Whether the backend server certificate chain and expiry are validated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"validateSNI":{"name":"validateSNI","type":"\u0004","is_mandatory":true,"title":"Whether the backend server certificate SNI is validated","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Application Gateway backend HTTP settings","desc":"Single backend HTTP settings collection on an Application Gateway, which controls how the gateway connects to its backend pool. A `protocol` of Https means the gateway re-encrypts traffic to the backend for end-to-end TLS. `validateCertChainAndExpiry` and `validateSNI` govern whether the backend server certificate is checked against the trusted root certificates named in `trustedRootCertificateNames`. `hostName`, `pickHostNameFromBackendAddress`, and `sniName` determine the host header and SNI presented to the backend.","private":true,"min_provider_version":"13.29.1","defaults":"name protocol port","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.applicationGateway.frontendIpConfig":{"id":"azure.subscription.networkService.applicationGateway.frontendIpConfig","name":"azure.subscription.networkService.applicationGateway.frontendIpConfig","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Frontend IP configuration name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateIPAddress":{"name":"privateIPAddress","type":"\u0007","is_mandatory":true,"title":"Static private IP address, when allocation is static","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateIPAllocationMethod":{"name":"privateIPAllocationMethod","type":"\u0007","is_mandatory":true,"title":"Private IP allocation method (one of Static or Dynamic; current known values from the Azure IPAllocationMethod enum)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddress":{"name":"publicIpAddress","type":"\u001bazure.subscription.networkService.ipAddress","title":"Bound public IP address; null for internal frontends that have no public IP","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddressId":{"name":"publicIpAddressId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the bound public IP address; non-empty for internet-facing frontends (cached for the typed `publicIpAddress` accessor)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Bound subnet; null for internet-facing frontends that have no subnet","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnetId":{"name":"subnetId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the bound subnet; non-empty for internal (private) frontends","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Application Gateway frontend IP configuration","desc":"Single frontend IP configuration on an Application Gateway. A configuration bound to a `subnetId` is an internal (private) frontend; one with a `publicIpAddressId` is internet-facing. Use this to audit whether a gateway exposes a public entry point.","private":true,"min_provider_version":"13.18.1","defaults":"name subnetId publicIpAddressId","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.applicationGateway.gatewayIpConfig":{"id":"azure.subscription.networkService.applicationGateway.gatewayIpConfig","name":"azure.subscription.networkService.applicationGateway.gatewayIpConfig","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Gateway IP configuration name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet the application gateway is deployed into","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnetId":{"name":"subnetId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the bound subnet","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Application Gateway IP configuration","desc":"Gateway IP configuration on an Application Gateway. Each entry binds the gateway into a subnet, from which the gateway draws its private addresses. The `subnet` reference traces the network the gateway is deployed into.","private":true,"min_provider_version":"13.23.1","defaults":"name subnetId","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.applicationGateway.listener":{"id":"azure.subscription.networkService.applicationGateway.listener","name":"azure.subscription.networkService.applicationGateway.listener","fields":{"hostName":{"name":"hostName","type":"\u0007","is_mandatory":true,"title":"Primary host name the listener matches; empty when matching by IP only","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostNames":{"name":"hostNames","type":"\u0019\u0007","is_mandatory":true,"title":"Host names the listener matches (allows wildcard); empty when only `hostName` is set","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Listener name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Port the listener binds to (resolved from the referenced frontendPort)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Listener protocol (\"Http\", \"Https\", \"Tcp\", or \"Tls\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the listener","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requireServerNameIndication":{"name":"requireServerNameIndication","type":"\u0004","is_mandatory":true,"title":"Whether SNI is required (only meaningful for Https listeners)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslCertificateId":{"name":"sslCertificateId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the SSL certificate the listener presents; empty for Http listeners","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslCertificateName":{"name":"sslCertificateName","type":"\u0007","is_mandatory":true,"title":"Name of the SSL certificate the listener presents (matches `name` of an entry in the parent gateway's `sslCertificates`); empty for Http listeners","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslProfileId":{"name":"sslProfileId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the SSL profile bound to the listener; empty when no profile is set","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslProfileName":{"name":"sslProfileName","type":"\u0007","is_mandatory":true,"title":"Name of the SSL profile bound to the listener (matches `name` of an entry in the parent gateway's `sslProfiles`); empty when no profile is set","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Application Gateway HTTP listener","desc":"Single HTTP/HTTPS listener configured on an Application Gateway. Surfaces the `protocol` (Http / Https) and `port` the listener binds to, the `hostName` (or `hostNames` wildcard list), whether SNI is required (`requireServerNameIndication`), and the SSL certificate the listener presents (`sslCertificate()` resolves to the typed [[azure.subscription.networkService.applicationGateway.sslCertificate]] declared on the parent gateway). A listener bound to `Http` with no `sslCertificate` indicates plaintext traffic acceptance.","private":true,"min_provider_version":"13.12.2","defaults":"name protocol port hostName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.applicationGateway.sslCertificate":{"id":"azure.subscription.networkService.applicationGateway.sslCertificate","name":"azure.subscription.networkService.applicationGateway.sslCertificate","fields":{"hsmKey":{"name":"hsmKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Managed HSM key backing this certificate (null when Key Vault- or PFX-backed)","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultSecret":{"name":"keyVaultSecret","type":"\u001bazure.subscription.keyVaultService.secret","title":"Key Vault secret backing the certificate (null when the cert was uploaded directly)","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultSecretId":{"name":"keyVaultSecretId","type":"\u0007","is_mandatory":true,"title":"Key Vault secret URI backing the certificate","desc":"Deprecated in favor of keyVaultSecret, which resolves the typed Key Vault secret. Empty when the certificate was uploaded directly.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Certificate name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the certificate resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicCertData":{"name":"publicCertData","type":"\u0007","is_mandatory":true,"title":"Base64-encoded public certificate data","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Application Gateway SSL certificate","desc":"Single SSL certificate uploaded to or referenced from Key Vault by an Application Gateway. Surfaces the source: when `keyVaultSecretId` is non-empty, the certificate is referenced from a Key Vault secret (the recommended path); when empty, the certificate data was uploaded directly to the gateway. `publicCertData` holds the base64-encoded public certificate (no private key).","private":true,"min_provider_version":"13.12.2","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.applicationGateway.sslProfile":{"id":"azure.subscription.networkService.applicationGateway.sslProfile","name":"azure.subscription.networkService.applicationGateway.sslProfile","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"SSL profile name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the SSL profile","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslCipherSuites":{"name":"sslCipherSuites","type":"\u0019\u0007","is_mandatory":true,"title":"SSL cipher suites enabled for the profile","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslMinProtocolVersion":{"name":"sslMinProtocolVersion","type":"\u0007","is_mandatory":true,"title":"Minimum SSL/TLS protocol version (\"TLSv1_0\", \"TLSv1_1\", \"TLSv1_2\", or \"TLSv1_3\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslPolicyName":{"name":"sslPolicyName","type":"\u0007","is_mandatory":true,"title":"Predefined SSL policy name, when `sslPolicyType` is Predefined","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslPolicyType":{"name":"sslPolicyType","type":"\u0007","is_mandatory":true,"title":"SSL policy type (\"Predefined\", \"Custom\", or \"CustomV2\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trustedClientCertificateIds":{"name":"trustedClientCertificateIds","type":"\u0019\u0007","is_mandatory":true,"title":"ARM resource IDs of trusted client certificates used to validate client certificates","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trustedClientCertificateNames":{"name":"trustedClientCertificateNames","type":"\u0019\u0007","is_mandatory":true,"title":"Names of trusted client certificates used to validate client certificates","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"verifyClientAuthMode":{"name":"verifyClientAuthMode","type":"\u0007","is_mandatory":true,"title":"Client certificate verification mode (\"Passthrough\" or \"Strict\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"verifyClientCertIssuerDN":{"name":"verifyClientCertIssuerDN","type":"\u0004","is_mandatory":true,"title":"Whether the client certificate issuer distinguished name is verified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"verifyClientRevocation":{"name":"verifyClientRevocation","type":"\u0007","is_mandatory":true,"title":"Client certificate revocation check (\"None\" or \"OCSP\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Application Gateway SSL profile","desc":"Single SSL profile on an Application Gateway, which defines the TLS policy and mutual-TLS client authentication for the listeners bound to it. `sslPolicyType`, `sslPolicyName`, `sslMinProtocolVersion`, and `sslCipherSuites` describe the negotiated TLS parameters. `verifyClientAuthMode`, `verifyClientCertIssuerDN`, and `verifyClientRevocation` describe how client certificates are checked against the authorities named in `trustedClientCertificateNames`.","private":true,"min_provider_version":"13.29.1","defaults":"name sslMinProtocolVersion verifyClientAuthMode","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.applicationGateway.trustedClientCertificate":{"id":"azure.subscription.networkService.applicationGateway.trustedClientCertificate","name":"azure.subscription.networkService.applicationGateway.trustedClientCertificate","fields":{"clientCertIssuerDN":{"name":"clientCertIssuerDN","type":"\u0007","is_mandatory":true,"title":"Issuer distinguished name of the client certificate authority","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"data":{"name":"data","type":"\u0007","is_mandatory":true,"title":"Base64-encoded certificate chain data","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Trusted client certificate name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the trusted client certificate","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"validatedCertData":{"name":"validatedCertData","type":"\u0007","is_mandatory":true,"title":"Validated certificate data computed by Azure","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Application Gateway trusted client certificate","desc":"Single trusted client certificate authority on an Application Gateway, used to validate client certificates presented during mutual TLS. `data` holds the base64-encoded certificate chain, `clientCertIssuerDN` the issuer distinguished name, and `validatedCertData` the validated certificate data computed by Azure.","private":true,"min_provider_version":"13.29.1","defaults":"name clientCertIssuerDN","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.applicationGateway.trustedRootCertificate":{"id":"azure.subscription.networkService.applicationGateway.trustedRootCertificate","name":"azure.subscription.networkService.applicationGateway.trustedRootCertificate","fields":{"data":{"name":"data","type":"\u0007","is_mandatory":true,"title":"Base64-encoded public certificate data; empty when sourced from Key Vault","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultSecret":{"name":"keyVaultSecret","type":"\u001bazure.subscription.keyVaultService.secret","title":"Key Vault secret backing the certificate (null when the data was uploaded directly)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Trusted root certificate name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the trusted root certificate","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Application Gateway trusted root certificate","desc":"Single trusted root certificate on an Application Gateway, used to validate the backend server certificate for end-to-end TLS. The certificate is sourced either from inline `data` (base64-encoded public certificate) or from a Key Vault secret resolved through `keyVaultSecret`.","private":true,"min_provider_version":"13.29.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.backendAddressPool":{"id":"azure.subscription.networkService.backendAddressPool","name":"azure.subscription.networkService.backendAddressPool","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Backend Address Pool etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Backend Address Pool ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Backend Address Pool name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Backend Address Pool properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Backend Address Pool type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network backend address pool","private":true,"min_provider_version":"9.0.8","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.bastionHost":{"id":"azure.subscription.networkService.bastionHost","name":"azure.subscription.networkService.bastionHost","fields":{"allowedIpRules":{"name":"allowedIpRules","type":"\u0019\u0007","is_mandatory":true,"title":"Source IP address ranges (CIDRs) permitted to reach the Bastion host; empty means no IP restriction is applied","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableCopyPaste":{"name":"disableCopyPaste","type":"\u0004","is_mandatory":true,"title":"Whether copy/paste between the local machine and the remote session is disabled","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableFileCopy":{"name":"enableFileCopy","type":"\u0004","is_mandatory":true,"title":"Whether file copy through the Bastion session is enabled","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableIpConnect":{"name":"enableIpConnect","type":"\u0004","is_mandatory":true,"title":"Whether connecting to a target by its private IP address is enabled","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableKerberos":{"name":"enableKerberos","type":"\u0004","is_mandatory":true,"title":"Whether Kerberos authentication is enabled","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablePrivateOnlyBastion":{"name":"enablePrivateOnlyBastion","type":"\u0004","is_mandatory":true,"title":"Whether the host is a private-only Bastion with no public IP exposure","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableSessionRecording":{"name":"enableSessionRecording","type":"\u0004","is_mandatory":true,"title":"Whether session recording is enabled for auditability of remote sessions","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableShareableLink":{"name":"enableShareableLink","type":"\u0004","is_mandatory":true,"title":"Whether shareable links (URLs granting session access without portal sign-in) are enabled","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableTunneling":{"name":"enableTunneling","type":"\u0004","is_mandatory":true,"title":"Whether native client tunneling (az network bastion tunnel / RDP / SSH) is enabled","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Bastion Host ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipConfiguration":{"name":"ipConfiguration","type":"\u001bazure.subscription.networkService.bastionHost.ipConfiguration","title":"Azure Bastion host IP configuration","desc":"An IP configuration binding a Bastion host to the AzureBastionSubnet it runs in and, for a public Bastion, to its public IP address. Surfaces the private IP allocation method and typed references to the subnet and public IP. Select by the configuration's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"ipConfigurations":{"name":"ipConfigurations","type":"\u0019\u001bazure.subscription.networkService.bastionHost.ipConfiguration","title":"IP configurations binding the Bastion host to its subnet and public IP","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Bastion Host location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Bastion Host name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Bastion host properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scaleUnits":{"name":"scaleUnits","type":"\u0005","is_mandatory":true,"title":"Number of scale units provisioned for the Bastion host","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"Bastion host SKU","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"Bastion SKU name (\"Basic\", \"Standard\", \"Developer\", \"Premium\")","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Bastion Host tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Bastion Host type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Network Bastion host","private":true,"min_provider_version":"9.0.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.bastionHost.ipConfiguration":{"id":"azure.subscription.networkService.bastionHost.ipConfiguration","name":"azure.subscription.networkService.bastionHost.ipConfiguration","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"IP configuration etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"IP configuration ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"IP configuration name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateIpAllocationMethod":{"name":"privateIpAllocationMethod","type":"\u0007","is_mandatory":true,"title":"Private IP allocation method (Static, Dynamic)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the IP configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddress":{"name":"publicIpAddress","type":"\u001bazure.subscription.networkService.ipAddress","title":"Public IP address of the Bastion host; null for a private-only Bastion","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet the Bastion host runs in (AzureBastionSubnet)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Bastion host IP configuration","desc":"An IP configuration binding a Bastion host to the AzureBastionSubnet it runs in and, for a public Bastion, to its public IP address. Surfaces the private IP allocation method and typed references to the subnet and public IP. Select by the configuration's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.bgpSettings":{"id":"azure.subscription.networkService.bgpSettings","name":"azure.subscription.networkService.bgpSettings","fields":{"asn":{"name":"asn","type":"\u0005","is_mandatory":true,"title":"BGP Settings speaker ASN","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bgpPeeringAddress":{"name":"bgpPeeringAddress","type":"\u0007","is_mandatory":true,"title":"The BGP peering address and BGP identifier of this BGP speaker","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bgpPeeringAddressesConfig":{"name":"bgpPeeringAddressesConfig","type":"\u0019\u001bazure.subscription.networkService.bgpSettings.ipConfigurationBgpPeeringAddress","is_mandatory":true,"title":"The BGP peering addresses with IP configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"BGP Settings ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipConfigurationBgpPeeringAddress":{"name":"ipConfigurationBgpPeeringAddress","type":"\u001bazure.subscription.networkService.bgpSettings.ipConfigurationBgpPeeringAddress","title":"Azure BGP settings IP configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"peerWeight":{"name":"peerWeight","type":"\u0005","is_mandatory":true,"title":"The weight added to routes learned from this BGP speaker","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network BGP settings","private":true,"min_provider_version":"9.0.8","defaults":"asn bgpPeeringAddress","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.bgpSettings.ipConfigurationBgpPeeringAddress":{"id":"azure.subscription.networkService.bgpSettings.ipConfigurationBgpPeeringAddress","name":"azure.subscription.networkService.bgpSettings.ipConfigurationBgpPeeringAddress","fields":{"customBgpIpAddresses":{"name":"customBgpIpAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"BGP Settings IP Configuration custom BGP IP addresses","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultBgpIpAddresses":{"name":"defaultBgpIpAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"BGP Settings IP Configuration default BGP IP addresses","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"BGP Settings IP Configuration ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipConfigurationId":{"name":"ipConfigurationId","type":"\u0007","is_mandatory":true,"title":"BGP Settings IP Configuration ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tunnelIpAddresses":{"name":"tunnelIpAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"BGP Settings IP Configuration tunnel public BGP IP addresses","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure BGP settings IP configuration","private":true,"min_provider_version":"9.0.8","defaults":"defaultBgpIpAddresses","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.customIpPrefix":{"id":"azure.subscription.networkService.customIpPrefix","name":"azure.subscription.networkService.customIpPrefix","fields":{"asn":{"name":"asn","type":"\u0007","is_mandatory":true,"title":"ASN used for CIDR advertising","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"authorizationMessage":{"name":"authorizationMessage","type":"\u0007","is_mandatory":true,"title":"Authorization message for WAN validation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cidr":{"name":"cidr","type":"\u0007","is_mandatory":true,"title":"Address range in CIDR notation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"commissionedState":{"name":"commissionedState","type":"\u0007","is_mandatory":true,"title":"Commissioned state of the prefix","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Custom IP prefix etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expressRouteAdvertise":{"name":"expressRouteAdvertise","type":"\u0004","is_mandatory":true,"title":"Whether the range is advertised over ExpressRoute","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"failedReason":{"name":"failedReason","type":"\u0007","is_mandatory":true,"title":"Reason the prefix is in a failed state, when applicable","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"geo":{"name":"geo","type":"\u0007","is_mandatory":true,"title":"Geo code the prefix advertises from","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Custom IP prefix ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Custom IP prefix location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Custom IP prefix name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"noInternetAdvertise":{"name":"noInternetAdvertise","type":"\u0004","is_mandatory":true,"title":"Whether the range is withheld from internet advertising","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"prefixType":{"name":"prefixType","type":"\u0007","is_mandatory":true,"title":"Prefix type (Singular, Parent, Child)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the prefix","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceGuid":{"name":"resourceGuid","type":"\u0007","is_mandatory":true,"title":"Resource GUID of the prefix","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"signedMessage":{"name":"signedMessage","type":"\u0007","is_mandatory":true,"title":"Signed message for WAN validation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Custom IP prefix tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Custom IP prefix resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"Availability zones the prefix is allocated in","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure custom IP prefix","desc":"A customer-owned public IP range brought to Azure (BYOIP) and advertised from Microsoft's network. Surfaces the CIDR range, advertising ASN and geo, the commissioned state, the advertise flags, and the WAN-validation messages. Select by the prefix's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.ddosProtectionPlan":{"id":"azure.subscription.networkService.ddosProtectionPlan","name":"azure.subscription.networkService.ddosProtectionPlan","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"DDoS protection plan etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"DDoS protection plan ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"DDoS protection plan location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"DDoS protection plan name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddresses":{"name":"publicIpAddresses","type":"\u0019\u001bazure.subscription.networkService.ipAddress","title":"Associated public IP addresses","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"DDoS protection plan tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"DDoS protection plan type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworks":{"name":"virtualNetworks","type":"\u0019\u001bazure.subscription.networkService.virtualNetwork","title":"Associated virtual networks protected by this plan","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure DDoS protection plan","desc":"DDoS Network Protection plan that virtual networks bind to for enhanced volumetric and protocol DDoS mitigation. Surfaces the plan resource GUID, the public IP addresses currently protected by the plan, and the linked virtual networks subscribing to its mitigation policies.","min_provider_version":"13.3.3","defaults":"name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.exposure":{"id":"azure.subscription.networkService.exposure","name":"azure.subscription.networkService.exposure","fields":{"hasPublicIp":{"name":"hasPublicIp","type":"\u0004","is_mandatory":true,"title":"Whether the resource has at least one public IP address assigned","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"internetReachable":{"name":"internetReachable","type":"\u0004","is_mandatory":true,"title":"Whether the resource is reachable from the public internet","desc":"True when the resource has a public IP AND the effective NSG chain admits inbound traffic from any source. False when either signal is absent.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"openIngressRules":{"name":"openIngressRules","type":"\u0019\n","is_mandatory":true,"title":"Effective inbound rules that admit traffic from any internet source","desc":"The priority-resolved inbound Allow rules that survive shadowing by any higher-priority Deny and are admitted by every NSG in the chain. Sourced from the effective rules on the resource's NICs, which merge the NSG on the NIC, the NSG on its subnet, and any application security group rules. Each entry is the raw Azure effective-rule object. Empty when a higher-priority Deny or another NSG in the chain blocks the traffic.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityGroupAllowsIngress":{"name":"securityGroupAllowsIngress","type":"\u0004","is_mandatory":true,"title":"Whether the effective NSG chain (NIC and subnet NSGs, resolved by priority) admits inbound traffic from any internet source","desc":"A resource whose network interfaces have no NSG attached at all admits every inbound flow, so this is true in that case. Check securityGroupsEvaluated before trusting a false: an unreadable effective rule set also yields false.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityGroupsEvaluated":{"name":"securityGroupsEvaluated","type":"\u0004","is_mandatory":true,"title":"Whether Azure returned an authoritative effective rule set for every network interface","desc":"False when the effective-security-rules call was denied, throttled, or unavailable for at least one interface (for example a deallocated VM, or a caller without the effectiveNetworkSecurityGroups action). When false, internetReachable and securityGroupAllowsIngress reflect only the interfaces that could be evaluated and must not be read as proof that the resource is closed.","min_provider_version":"13.33.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Internet-exposure summary for a network-reachable Azure resource","desc":"Combines whether the resource has a public IP with whether its effective network security rules permit inbound traffic from the internet. A resource is considered internet-reachable only when it has a public IP AND its effective network security group chain admits ingress from any source (0.0.0.0/0, ::/0, *, or the \"Internet\" service tag). The effective rules merge the NSG on the NIC, the NSG on its subnet, and application security groups. Inbound traffic must be admitted by every NSG in the chain, and rule priority is honored so a higher-priority Deny that shadows an Allow closes the exposure.","private":true,"min_provider_version":"13.20.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.expressRouteCircuit":{"id":"azure.subscription.networkService.expressRouteCircuit","name":"azure.subscription.networkService.expressRouteCircuit","fields":{"allowClassicOperations":{"name":"allowClassicOperations","type":"\u0004","is_mandatory":true,"title":"Whether classic-provisioning operations are allowed on the circuit","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"authorization":{"name":"authorization","type":"\u001bazure.subscription.networkService.expressRouteCircuit.authorization","title":"ExpressRoute circuit authorization","desc":"Connection authorization issued on an ExpressRoute circuit. Each authorization carries a redeemable key that a downstream subscription owner can use to attach a virtual network gateway to this circuit. The key itself is not exposed; surfaces `authorizationKeySet` (whether a key is currently provisioned), `authorizationUseStatus` (whether the key has been consumed by a gateway connection), and `provisioningState`. Use this to audit cross-subscription circuit sharing and to detect stale or unused authorizations.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"authorizationStatus":{"name":"authorizationStatus","type":"\u0007","is_mandatory":true,"title":"Authorization status of the circuit","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"authorizations":{"name":"authorizations","type":"\u0019\u001bazure.subscription.networkService.expressRouteCircuit.authorization","title":"Connection authorizations issued for the circuit","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bandwidthInGbps":{"name":"bandwidthInGbps","type":"\u0006","is_mandatory":true,"title":"Bandwidth in Gbps when the circuit is provisioned on an ExpressRoute Direct port","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bandwidthInMbps":{"name":"bandwidthInMbps","type":"\u0005","is_mandatory":true,"title":"Bandwidth in Mbps when the circuit is provisioned through a connectivity provider","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"circuitProvisioningState":{"name":"circuitProvisioningState","type":"\u0007","is_mandatory":true,"title":"Microsoft's view of provisioning state (\"Provisioning\", \"Provisioned\", \"NotProvisioned\", \"Deprovisioning\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableDirectPortRateLimit":{"name":"enableDirectPortRateLimit","type":"\u0004","is_mandatory":true,"title":"Whether rate-limiting is enabled on an ExpressRoute Direct circuit","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"ExpressRoute circuit etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expressRoutePortId":{"name":"expressRoutePortId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the ExpressRoute port (only set for ExpressRoute Direct circuits)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"globalReachEnabled":{"name":"globalReachEnabled","type":"\u0004","is_mandatory":true,"title":"Whether ExpressRoute Global Reach is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ExpressRoute circuit ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"ExpressRoute circuit location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"ExpressRoute circuit name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peering":{"name":"peering","type":"\u001bazure.subscription.networkService.expressRouteCircuit.peering","title":"ExpressRoute circuit peering","desc":"BGP peering inside an ExpressRoute circuit. The `peeringType` field distinguishes the three peering kinds: `AzurePrivatePeering` (traffic to Azure VNets), `AzurePublicPeering` (deprecated, public Azure services), and `MicrosoftPeering` (Microsoft 365 and Azure public services). Surfaces the BGP state machine fields (`azureAsn`, `peerAsn`, `state`), the IPv4 BGP substrate (`primaryPeerAddressPrefix`, `secondaryPeerAddressPrefix`, `primaryAzurePort`, `secondaryAzurePort`, `vlanId`), `sharedKeySet` (whether an MD5 shared key is configured, the key itself is not exposed), the `microsoftPeeringConfig` (advertised public prefixes, customer ASN, routing-registry name, IPv4 community advertisement) when `peeringType` is `MicrosoftPeering`, the `ipv6PeeringConfig` for dual-stack peerings, and `gatewayManagerEtag` / `provisioningState`. Use this to audit route advertisement and BGP-key rotation on hybrid connectivity.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"peeringLocation":{"name":"peeringLocation","type":"\u0007","is_mandatory":true,"title":"Peering location reported to the connectivity provider (e.g., \"Amsterdam\", \"Washington DC\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peerings":{"name":"peerings","type":"\u0019\u001bazure.subscription.networkService.expressRouteCircuit.peering","title":"BGP peerings (private, microsoft, Azure private) configured on the circuit","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"ExpressRoute circuit properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the circuit resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceProviderName":{"name":"serviceProviderName","type":"\u0007","is_mandatory":true,"title":"Connectivity provider name (empty for ExpressRoute Direct circuits)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceProviderNotes":{"name":"serviceProviderNotes","type":"\u0007","is_mandatory":true,"title":"Free-form notes the provider attaches to the circuit","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceProviderProvisioningState":{"name":"serviceProviderProvisioningState","type":"\u0007","is_mandatory":true,"title":"Provider's view of provisioning state (\"NotProvisioned\", \"Provisioning\", \"Provisioned\", \"Deprovisioning\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuFamily":{"name":"skuFamily","type":"\u0007","is_mandatory":true,"title":"SKU family (\"MeteredData\" or \"UnlimitedData\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"SKU name (typically formatted as \"\u003ctier\u003e_\u003cfamily\u003e\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuTier":{"name":"skuTier","type":"\u0007","is_mandatory":true,"title":"SKU tier (\"Standard\", \"Premium\", \"Local\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"stag":{"name":"stag","type":"\u0005","is_mandatory":true,"title":"Outer QinQ tag identifying the circuit's traffic","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"ExpressRoute circuit tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure ExpressRoute circuit","desc":"ExpressRoute circuit, the dedicated private link between an on-prem network and Microsoft's backbone, provisioned either through a connectivity provider or on a customer-owned ExpressRoute port. Surfaces the SKU triplet (`skuName`/`skuTier`/`skuFamily`), the `serviceProviderName`/`peeringLocation`/`bandwidthInMbps` of the connectivity-provider plan (or `bandwidthInGbps` for ExpressRoute Direct), the `serviceProviderProvisioningState` (the provider's view), the `circuitProvisioningState` (Microsoft's view), the `globalReachEnabled` flag, `allowClassicOperations`, the `authorizationStatus`, and the `stag` (the outer QinQ tag). Peerings, BGP configuration, and authorizations are reachable through the typed sub-resources [[azure.subscription.networkService.expressRouteCircuit.peering]] and [[azure.subscription.networkService.expressRouteCircuit.authorization]].","min_provider_version":"13.12.2","defaults":"id name location skuTier serviceProviderName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.expressRouteCircuit.authorization":{"id":"azure.subscription.networkService.expressRouteCircuit.authorization","name":"azure.subscription.networkService.expressRouteCircuit.authorization","fields":{"authorizationKeySet":{"name":"authorizationKeySet","type":"\u0004","is_mandatory":true,"title":"Whether a redeemable authorization key is provisioned (the key itself is not exposed)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"authorizationUseStatus":{"name":"authorizationUseStatus","type":"\u0007","is_mandatory":true,"title":"Whether the key is currently in use (\"Available\" or \"InUse\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Authorization etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Authorization ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Authorization name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the authorization","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Authorization resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"ExpressRoute circuit authorization","desc":"Connection authorization issued on an ExpressRoute circuit. Each authorization carries a redeemable key that a downstream subscription owner can use to attach a virtual network gateway to this circuit. The key itself is not exposed; surfaces `authorizationKeySet` (whether a key is currently provisioned), `authorizationUseStatus` (whether the key has been consumed by a gateway connection), and `provisioningState`. Use this to audit cross-subscription circuit sharing and to detect stale or unused authorizations.","private":true,"min_provider_version":"13.12.2","defaults":"name authorizationUseStatus provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.expressRouteCircuit.peering":{"id":"azure.subscription.networkService.expressRouteCircuit.peering","name":"azure.subscription.networkService.expressRouteCircuit.peering","fields":{"azureAsn":{"name":"azureAsn","type":"\u0005","is_mandatory":true,"title":"Azure-side ASN","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Peering etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"gatewayManagerEtag":{"name":"gatewayManagerEtag","type":"\u0007","is_mandatory":true,"title":"GatewayManager etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Peering ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipv6PeeringConfig":{"name":"ipv6PeeringConfig","type":"\n","is_mandatory":true,"title":"IPv6 peering configuration (state, prefixes, MicrosoftPeering routes for IPv6)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"microsoftPeeringConfig":{"name":"microsoftPeeringConfig","type":"\n","is_mandatory":true,"title":"MicrosoftPeering configuration: advertised public prefixes, customerAsn, routingRegistryName, IPv4 community state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Peering name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peerAsn":{"name":"peerAsn","type":"\u0005","is_mandatory":true,"title":"Peer (customer) ASN","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peeringType":{"name":"peeringType","type":"\u0007","is_mandatory":true,"title":"Peering type (\"AzurePrivatePeering\", \"AzurePublicPeering\", \"MicrosoftPeering\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"primaryAzurePort":{"name":"primaryAzurePort","type":"\u0007","is_mandatory":true,"title":"Primary Azure-side BGP IP","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"primaryPeerAddressPrefix":{"name":"primaryPeerAddressPrefix","type":"\u0007","is_mandatory":true,"title":"Primary IPv4 BGP substrate prefix","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Peering properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the peering","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secondaryAzurePort":{"name":"secondaryAzurePort","type":"\u0007","is_mandatory":true,"title":"Secondary Azure-side BGP IP","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secondaryPeerAddressPrefix":{"name":"secondaryPeerAddressPrefix","type":"\u0007","is_mandatory":true,"title":"Secondary IPv4 BGP substrate prefix","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sharedKeySet":{"name":"sharedKeySet","type":"\u0004","is_mandatory":true,"title":"Whether an MD5 shared key is configured to authenticate the BGP session (the secret itself is not exposed)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Administrative state (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Peering resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vlanId":{"name":"vlanId","type":"\u0005","is_mandatory":true,"title":"VLAN ID for the BGP session","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"ExpressRoute circuit peering","desc":"BGP peering inside an ExpressRoute circuit. The `peeringType` field distinguishes the three peering kinds: `AzurePrivatePeering` (traffic to Azure VNets), `AzurePublicPeering` (deprecated, public Azure services), and `MicrosoftPeering` (Microsoft 365 and Azure public services). Surfaces the BGP state machine fields (`azureAsn`, `peerAsn`, `state`), the IPv4 BGP substrate (`primaryPeerAddressPrefix`, `secondaryPeerAddressPrefix`, `primaryAzurePort`, `secondaryAzurePort`, `vlanId`), `sharedKeySet` (whether an MD5 shared key is configured, the key itself is not exposed), the `microsoftPeeringConfig` (advertised public prefixes, customer ASN, routing-registry name, IPv4 community advertisement) when `peeringType` is `MicrosoftPeering`, the `ipv6PeeringConfig` for dual-stack peerings, and `gatewayManagerEtag` / `provisioningState`. Use this to audit route advertisement and BGP-key rotation on hybrid connectivity.","private":true,"min_provider_version":"13.12.2","defaults":"name peeringType state vlanId","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.expressRouteGateway":{"id":"azure.subscription.networkService.expressRouteGateway","name":"azure.subscription.networkService.expressRouteGateway","fields":{"allowNonVirtualWanTraffic":{"name":"allowNonVirtualWanTraffic","type":"\u0004","is_mandatory":true,"title":"Whether traffic from non-Virtual-WAN networks is allowed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connection":{"name":"connection","type":"\u001bazure.subscription.networkService.expressRouteGateway.connection","title":"Virtual WAN ExpressRoute gateway connection","desc":"A single connection between a Virtual WAN ExpressRoute gateway and an ExpressRoute circuit peering. Surfaces the routing weight, internet-security and FastPath (gateway bypass) flags, and the ID of the circuit peering it binds to. Select by the connection's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"connections":{"name":"connections","type":"\u0019\u001bazure.subscription.networkService.expressRouteGateway.connection","title":"ExpressRoute connections terminated by the gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"ExpressRoute gateway etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ExpressRoute gateway ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"ExpressRoute gateway location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxScaleUnits":{"name":"maxScaleUnits","type":"\u0005","is_mandatory":true,"title":"Maximum number of scale units for auto-scaling","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minScaleUnits":{"name":"minScaleUnits","type":"\u0005","is_mandatory":true,"title":"Minimum number of scale units for auto-scaling","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"ExpressRoute gateway name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"ExpressRoute gateway tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"ExpressRoute gateway resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualHub":{"name":"virtualHub","type":"\u001bazure.subscription.networkService.virtualHub","title":"Virtual hub the gateway is deployed in","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual WAN ExpressRoute gateway","desc":"An ExpressRoute gateway deployed inside a Virtual WAN hub that connects the hub to ExpressRoute circuits. Surfaces the auto-scale bounds, whether non-Virtual-WAN traffic is allowed, the virtual hub it belongs to, and the ExpressRoute connections it terminates. Select by the gateway's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.expressRouteGateway.connection":{"id":"azure.subscription.networkService.expressRouteGateway.connection","name":"azure.subscription.networkService.expressRouteGateway.connection","fields":{"expressRouteCircuitPeeringId":{"name":"expressRouteCircuitPeeringId","type":"\u0007","is_mandatory":true,"title":"ARM ID of the ExpressRoute circuit peering the connection binds to","desc":"A circuit peering is only reachable through its parent circuit and has no standalone lookup, so it is exposed as the raw ARM ID rather than a typed accessor.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expressRouteGatewayBypass":{"name":"expressRouteGatewayBypass","type":"\u0004","is_mandatory":true,"title":"Whether ExpressRoute gateway bypass (FastPath) is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connection ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"internetSecurityEnabled":{"name":"internetSecurityEnabled","type":"\u0004","is_mandatory":true,"title":"Whether internet security is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the connection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"routingWeight":{"name":"routingWeight","type":"\u0005","is_mandatory":true,"title":"Routing weight of the connection","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Virtual WAN ExpressRoute gateway connection","desc":"A single connection between a Virtual WAN ExpressRoute gateway and an ExpressRoute circuit peering. Surfaces the routing weight, internet-security and FastPath (gateway bypass) flags, and the ID of the circuit peering it binds to. Select by the connection's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.expressRoutePort":{"id":"azure.subscription.networkService.expressRoutePort","name":"azure.subscription.networkService.expressRoutePort","fields":{"bandwidthInGbps":{"name":"bandwidthInGbps","type":"\u0005","is_mandatory":true,"title":"Bandwidth of the procured ports in Gbps","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"billingType":{"name":"billingType","type":"\u0007","is_mandatory":true,"title":"Billing model of the port (MeteredData, UnlimitedData)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"circuits":{"name":"circuits","type":"\u0019\u001bazure.subscription.networkService.expressRouteCircuit","title":"ExpressRoute circuits provisioned on the port","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encapsulation":{"name":"encapsulation","type":"\u0007","is_mandatory":true,"title":"Encapsulation method on the physical ports (Dot1Q, QinQ)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"ExpressRoute port etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etherType":{"name":"etherType","type":"\u0007","is_mandatory":true,"title":"Ether type of the physical port","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ExpressRoute port ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"links":{"name":"links","type":"\u0019\n","is_mandatory":true,"title":"Physical links of the port; each entry carries the link name, admin state, connector type, interface name, and rack ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"ExpressRoute port location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mtu":{"name":"mtu","type":"\u0007","is_mandatory":true,"title":"Maximum transmission unit of the physical port pair","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"ExpressRoute port name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peeringLocation":{"name":"peeringLocation","type":"\u0007","is_mandatory":true,"title":"Peering location the port is physically mapped to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisionedBandwidthInGbps":{"name":"provisionedBandwidthInGbps","type":"\u0006","is_mandatory":true,"title":"Aggregate provisioned bandwidth of associated circuits in Gbps","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the port","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceGuid":{"name":"resourceGuid","type":"\u0007","is_mandatory":true,"title":"Resource GUID of the port","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"ExpressRoute port tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"ExpressRoute port resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure ExpressRoute Direct port","desc":"A physical ExpressRoute Direct port pair procured at a peering location. Surfaces the procured and provisioned bandwidth, the encapsulation and billing model, the peering location, the physical link details, and the ExpressRoute circuits provisioned on the port. Select by the port's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.firewall":{"id":"azure.subscription.networkService.firewall","name":"azure.subscription.networkService.firewall","fields":{"afcServiceEndpoint":{"name":"afcServiceEndpoint","type":"\u0007","is_mandatory":true,"title":"Endpoint URL of the Azure Firewall control plane (AFC), empty when not configured","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"applicationRule":{"name":"applicationRule","type":"\u001bazure.subscription.networkService.firewall.applicationRule","title":"Azure network firewall application rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"applicationRules":{"name":"applicationRules","type":"\u0019\u001bazure.subscription.networkService.firewall.applicationRule","title":"List of application rules for the firewall","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Firewall etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Firewall ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipConfig":{"name":"ipConfig","type":"\u001bazure.subscription.networkService.firewall.ipConfig","title":"Azure network firewall IP configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"ipConfigurations":{"name":"ipConfigurations","type":"\u0019\u001bazure.subscription.networkService.firewall.ipConfig","title":"List of IP configurations for the firewall","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Firewall location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managementIpConfiguration":{"name":"managementIpConfiguration","type":"\u001bazure.subscription.networkService.firewall.ipConfig","title":"The IP configuration used for management traffic","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Firewall name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"natRule":{"name":"natRule","type":"\u001bazure.subscription.networkService.firewall.natRule","title":"Azure network firewall NAT rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"natRules":{"name":"natRules","type":"\u0019\u001bazure.subscription.networkService.firewall.natRule","title":"List of NAT rules for the firewall","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkRule":{"name":"networkRule","type":"\u001bazure.subscription.networkService.firewall.networkRule","title":"Azure network firewall network rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"networkRules":{"name":"networkRules","type":"\u0019\u001bazure.subscription.networkService.firewall.networkRule","title":"List of network rules for the firewall","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policy":{"name":"policy","type":"\u001bazure.subscription.networkService.firewallPolicy","title":"Policy associated with this firewall","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Firewall properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Firewall provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"Firewall SKU name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuTier":{"name":"skuTier","type":"\u0007","is_mandatory":true,"title":"Firewall SKU tier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Firewall tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"threatIntelMode":{"name":"threatIntelMode","type":"\u0007","is_mandatory":true,"title":"Firewall threat intel mode","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Firewall type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Firewall","desc":"Azure Firewall instance, the L4/L7 stateful service firewall deployed at the network edge. Surfaces the firewall SKU (Standard, Premium, or Basic), threat-intel mode, attached firewall policy, IP configurations and management IP, application/network/NAT rule collections, hub IP addresses for Secure Virtual Hub deployments, the public IP and virtual hub linkage, and the `additionalProperties` exposing autoscale and DNS settings.","min_provider_version":"9.0.8","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.firewall.applicationRule":{"id":"azure.subscription.networkService.firewall.applicationRule","name":"azure.subscription.networkService.firewall.applicationRule","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action applied to traffic matching a rule in this collection (\"Allow\" or \"Deny\")","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Firewall application rule etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Firewall application rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Firewall application rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Evaluation priority of the rule collection; lower numbers are evaluated first","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw rule collection properties","desc":"Deprecated in favor of action, priority, and rules.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Individual application rules in the collection, each with its name, protocols, source addresses, target FQDNs, and FQDN tags","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network firewall application rule","private":true,"min_provider_version":"9.0.8","defaults":"name action priority","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.firewall.ipConfig":{"id":"azure.subscription.networkService.firewall.ipConfig","name":"azure.subscription.networkService.firewall.ipConfig","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Firewall IP configuration etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Firewall IP configuration ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Firewall IP configuration name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateIpAddress":{"name":"privateIpAddress","type":"\u0007","is_mandatory":true,"title":"Firewall IP configuration private IP address","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Firewall IP configuration properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddress":{"name":"publicIpAddress","type":"\u001bazure.subscription.networkService.ipAddress","title":"Public IP address associated with this IP configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet associated with this IP configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network firewall IP configuration","private":true,"min_provider_version":"9.0.8","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.firewall.natRule":{"id":"azure.subscription.networkService.firewall.natRule","name":"azure.subscription.networkService.firewall.natRule","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"NAT action applied by this collection (\"Dnat\" or \"Snat\")","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Firewall NAT rule etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Firewall NAT rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Firewall NAT rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Evaluation priority of the rule collection; lower numbers are evaluated first","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw rule collection properties","desc":"Deprecated in favor of action, priority, and rules.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Individual NAT rules in the collection, each with its name, protocols, source/destination addresses, translated address, and ports","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network firewall NAT rule","private":true,"min_provider_version":"9.0.8","defaults":"name action priority","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.firewall.networkRule":{"id":"azure.subscription.networkService.firewall.networkRule","name":"azure.subscription.networkService.firewall.networkRule","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action applied to traffic matching a rule in this collection (\"Allow\" or \"Deny\")","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Firewall network rule etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Firewall network rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Firewall network rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Evaluation priority of the rule collection; lower numbers are evaluated first","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw rule collection properties","desc":"Deprecated in favor of action, priority, and rules.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Individual network rules in the collection, each with its name, protocols, source/destination addresses, and ports","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network firewall network rule","private":true,"min_provider_version":"9.0.8","defaults":"name action priority","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.firewallPolicy":{"id":"azure.subscription.networkService.firewallPolicy","name":"azure.subscription.networkService.firewallPolicy","fields":{"basePolicy":{"name":"basePolicy","type":"\u001bazure.subscription.networkService.firewallPolicy","title":"The parent firewall policy from which rules are inherited","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"childPolicies":{"name":"childPolicies","type":"\u0019\u001bazure.subscription.networkService.firewallPolicy","title":"List of child policies this policy is associated with","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Firewall policy etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"firewalls":{"name":"firewalls","type":"\u0019\u001bazure.subscription.networkService.firewall","title":"List of firewalls the policy is associated with","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Firewall policy ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"idpsBypassRule":{"name":"idpsBypassRule","type":"\u001bazure.subscription.networkService.firewallPolicy.idpsBypassRule","title":"Azure Firewall Policy IDPS bypass traffic rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"intrusionDetectionBypassRules":{"name":"intrusionDetectionBypassRules","type":"\u0019\u001bazure.subscription.networkService.firewallPolicy.idpsBypassRule","title":"IDPS bypass traffic rules","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"intrusionDetectionMode":{"name":"intrusionDetectionMode","type":"\u0007","title":"Intrusion detection mode (Off, Alert, Deny)","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"intrusionDetectionProfile":{"name":"intrusionDetectionProfile","type":"\u0007","title":"Intrusion detection profile (Basic, Standard, Advanced)","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"intrusionDetectionSignatureOverrides":{"name":"intrusionDetectionSignatureOverrides","type":"\u0019\n","title":"IDPS signature overrides (signatures with non-default modes)","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Firewall policy location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Firewall policy name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Firewall policy properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Firewall policy provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ruleCollectionGroup":{"name":"ruleCollectionGroup","type":"\u001bazure.subscription.networkService.firewallPolicy.ruleCollectionGroup","title":"Azure Firewall policy rule collection group","desc":"A named, priority-ordered group of rule collections within a firewall policy. Each rule collection applies an allow or deny action (filter collections) or a DNAT or SNAT translation (NAT collections) to the network, application, and NAT rules it holds, so this is where a policy's effective traffic rules live. Select by the group's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"ruleCollectionGroups":{"name":"ruleCollectionGroups","type":"\u0019\u001bazure.subscription.networkService.firewallPolicy.ruleCollectionGroup","title":"Rule collection groups that hold the policy's network, NAT, and application rules","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Firewall policy tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Firewall policy type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Firewall policy","desc":"Reusable Azure Firewall policy, the rule-set parent that firewall instances reference. Surfaces the policy SKU, threat-intel mode and allow-list, DNS settings, intrusion detection settings, TLS inspection certificate, the explicit-proxy configuration, the child policy chain (`basePolicy`), and the rule collection groups that hold the actual application/network/NAT rules.","min_provider_version":"9.0.8","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.firewallPolicy.idpsBypassRule":{"id":"azure.subscription.networkService.firewallPolicy.idpsBypassRule","name":"azure.subscription.networkService.firewallPolicy.idpsBypassRule","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the bypass rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"destinationAddresses":{"name":"destinationAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Destination IP addresses or ranges","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"destinationIpGroupRefs":{"name":"destinationIpGroupRefs","type":"\u0019\u001bazure.subscription.networkService.ipGroup","title":"Destination IP groups referenced by the bypass rule","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"destinationIpGroups":{"name":"destinationIpGroups","type":"\u0019\u0007","is_mandatory":true,"title":"Destination IP group IDs","desc":"Deprecated in favor of destinationIpGroupRefs, which resolves each IP group to its typed resource.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"destinationPorts":{"name":"destinationPorts","type":"\u0019\u0007","is_mandatory":true,"title":"Destination ports or ranges","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique ID (firewallPolicyId + rule name)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol (TCP, UDP, ICMP, ANY)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceAddresses":{"name":"sourceAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Source IP addresses or ranges","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceIpGroupRefs":{"name":"sourceIpGroupRefs","type":"\u0019\u001bazure.subscription.networkService.ipGroup","title":"Source IP groups referenced by the bypass rule","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceIpGroups":{"name":"sourceIpGroups","type":"\u0019\u0007","is_mandatory":true,"title":"Source IP group IDs","desc":"Deprecated in favor of sourceIpGroupRefs, which resolves each IP group to its typed resource.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"}},"title":"Azure Firewall Policy IDPS bypass traffic rule","private":true,"min_provider_version":"13.3.3","defaults":"name protocol","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.firewallPolicy.ruleCollectionGroup":{"id":"azure.subscription.networkService.firewallPolicy.ruleCollectionGroup","name":"azure.subscription.networkService.firewallPolicy.ruleCollectionGroup","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Rule collection group etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule collection group ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule collection group name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Evaluation priority of the group; lower numbers are evaluated first","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the rule collection group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ruleCollections":{"name":"ruleCollections","type":"\u0019\n","is_mandatory":true,"title":"Rule collections in the group","desc":"Each entry carries ruleCollectionType (FirewallPolicyFilterRuleCollection or FirewallPolicyNatRuleCollection), name, priority, and action, plus a rules list whose shape varies by ruleType: network rules carry ipProtocols, source/destination addresses, and destination ports; application rules carry protocols, source addresses, target FQDNs, and web categories; NAT rules carry the translated address and port.","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Firewall policy rule collection group","desc":"A named, priority-ordered group of rule collections within a firewall policy. Each rule collection applies an allow or deny action (filter collections) or a DNAT or SNAT translation (NAT collections) to the network, application, and NAT rules it holds, so this is where a policy's effective traffic rules live. Select by the group's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"name priority","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.frontendIpConfig":{"id":"azure.subscription.networkService.frontendIpConfig","name":"azure.subscription.networkService.frontendIpConfig","fields":{"ddosCustomPolicyId":{"name":"ddosCustomPolicyId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the DDoS custom policy bound to this frontend IP configuration (empty when none)","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Frontend IP Configuration etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Frontend IP Configuration ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isPublic":{"name":"isPublic","type":"\u0004","is_mandatory":true,"title":"Whether this frontend IP configuration uses a public IP address","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Frontend IP Configuration name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateIpAddress":{"name":"privateIpAddress","type":"\u0007","is_mandatory":true,"title":"Private IP address (empty if public)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Frontend IP Configuration properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddress":{"name":"publicIpAddress","type":"\u001bazure.subscription.networkService.ipAddress","title":"Public IP address bound to this frontend (internet-facing); null for an internal frontend","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddressId":{"name":"publicIpAddressId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the associated public IP address","desc":"Deprecated in favor of publicIpAddress, which resolves to the typed public IP address resource.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet the frontend is bound to (internal load balancer); null for a public frontend","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Frontend IP Configuration type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"Frontend IP Configuration zones","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network frontend IP configuration","private":true,"min_provider_version":"9.0.8","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.inboundNatPool":{"id":"azure.subscription.networkService.inboundNatPool","name":"azure.subscription.networkService.inboundNatPool","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Inbound NAT Pool etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Inbound NAT Pool ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Inbound NAT Pool name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Inbound NAT Pool properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Inbound NAT Pool type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network inbound NAT pool","private":true,"min_provider_version":"9.0.8","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.inboundNatRule":{"id":"azure.subscription.networkService.inboundNatRule","name":"azure.subscription.networkService.inboundNatRule","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Inbound NAT Rule etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Inbound NAT Rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Inbound NAT Rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Inbound NAT Rule properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Inbound NAT Rule type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network inbound NAT rule","private":true,"min_provider_version":"9.0.8","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.interface":{"id":"azure.subscription.networkService.interface","name":"azure.subscription.networkService.interface","fields":{"appliedDnsServers":{"name":"appliedDnsServers","type":"\u0019\u0007","is_mandatory":true,"title":"Effective DNS servers applied to the NIC (custom servers when set, otherwise resolved from the VNet)","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dnsServers":{"name":"dnsServers","type":"\u0019\u0007","is_mandatory":true,"title":"Custom DNS servers configured on the network interface (overrides VNet-level DNS); empty when the NIC inherits VNet DNS","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"effectiveRouteTable":{"name":"effectiveRouteTable","type":"\u0019\n","title":"Effective routes applied to the NIC","desc":"Merges system, user-defined, and BGP-learned routes into the route table actually applied to the interface. Each entry carries name, source, state, addressPrefix, nextHopType, and nextHopIpAddress.","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"effectiveSecurityRules":{"name":"effectiveSecurityRules","type":"\u0019\n","title":"Effective NSG rules merged across NSG-on-NIC, ASGs, and NSG-on-subnet (computed via BeginGetEffectiveNetworkSecurityGroup)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableAcceleratedNetworking":{"name":"enableAcceleratedNetworking","type":"\u0004","is_mandatory":true,"title":"Whether accelerated networking is enabled on the network interface","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableIPForwarding":{"name":"enableIPForwarding","type":"\u0004","is_mandatory":true,"title":"Whether IP forwarding is enabled on the network interface","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Network interface etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Network interface ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"internalDnsNameLabel":{"name":"internalDnsNameLabel","type":"\u0007","is_mandatory":true,"title":"Internal DNS name label assigned to the NIC; empty when unset","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipConfigs":{"name":"ipConfigs","type":"\u0019\u001bazure.subscription.networkService.interface.ipConfiguration","title":"IP configurations bound to the network interface","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipConfiguration":{"name":"ipConfiguration","type":"\u001bazure.subscription.networkService.interface.ipConfiguration","title":"Azure network interface IP configuration","desc":"A single IP configuration bound to a network interface. It ties the interface's private IP address to a subnet, and optionally to a public IP address, application security groups, and load-balancer membership. Surfaces the private IP address and allocation method, whether it is the primary configuration, and typed references to the subnet, public IP address, and application security groups. Select by the configuration's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"ipConfigurations":{"name":"ipConfigurations","type":"\u0019\n","is_mandatory":true,"title":"Raw IP configuration dicts","desc":"Deprecated in favor of ipConfigs, which exposes each IP configuration as a resource with typed subnet, public IP, and application security group references.","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Network interface name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Network interface name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkSecurityGroup":{"name":"networkSecurityGroup","type":"\u001bazure.subscription.networkService.securityGroup","title":"Network security group attached to the NIC; null when the NIC inherits NSG enforcement from its subnet only","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkSecurityGroupId":{"name":"networkSecurityGroupId","type":"\u0007","is_mandatory":true,"title":"Raw network security group resource ID","desc":"Deprecated in favor of `networkSecurityGroup()`.","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"primary":{"name":"primary","type":"\u0004","is_mandatory":true,"title":"Whether this is a primary network interface on a VM","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Network interface properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Network interface tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Network interface type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vm":{"name":"vm","type":"\u001bazure.subscription.computeService.vm","title":"Network interface compute vm","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network interface","desc":"Azure network interface (NIC) attached to a VM, scale set, or private endpoint. Surfaces the IP configurations (private IP allocation, public IP, subnet binding), MAC address, the associated network security group, accelerated-networking and IP-forwarding flags, DNS settings, the NIC type (Standard, Elastic), the migration phase, and the auxiliary mode/SKU when the NIC is in an accelerated-connection configuration.","min_provider_version":"9.0.1","defaults":"name location properties.macAddress properties.nicType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.interface.ipConfiguration":{"id":"azure.subscription.networkService.interface.ipConfiguration","name":"azure.subscription.networkService.interface.ipConfiguration","fields":{"applicationSecurityGroups":{"name":"applicationSecurityGroups","type":"\u0019\u001bazure.subscription.networkService.appSecurityGroup","title":"Application security groups the IP configuration is a member of","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"IP configuration etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"IP configuration ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"IP configuration name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"primary":{"name":"primary","type":"\u0004","is_mandatory":true,"title":"Whether this is the primary IP configuration on the interface","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateIpAddress":{"name":"privateIpAddress","type":"\u0007","is_mandatory":true,"title":"Private IP address (single address or CIDR block)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateIpAddressVersion":{"name":"privateIpAddressVersion","type":"\u0007","is_mandatory":true,"title":"Private IP address version (IPv4, IPv6)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateIpAllocationMethod":{"name":"privateIpAllocationMethod","type":"\u0007","is_mandatory":true,"title":"Private IP address allocation method (Static, Dynamic)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the IP configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddress":{"name":"publicIpAddress","type":"\u001bazure.subscription.networkService.ipAddress","title":"Public IP address bound to the IP configuration; null when the configuration has no public IP","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet the IP configuration is bound to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkTaps":{"name":"virtualNetworkTaps","type":"\u0019\u001bazure.subscription.networkService.virtualNetworkTap","title":"Virtual network taps mirroring this IP configuration's traffic","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network interface IP configuration","desc":"A single IP configuration bound to a network interface. It ties the interface's private IP address to a subnet, and optionally to a public IP address, application security groups, and load-balancer membership. Surfaces the private IP address and allocation method, whether it is the primary configuration, and typed references to the subnet, public IP address, and application security groups. Select by the configuration's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"name privateIpAddress primary","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.ipAddress":{"id":"azure.subscription.networkService.ipAddress","name":"azure.subscription.networkService.ipAddress","fields":{"associatedResourceId":{"name":"associatedResourceId","type":"\u0007","is_mandatory":true,"title":"ARM ID of the IP configuration this public IP is attached to","desc":"Identifies the NIC, load balancer frontend, NAT gateway, Bastion, or firewall that uses this address. Empty when the address is not associated with any resource (an unused / orphaned public IP).","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ddosProtectionMode":{"name":"ddosProtectionMode","type":"\u0007","is_mandatory":true,"title":"DDoS protection mode (\"VirtualNetworkInherited\", \"Enabled\", \"Disabled\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"IP address ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"idleTimeoutInMinutes":{"name":"idleTimeoutInMinutes","type":"\u0005","is_mandatory":true,"title":"Idle timeout in minutes for the public IP","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipAddress":{"name":"ipAddress","type":"\u0007","is_mandatory":true,"title":"IP address","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipAllocationMethod":{"name":"ipAllocationMethod","type":"\u0007","is_mandatory":true,"title":"IP address allocation method (Static, Dynamic)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipTags":{"name":"ipTags","type":"\u0019\n","is_mandatory":true,"title":"IP tags applied to the address; each entry carries ipTagType and tag","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipVersion":{"name":"ipVersion","type":"\u0007","is_mandatory":true,"title":"IP address version (IPv4, IPv6)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"IP address location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"IP address name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"natGateway":{"name":"natGateway","type":"\u001bazure.subscription.networkService.natGateway","title":"NAT gateway using this public IP; null when the address is not used by a NAT gateway","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpPrefix":{"name":"publicIpPrefix","type":"\u001bazure.subscription.networkService.publicIpPrefix","title":"Public IP prefix this address was allocated from; null when the address is not drawn from a prefix","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"Public IP SKU name (Basic, Standard)","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuTier":{"name":"skuTier","type":"\u0007","is_mandatory":true,"title":"Public IP SKU tier (Regional, Global)","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"IP address tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"IP address type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"Availability zones for the public IP address","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network IP address","private":true,"min_provider_version":"9.0.1","defaults":"name location ipAddress","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.ipAllocation":{"id":"azure.subscription.networkService.ipAllocation","name":"azure.subscription.networkService.ipAllocation","fields":{"allocationTags":{"name":"allocationTags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Tags recorded on the allocation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"IP allocation etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"IP allocation ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipAllocationType":{"name":"ipAllocationType","type":"\u0007","is_mandatory":true,"title":"Allocation type (Undefined, Hypernet)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"IP allocation location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"IP allocation name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"prefix":{"name":"prefix","type":"\u0007","is_mandatory":true,"title":"Address prefix reserved by the allocation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"prefixLength":{"name":"prefixLength","type":"\u0005","is_mandatory":true,"title":"Length of the reserved prefix","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"prefixType":{"name":"prefixType","type":"\u0007","is_mandatory":true,"title":"IP version of the prefix (IPv4, IPv6)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet consuming the allocation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"IP allocation tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"IP allocation resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetwork":{"name":"virtualNetwork","type":"\u001bazure.subscription.networkService.virtualNetwork","title":"Virtual network consuming the allocation","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure IP allocation","desc":"A reserved address prefix managed outside of a virtual network that a subnet or virtual network can later consume. Surfaces the allocation type, the address prefix and length, allocation tags, and the subnet and virtual network consuming the prefix. Select by the allocation's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.ipGroup":{"id":"azure.subscription.networkService.ipGroup","name":"azure.subscription.networkService.ipGroup","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"IP group etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"firewallPolicies":{"name":"firewallPolicies","type":"\u0019\u001bazure.subscription.networkService.firewallPolicy","title":"Firewall policies that reference this IP group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"firewalls":{"name":"firewalls","type":"\u0019\u001bazure.subscription.networkService.firewall","title":"Firewalls that reference this IP group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"IP group ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipAddresses":{"name":"ipAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"IP addresses and CIDR prefixes contained in the group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"IP group location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"IP group name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the IP group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"IP group tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"IP group resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure IP group","desc":"A reusable, named collection of IP addresses and CIDR prefixes that firewall and firewall-policy rules reference in bulk instead of listing individual addresses. Surfaces the contained addresses and prefixes along with the firewalls and firewall policies that consume the group. Select by the IP group's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.loadBalancer":{"id":"azure.subscription.networkService.loadBalancer","name":"azure.subscription.networkService.loadBalancer","fields":{"backendPools":{"name":"backendPools","type":"\u0019\u001bazure.subscription.networkService.backendAddressPool","title":"List of Load Balancer backend address pools","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Load Balancer etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"frontendIpConfigs":{"name":"frontendIpConfigs","type":"\u0019\u001bazure.subscription.networkService.frontendIpConfig","title":"List of Load Balancer frontend IP configurations","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Load Balancer ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inboundNatPools":{"name":"inboundNatPools","type":"\u0019\u001bazure.subscription.networkService.inboundNatPool","title":"List of Load Balancer inbound NAT pools","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inboundNatRules":{"name":"inboundNatRules","type":"\u0019\u001bazure.subscription.networkService.inboundNatRule","title":"List of Load Balancer inbound NAT rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"loadBalancerRules":{"name":"loadBalancerRules","type":"\u0019\u001bazure.subscription.networkService.loadBalancerRule","title":"List of Load Balancer rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Load Balancer location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Load Balancer name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"outboundRules":{"name":"outboundRules","type":"\u0019\u001bazure.subscription.networkService.outboundRule","title":"List of Load Balancer outbound rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"probes":{"name":"probes","type":"\u0019\u001bazure.subscription.networkService.probe","title":"List of Load Balancer probes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Load Balancer properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\u0007","is_mandatory":true,"title":"Load Balancer SKU name (\"Basic\", \"Gateway\", \"Standard\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuTier":{"name":"skuTier","type":"\u0007","is_mandatory":true,"title":"Load Balancer SKU tier (\"Global\" or \"Regional\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Load Balancer tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Load Balancer type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Load Balancer","desc":"Azure Load Balancer and the front-end / back-end configuration that determines how traffic is distributed. Surfaces the SKU (Basic, Standard, Gateway), tier (Regional or Global), the `frontendIPConfigurations`, `backendAddressPools`, `loadBalancingRules`, `inboundNatRules`, `inboundNatPools`, `outboundRules`, and `probes`. The `extendedLocation`, attached `virtualNetwork` for Standard private LBs, and the resource GUID help correlate the LB to its surrounding network.","min_provider_version":"9.0.8","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.loadBalancerRule":{"id":"azure.subscription.networkService.loadBalancerRule","name":"azure.subscription.networkService.loadBalancerRule","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Load Balancer rule etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Load Balancer rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Load Balancer rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Load Balancer rule properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Load Balancer rule type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Load Balancer rule","private":true,"min_provider_version":"9.0.8","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.localNetworkGateway":{"id":"azure.subscription.networkService.localNetworkGateway","name":"azure.subscription.networkService.localNetworkGateway","fields":{"bgpSettings":{"name":"bgpSettings","type":"\u001bazure.subscription.networkService.bgpSettings","title":"BGP settings advertised by the on-premises VPN device, if BGP is configured","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Local network gateway etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fqdn":{"name":"fqdn","type":"\u0007","is_mandatory":true,"title":"FQDN of the on-premises VPN device (alternative to `gatewayIpAddress`)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"gatewayIpAddress":{"name":"gatewayIpAddress","type":"\u0007","is_mandatory":true,"title":"IP address of the on-premises VPN device","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Local network gateway ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"localNetworkAddressSpacePrefixes":{"name":"localNetworkAddressSpacePrefixes","type":"\u0019\u0007","is_mandatory":true,"title":"Address prefixes (CIDR notation) describing the on-premises network reachable through this gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Local network gateway location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Local network gateway name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the local network gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceGuid":{"name":"resourceGuid","type":"\u0007","is_mandatory":true,"title":"Resource GUID assigned to the local network gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Local network gateway tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Local network gateway resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure local network gateway","desc":"Local network gateway, the Azure resource that represents an on-premises network endpoint paired with a virtual network gateway to form a site-to-site VPN. Surfaces the on-premises device IP (`gatewayIpAddress`) or `fqdn`, the address prefixes that describe the on-premises network (`localNetworkAddressSpacePrefixes`), and any configured BGP settings (`bgpSettings`) used to exchange routes with Azure. Use alongside `azure.subscription.networkService.virtualNetworkGateway` and `virtualNetworkGateway.connections` to audit the full site-to-site VPN topology.","min_provider_version":"13.10.2","defaults":"id name location gatewayIpAddress","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.natGateway":{"id":"azure.subscription.networkService.natGateway","name":"azure.subscription.networkService.natGateway","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"NAT Gateway etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"NAT Gateway ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"NAT Gateway location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"NAT Gateway name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nat64Enabled":{"name":"nat64Enabled","type":"\u0004","is_mandatory":true,"title":"Whether NAT64 translation is enabled for the NAT Gateway","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"NAT Gateway properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddresses":{"name":"publicIpAddresses","type":"\u0019\u001bazure.subscription.networkService.ipAddress","title":"List of public IP addresses the NAT Gateway is associated with","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnets":{"name":"subnets","type":"\u0019\u001bazure.subscription.networkService.subnet","title":"List of subnets the NAT Gateway is associated with","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"NAT Gateway tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"NAT Gateway type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"NAT Gateway availability zones","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure NAT gateway","desc":"NAT gateway that provides outbound SNAT for resources in one or more subnets. Surfaces the SKU and zone placement, the configured idle-timeout, the public IP addresses and prefixes allocated for outbound translation, the subnets currently consuming the gateway, and the resource GUID.","min_provider_version":"9.0.8","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.networkManager":{"id":"azure.subscription.networkService.networkManager","name":"azure.subscription.networkService.networkManager","fields":{"connectivityConfiguration":{"name":"connectivityConfiguration","type":"\u001bazure.subscription.networkService.networkManager.connectivityConfiguration","title":"Network manager connectivity configuration","desc":"A configuration that builds hub-and-spoke or mesh connectivity across the virtual networks in the targeted network groups. Surfaces the connectivity topology, whether the mesh is global, whether existing peerings are removed, the hub resources, and the network groups it applies to. Select by the configuration's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"connectivityConfigurations":{"name":"connectivityConfigurations","type":"\u0019\u001bazure.subscription.networkService.networkManager.connectivityConfiguration","title":"Connectivity configurations defined in the manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Network manager etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Network manager ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Network manager location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Network manager name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkGroup":{"name":"networkGroup","type":"\u001bazure.subscription.networkService.networkManager.networkGroup","title":"Network manager network group","desc":"A named collection of virtual networks or subnets that network manager configurations target as a unit. Surfaces the group's member type and description. Select by the group's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"networkGroups":{"name":"networkGroups","type":"\u0019\u001bazure.subscription.networkService.networkManager.networkGroup","title":"Network groups defined in the manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceGuid":{"name":"resourceGuid","type":"\u0007","is_mandatory":true,"title":"Resource GUID of the manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scopeAccesses":{"name":"scopeAccesses","type":"\u0019\u0007","is_mandatory":true,"title":"Configuration types the manager may apply (SecurityAdmin, Connectivity, Routing)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scopeManagementGroups":{"name":"scopeManagementGroups","type":"\u0019\u0007","is_mandatory":true,"title":"Management groups in the manager's scope","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scopeSubscriptions":{"name":"scopeSubscriptions","type":"\u0019\u0007","is_mandatory":true,"title":"Subscriptions in the manager's scope","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityAdminConfiguration":{"name":"securityAdminConfiguration","type":"\u001bazure.subscription.networkService.networkManager.securityAdminConfiguration","title":"Network manager security admin configuration","desc":"A configuration that groups the security admin rule collections a network manager enforces. Its rules override network security group rules on the virtual networks in the targeted network groups. Surfaces the intent-policy services the configuration applies on and its rule collections. Select by the configuration's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"securityAdminConfigurations":{"name":"securityAdminConfigurations","type":"\u0019\u001bazure.subscription.networkService.networkManager.securityAdminConfiguration","title":"Security admin configurations defined in the manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Network manager tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Network manager resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual Network Manager","desc":"A management scope that applies security admin rules and connectivity configurations across many virtual networks at once. Its security admin rules take precedence over network security group rules, so this is where a tenant's enforced network posture is defined. Surfaces the manager's scope (subscriptions and management groups), the configuration types it is allowed to apply, the network groups it targets, and its security-admin and connectivity configurations. Select by the manager's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.networkManager.connectivityConfiguration":{"id":"azure.subscription.networkService.networkManager.connectivityConfiguration","name":"azure.subscription.networkService.networkManager.connectivityConfiguration","fields":{"appliesToGroups":{"name":"appliesToGroups","type":"\u0019\u001bazure.subscription.networkService.networkManager.networkGroup","title":"Network groups the configuration applies to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectivityTopology":{"name":"connectivityTopology","type":"\u0007","is_mandatory":true,"title":"Connectivity topology (HubAndSpoke, Mesh)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deleteExistingPeering":{"name":"deleteExistingPeering","type":"\u0004","is_mandatory":true,"title":"Whether existing peerings are removed when the configuration is applied","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Connectivity configuration etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hubs":{"name":"hubs","type":"\u0019\n","is_mandatory":true,"title":"Hub resources in the topology; each entry carries resourceId and resourceType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connectivity configuration ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isGlobal":{"name":"isGlobal","type":"\u0004","is_mandatory":true,"title":"Whether the mesh connectivity is global across regions","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connectivity configuration name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Connectivity configuration resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network manager connectivity configuration","desc":"A configuration that builds hub-and-spoke or mesh connectivity across the virtual networks in the targeted network groups. Surfaces the connectivity topology, whether the mesh is global, whether existing peerings are removed, the hub resources, and the network groups it applies to. Select by the configuration's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.networkManager.networkGroup":{"id":"azure.subscription.networkService.networkManager.networkGroup","name":"azure.subscription.networkService.networkManager.networkGroup","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Network group etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Network group ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"memberType":{"name":"memberType","type":"\u0007","is_mandatory":true,"title":"Type of member the group contains (VirtualNetwork, Subnet)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Network group name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceGuid":{"name":"resourceGuid","type":"\u0007","is_mandatory":true,"title":"Resource GUID of the group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"staticMember":{"name":"staticMember","type":"\u001bazure.subscription.networkService.networkManager.networkGroup.staticMember","title":"Network manager network group static member","desc":"A resource explicitly added to a network group, as opposed to one matched by an Azure Policy membership rule. Names the member resource (a virtual network, or a subnet when the group's member type is Subnet) and the region it lives in. Static membership determines which virtual networks a manager's connectivity and security admin configurations actually apply to. Select by the member's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"staticMembers":{"name":"staticMembers","type":"\u0019\u001bazure.subscription.networkService.networkManager.networkGroup.staticMember","title":"Statically-defined members of the group","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Network group resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network manager network group","desc":"A named collection of virtual networks or subnets that network manager configurations target as a unit. Surfaces the group's member type and description. Select by the group's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"id name memberType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.networkManager.networkGroup.staticMember":{"id":"azure.subscription.networkService.networkManager.networkGroup.staticMember","name":"azure.subscription.networkService.networkManager.networkGroup.staticMember","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Static member resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Static member name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"region":{"name":"region","type":"\u0007","is_mandatory":true,"title":"Region the member resource lives in","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceId":{"name":"resourceId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the member resource (a virtual network or a subnet)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetwork":{"name":"virtualNetwork","type":"\u001bazure.subscription.networkService.virtualNetwork","title":"The member virtual network, when the group's member type is VirtualNetwork","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network manager network group static member","desc":"A resource explicitly added to a network group, as opposed to one matched by an Azure Policy membership rule. Names the member resource (a virtual network, or a subnet when the group's member type is Subnet) and the region it lives in. Static membership determines which virtual networks a manager's connectivity and security admin configurations actually apply to. Select by the member's Azure resource ID.","private":true,"min_provider_version":"13.32.1","defaults":"name region","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.networkManager.securityAdminConfiguration":{"id":"azure.subscription.networkService.networkManager.securityAdminConfiguration","name":"azure.subscription.networkService.networkManager.securityAdminConfiguration","fields":{"applyOnNetworkIntentPolicyBasedServices":{"name":"applyOnNetworkIntentPolicyBasedServices","type":"\u0019\u0007","is_mandatory":true,"title":"Network intent policy based services the configuration applies on (for example All, None)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Security admin configuration etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Security admin configuration ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Security admin configuration name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ruleCollection":{"name":"ruleCollection","type":"\u001bazure.subscription.networkService.networkManager.securityAdminConfiguration.ruleCollection","title":"Network manager admin rule collection","desc":"A priority-ordered set of security admin rules within a security admin configuration, applied to one or more network groups. Surfaces the network groups the collection applies to and the admin rules it holds. Select by the collection's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"ruleCollections":{"name":"ruleCollections","type":"\u0019\u001bazure.subscription.networkService.networkManager.securityAdminConfiguration.ruleCollection","title":"Rule collections in the configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Security admin configuration resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network manager security admin configuration","desc":"A configuration that groups the security admin rule collections a network manager enforces. Its rules override network security group rules on the virtual networks in the targeted network groups. Surfaces the intent-policy services the configuration applies on and its rule collections. Select by the configuration's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.networkManager.securityAdminConfiguration.ruleCollection":{"id":"azure.subscription.networkService.networkManager.securityAdminConfiguration.ruleCollection","name":"azure.subscription.networkService.networkManager.securityAdminConfiguration.ruleCollection","fields":{"appliesToGroups":{"name":"appliesToGroups","type":"\u0019\u001bazure.subscription.networkService.networkManager.networkGroup","title":"Network groups the collection applies to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the collection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Rule collection etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule collection ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule collection name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the collection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rule":{"name":"rule","type":"\u001bazure.subscription.networkService.networkManager.securityAdminConfiguration.ruleCollection.rule","title":"Network manager security admin rule","desc":"A single security admin rule that allows or denies traffic, taking precedence over network security group rules. Surfaces the access (Allow, Deny, AlwaysAllow), direction, priority, protocol, and the source and destination address prefixes and port ranges. Select by the rule's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"rules":{"name":"rules","type":"\u0019\u001bazure.subscription.networkService.networkManager.securityAdminConfiguration.ruleCollection.rule","title":"Admin rules in the collection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Rule collection resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network manager admin rule collection","desc":"A priority-ordered set of security admin rules within a security admin configuration, applied to one or more network groups. Surfaces the network groups the collection applies to and the admin rules it holds. Select by the collection's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.networkManager.securityAdminConfiguration.ruleCollection.rule":{"id":"azure.subscription.networkService.networkManager.securityAdminConfiguration.ruleCollection.rule","name":"azure.subscription.networkService.networkManager.securityAdminConfiguration.ruleCollection.rule","fields":{"access":{"name":"access","type":"\u0007","is_mandatory":true,"title":"Access applied to matching traffic (Allow, Deny, AlwaysAllow)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"destinationPortRanges":{"name":"destinationPortRanges","type":"\u0019\u0007","is_mandatory":true,"title":"Destination port ranges the rule matches","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"destinations":{"name":"destinations","type":"\u0019\n","is_mandatory":true,"title":"Destination address prefixes; each entry carries addressPrefix and addressPrefixType (IPPrefix, ServiceTag, NetworkGroup)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"direction":{"name":"direction","type":"\u0007","is_mandatory":true,"title":"Direction the rule matches (Inbound, Outbound)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Rule etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Whether the rule is Custom or Default","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Evaluation priority of the rule; lower numbers are evaluated first","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Network protocol the rule applies to (Tcp, Udp, Icmp, Esp, Ah, Any)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourcePortRanges":{"name":"sourcePortRanges","type":"\u0019\u0007","is_mandatory":true,"title":"Source port ranges the rule matches","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sources":{"name":"sources","type":"\u0019\n","is_mandatory":true,"title":"Source address prefixes; each entry carries addressPrefix and addressPrefixType (IPPrefix, ServiceTag, NetworkGroup)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Rule resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network manager security admin rule","desc":"A single security admin rule that allows or denies traffic, taking precedence over network security group rules. Surfaces the access (Allow, Deny, AlwaysAllow), direction, priority, protocol, and the source and destination address prefixes and port ranges. Select by the rule's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"name access direction priority","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.outboundRule":{"id":"azure.subscription.networkService.outboundRule","name":"azure.subscription.networkService.outboundRule","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Outbound rule etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Outbound rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Outbound rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Outbound rule properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Outbound rule type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network outbound rule","private":true,"min_provider_version":"9.0.8","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.privateEndpoint":{"id":"azure.subscription.networkService.privateEndpoint","name":"azure.subscription.networkService.privateEndpoint","fields":{"billingSku":{"name":"billingSku","type":"\u0007","is_mandatory":true,"title":"Billing SKU of the private endpoint (\"Fixed\" or \"PayAsYouGo\")","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"customNetworkInterfaceName":{"name":"customNetworkInterfaceName","type":"\u0007","is_mandatory":true,"title":"Custom name of the network interface attached to the private endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Private endpoint ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Private endpoint location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"manualPrivateLinkServiceConnections":{"name":"manualPrivateLinkServiceConnections","type":"\u0019\u001bazure.subscription.networkService.privateEndpoint.serviceconnection","is_mandatory":true,"title":"Manually approved private link service connections","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Private endpoint name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkInterfaces":{"name":"networkInterfaces","type":"\u0019\u001bazure.subscription.networkService.interface","title":"Network interfaces automatically created for the private endpoint","desc":"Resolves the interfaces that hold the endpoint's private IPs so their effective security rules and routes can be examined, connecting the private-access path to the network filtering applied at the endpoint.","min_provider_version":"13.26.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateDnsZoneGroups":{"name":"privateDnsZoneGroups","type":"\u0019\n","title":"Private DNS zone groups attached to this PE (each entry: { name, privateDnsZoneIds, recordSets })","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateLinkServiceConnections":{"name":"privateLinkServiceConnections","type":"\u0019\u001bazure.subscription.networkService.privateEndpoint.serviceconnection","is_mandatory":true,"title":"Private link service connections","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the private endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceconnection":{"name":"serviceconnection","type":"\u001bazure.subscription.networkService.privateEndpoint.serviceconnection","title":"Azure network private endpoint service connection","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet the private endpoint's network interface is allocated in; null when the endpoint has no subnet","desc":"Resolves the subnet hosting the private endpoint so its network security group, route table, address space, and virtual network can be examined. This is the network location from which the linked resource is privately reachable, completing a private-access path from a virtual network to the resource behind the endpoint.","min_provider_version":"13.26.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnetId":{"name":"subnetId","type":"\u0007","is_mandatory":true,"title":"Subnet ID from which the private IP is allocated","desc":"Deprecated in favor of subnet.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Private endpoint tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Private endpoint type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network private endpoint","private":true,"min_provider_version":"11.4.28","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.privateEndpoint.serviceconnection":{"id":"azure.subscription.networkService.privateEndpoint.serviceconnection","name":"azure.subscription.networkService.privateEndpoint.serviceconnection","fields":{"connectionStatus":{"name":"connectionStatus","type":"\u0007","is_mandatory":true,"title":"Connection status (\"Approved\", \"Pending\", \"Rejected\", \"Disconnected\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"groupIds":{"name":"groupIds","type":"\u0019\u0007","is_mandatory":true,"title":"Group IDs obtained from the remote resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connection ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateLinkService":{"name":"privateLinkService","type":"\u001bazure.subscription.networkService.privateLinkService","title":"Private link service being connected to","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateLinkServiceId":{"name":"privateLinkServiceId","type":"\u0007","is_mandatory":true,"title":"Raw private link service resource ID","desc":"Deprecated in favor of `privateLinkService()`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"requestMessage":{"name":"requestMessage","type":"\u0007","is_mandatory":true,"title":"Message passed to the service owner with this connection request","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network private endpoint service connection","private":true,"min_provider_version":"11.4.28","defaults":"name privateLinkServiceId","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.privateLinkService":{"id":"azure.subscription.networkService.privateLinkService","name":"azure.subscription.networkService.privateLinkService","fields":{"accessMode":{"name":"accessMode","type":"\u0007","is_mandatory":true,"title":"Access mode (\"Default\" allows any subscription to connect; \"Restricted\" limits to the visibility list)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"alias":{"name":"alias","type":"\u0007","is_mandatory":true,"title":"Globally unique alias used by consumers in other tenants to reference this service","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"autoApprovalSubscriptions":{"name":"autoApprovalSubscriptions","type":"\u0019\u0007","is_mandatory":true,"title":"Subscription IDs whose connection requests are auto-approved","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"destinationIPAddress":{"name":"destinationIPAddress","type":"\u0007","is_mandatory":true,"title":"Destination IP address for traffic exiting the service","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableProxyProtocol":{"name":"enableProxyProtocol","type":"\u0004","is_mandatory":true,"title":"Whether proxy protocol is enabled (forwards consumer source IP to the service)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Private Link service etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fqdns":{"name":"fqdns","type":"\u0019\u0007","is_mandatory":true,"title":"FQDNs the Private Link service answers to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Private Link service ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipConfigurations":{"name":"ipConfigurations","type":"\u0019\n","is_mandatory":true,"title":"IP configurations associated with the Private Link service","desc":"Each entry: { id, name, primary, privateIPAddress, privateIPAddressVersion, privateIPAllocationMethod, subnetId, provisioningState }.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"loadBalancerFrontendIpConfigurationIds":{"name":"loadBalancerFrontendIpConfigurationIds","type":"\u0019\u0007","is_mandatory":true,"title":"Resource IDs of load balancer frontend IP configurations the service is fronted by","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Private Link service location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Private Link service name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkInterfaceIds":{"name":"networkInterfaceIds","type":"\u0019\u0007","is_mandatory":true,"title":"Resource IDs of network interfaces auto-created for this Private Link service","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnection":{"name":"privateEndpointConnection","type":"\u001bazure.subscription.networkService.privateLinkService.privateEndpointConnection","title":"Endpoint connection to a Private Link service (provider's view of an incoming consumer request)","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.networkService.privateLinkService.privateEndpointConnection","title":"Endpoint connections to this Private Link service","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state (\"Succeeded\", \"Updating\", \"Deleting\", \"Failed\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Private Link service tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Private Link service resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"visibilitySubscriptions":{"name":"visibilitySubscriptions","type":"\u0019\u0007","is_mandatory":true,"title":"Subscription IDs allowed to see (and connect to) this service","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Private Link service (provider-side resource that exposes a service via Private Link)","private":true,"min_provider_version":"13.9.3","defaults":"id name location alias","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.privateLinkService.privateEndpointConnection":{"id":"azure.subscription.networkService.privateLinkService.privateEndpointConnection","name":"azure.subscription.networkService.privateLinkService.privateEndpointConnection","fields":{"actionsRequired":{"name":"actionsRequired","type":"\u0007","is_mandatory":true,"title":"Required actions on the consumer side","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionDescription":{"name":"connectionDescription","type":"\u0007","is_mandatory":true,"title":"Description of the connection state (reason for approval/rejection)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionStatus":{"name":"connectionStatus","type":"\u0007","is_mandatory":true,"title":"Connection status (\"Approved\", \"Pending\", \"Rejected\", \"Disconnected\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Connection etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connection ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"linkIdentifier":{"name":"linkIdentifier","type":"\u0007","is_mandatory":true,"title":"Consumer link identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpoint":{"name":"privateEndpoint","type":"\u001bazure.subscription.networkService.privateEndpoint","title":"Consumer's private endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointId":{"name":"privateEndpointId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the consumer's private endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointLocation":{"name":"privateEndpointLocation","type":"\u0007","is_mandatory":true,"title":"Location of the consumer private endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the endpoint connection (\"Succeeded\", \"Updating\", \"Deleting\", \"Failed\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Connection resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Endpoint connection to a Private Link service (provider's view of an incoming consumer request)","private":true,"min_provider_version":"13.9.3","defaults":"id name connectionStatus","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.probe":{"id":"azure.subscription.networkService.probe","name":"azure.subscription.networkService.probe","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Probe etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Probe ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Probe name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Probe properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Probe type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network probe","private":true,"min_provider_version":"9.0.8","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.publicIpPrefix":{"id":"azure.subscription.networkService.publicIpPrefix","name":"azure.subscription.networkService.publicIpPrefix","fields":{"customIpPrefix":{"name":"customIpPrefix","type":"\u001bazure.subscription.networkService.customIpPrefix","title":"Custom IP prefix (BYOIP) the range is drawn from","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Public IP prefix etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Public IP prefix ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipPrefix":{"name":"ipPrefix","type":"\u0007","is_mandatory":true,"title":"Allocated address prefix in CIDR notation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipTags":{"name":"ipTags","type":"\u0019\n","is_mandatory":true,"title":"IP tags applied to the prefix; each entry carries ipTagType and tag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipVersion":{"name":"ipVersion","type":"\u0007","is_mandatory":true,"title":"IP version of the prefix (IPv4, IPv6)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Public IP prefix location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Public IP prefix name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"prefixLength":{"name":"prefixLength","type":"\u0005","is_mandatory":true,"title":"Length of the prefix (for example 28 for a /28)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the prefix","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceGuid":{"name":"resourceGuid","type":"\u0007","is_mandatory":true,"title":"Resource GUID of the prefix","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"SKU name of the prefix","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuTier":{"name":"skuTier","type":"\u0007","is_mandatory":true,"title":"SKU tier of the prefix (Regional, Global)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Public IP prefix tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Public IP prefix resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zones":{"name":"zones","type":"\u0019\u0007","is_mandatory":true,"title":"Availability zones the prefix is allocated in","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure public IP prefix","desc":"A reserved contiguous range of static public IP addresses that individual public IPs are allocated from. Surfaces the prefix length and allocated prefix, the IP version, the SKU, IP tags, and the custom IP prefix (BYOIP) the range is drawn from. Select by the prefix's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.route":{"id":"azure.subscription.networkService.route","name":"azure.subscription.networkService.route","fields":{"addressPrefix":{"name":"addressPrefix","type":"\u0007","is_mandatory":true,"title":"Destination CIDR to which the route applies","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ecmpNextHopIpAddresses":{"name":"ecmpNextHopIpAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"ECMP next-hop IP addresses (set only when nextHopType is \"VirtualApplianceEcmp\")","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hasBgpOverride":{"name":"hasBgpOverride","type":"\u0004","is_mandatory":true,"title":"Whether this route overrides overlapping BGP routes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Route ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Route name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nextHopIpAddress":{"name":"nextHopIpAddress","type":"\u0007","is_mandatory":true,"title":"IP address packets should be forwarded to (only for VirtualAppliance)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nextHopType":{"name":"nextHopType","type":"\u0007","is_mandatory":true,"title":"Type of Azure hop (\"Internet\", \"None\", \"VirtualAppliance\", \"VirtualNetworkGateway\", \"VnetLocal\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the route","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network route","private":true,"min_provider_version":"11.4.28","defaults":"name addressPrefix nextHopType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.routeFilter":{"id":"azure.subscription.networkService.routeFilter","name":"azure.subscription.networkService.routeFilter","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Route filter etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Route filter ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Route filter location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Route filter name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the filter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rule":{"name":"rule","type":"\u001bazure.subscription.networkService.routeFilter.rule","title":"Route filter rule","desc":"A single rule within a route filter that allows or denies a set of BGP community values on ExpressRoute Microsoft peering. Select by the rule's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"rules":{"name":"rules","type":"\u0019\u001bazure.subscription.networkService.routeFilter.rule","title":"Rules that allow or deny BGP community values","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Route filter tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Route filter resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure route filter","desc":"A filter that controls which ExpressRoute BGP community route advertisements are accepted, used with Microsoft peering. Surfaces the filter rules that allow or deny specific BGP community values. Select by the filter's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.routeFilter.rule":{"id":"azure.subscription.networkService.routeFilter.rule","name":"azure.subscription.networkService.routeFilter.rule","fields":{"access":{"name":"access","type":"\u0007","is_mandatory":true,"title":"Access type applied to matching routes (Allow, Deny)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"communities":{"name":"communities","type":"\u0019\u0007","is_mandatory":true,"title":"BGP community values the rule matches, for example 12076:5010","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Rule etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Rule location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ruleType":{"name":"ruleType","type":"\u0007","is_mandatory":true,"title":"Rule type (Community)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Route filter rule","desc":"A single rule within a route filter that allows or denies a set of BGP community values on ExpressRoute Microsoft peering. Select by the rule's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"name access","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.routeTable":{"id":"azure.subscription.networkService.routeTable","name":"azure.subscription.networkService.routeTable","fields":{"disableBgpRoutePropagation":{"name":"disableBgpRoutePropagation","type":"\u0004","is_mandatory":true,"title":"Whether to disable routes learned by BGP on this route table","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Route table etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Route table ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Route table location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Route table name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the route table","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"routes":{"name":"routes","type":"\u0019\u001bazure.subscription.networkService.route","is_mandatory":true,"title":"Routes contained in the route table","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Route table tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Route table type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network route table","private":true,"min_provider_version":"11.4.28","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.securityGroup":{"id":"azure.subscription.networkService.securityGroup","name":"azure.subscription.networkService.securityGroup","fields":{"defaultSecurityRules":{"name":"defaultSecurityRules","type":"\u0019\u001bazure.subscription.networkService.securityrule","title":"Security group default security rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Security group etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"flowLog":{"name":"flowLog","type":"\u001bazure.subscription.networkService.watcher.flowlog","title":"Network Watcher flow log that targets this security group","desc":"Resolves the flow log whose target resource is this network security group, exposing whether flow logging is enabled and its retention policy. Null when no flow log targets the NSG. Use this to verify NSG flow logs are enabled with adequate retention without traversing every Network Watcher.","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Security group ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"interfaces":{"name":"interfaces","type":"\u0019\u001bazure.subscription.networkService.interface","title":"Network interfaces this NSG is attached to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Security group location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Security group name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Security group properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityRules":{"name":"securityRules","type":"\u0019\u001bazure.subscription.networkService.securityrule","title":"Security group rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnets":{"name":"subnets","type":"\u0019\u001bazure.subscription.networkService.subnet","title":"Subnets this NSG is attached to","min_provider_version":"13.11.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Security group tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Security group type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network security group","private":true,"min_provider_version":"9.0.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.securityPerimeter":{"id":"azure.subscription.networkService.securityPerimeter","name":"azure.subscription.networkService.securityPerimeter","fields":{"accessRule":{"name":"accessRule","type":"\u001bazure.subscription.networkService.securityPerimeter.accessRule","title":"Network security perimeter access rule","desc":"A single inbound or outbound rule within a perimeter profile. Inbound rules admit traffic by source address prefix, service tag, or subscription; outbound rules permit traffic to fully qualified domain names. The direction selects which fields apply. Select by the rule's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"association":{"name":"association","type":"\u001bazure.subscription.networkService.securityPerimeter.association","title":"Network security perimeter resource association","desc":"The binding that places a single PaaS resource inside a network security perimeter under a chosen profile. Surfaces the access mode enforced on the resource, whether the association has provisioning issues, the profile the resource is bound to, and the ID of the associated PaaS resource. Select by the association's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"associations":{"name":"associations","type":"\u0019\u001bazure.subscription.networkService.securityPerimeter.association","title":"Resource associations placing PaaS resources inside the perimeter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Network security perimeter ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Network security perimeter location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Network security perimeter name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"perimeterGuid":{"name":"perimeterGuid","type":"\u0007","is_mandatory":true,"title":"Globally unique identifier assigned to the perimeter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"profile":{"name":"profile","type":"\u001bazure.subscription.networkService.securityPerimeter.profile","title":"Network security perimeter profile","desc":"A named set of access rules within a network security perimeter. Resources are associated with a profile to inherit its inbound and outbound rules. Surfaces the access-rule and diagnostic-settings version counters and the inbound and outbound access rules the profile enforces.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"profiles":{"name":"profiles","type":"\u0019\u001bazure.subscription.networkService.securityPerimeter.profile","title":"Profiles that group the access rules applied to associated resources","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the perimeter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Network security perimeter tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Network security perimeter resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Network Security Perimeter","desc":"A logical isolation boundary that lets PaaS resources such as storage accounts and key vaults communicate inside an explicit perimeter while controlling traffic that crosses it. Surfaces the perimeter GUID and provisioning state, the profiles that group inbound and outbound access rules, and the resource associations that place PaaS resources inside the perimeter along with the access mode enforced on each. Select by the perimeter's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.securityPerimeter.accessRule":{"id":"azure.subscription.networkService.securityPerimeter.accessRule","name":"azure.subscription.networkService.securityPerimeter.accessRule","fields":{"addressPrefixes":{"name":"addressPrefixes","type":"\u0019\u0007","is_mandatory":true,"title":"Inbound source address prefixes in IPv4 or IPv6 CIDR notation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"direction":{"name":"direction","type":"\u0007","is_mandatory":true,"title":"Direction the rule governs: Inbound or Outbound","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"emailAddresses":{"name":"emailAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Outbound email addresses (currently unavailable for use by Azure)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fullyQualifiedDomainNames":{"name":"fullyQualifiedDomainNames","type":"\u0019\u0007","is_mandatory":true,"title":"Outbound destination fully qualified domain names","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Access rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Access rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the access rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceTags":{"name":"serviceTags","type":"\u0019\u0007","is_mandatory":true,"title":"Inbound service tags admitted through the perimeter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptions":{"name":"subscriptions","type":"\u0019\u0007","is_mandatory":true,"title":"Inbound subscription IDs admitted through the perimeter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Access rule resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network security perimeter access rule","desc":"A single inbound or outbound rule within a perimeter profile. Inbound rules admit traffic by source address prefix, service tag, or subscription; outbound rules permit traffic to fully qualified domain names. The direction selects which fields apply. Select by the rule's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"name direction","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.securityPerimeter.association":{"id":"azure.subscription.networkService.securityPerimeter.association","name":"azure.subscription.networkService.securityPerimeter.association","fields":{"accessMode":{"name":"accessMode","type":"\u0007","is_mandatory":true,"title":"Access mode enforced on the associated resource: Learning, Enforced, or Audit","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hasProvisioningIssues":{"name":"hasProvisioningIssues","type":"\u0007","is_mandatory":true,"title":"Whether the association currently reports provisioning issues","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Association ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Association name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"profile":{"name":"profile","type":"\u001bazure.subscription.networkService.securityPerimeter.profile","title":"Profile the associated resource is bound to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the association","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceId":{"name":"resourceId","type":"\u0007","is_mandatory":true,"title":"ARM ID of the PaaS resource placed inside the perimeter","desc":"The associated resource can be any PaaS type (storage account, key vault, SQL server, and others), so it is kept as the raw ARM ID rather than a single typed accessor.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Association resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network security perimeter resource association","desc":"The binding that places a single PaaS resource inside a network security perimeter under a chosen profile. Surfaces the access mode enforced on the resource, whether the association has provisioning issues, the profile the resource is bound to, and the ID of the associated PaaS resource. Select by the association's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"name accessMode","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.securityPerimeter.profile":{"id":"azure.subscription.networkService.securityPerimeter.profile","name":"azure.subscription.networkService.securityPerimeter.profile","fields":{"accessRules":{"name":"accessRules","type":"\u0019\u001bazure.subscription.networkService.securityPerimeter.accessRule","title":"Inbound and outbound access rules the profile enforces","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"accessRulesVersion":{"name":"accessRulesVersion","type":"\u0007","is_mandatory":true,"title":"Version counter that increases with every access-rule change in the profile","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettingsVersion":{"name":"diagnosticSettingsVersion","type":"\u0007","is_mandatory":true,"title":"Version counter that increases with every diagnostic-settings change in the profile","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Profile ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Profile name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Profile resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network security perimeter profile","desc":"A named set of access rules within a network security perimeter. Resources are associated with a profile to inherit its inbound and outbound rules. Surfaces the access-rule and diagnostic-settings version counters and the inbound and outbound access rules the profile enforces.","private":true,"min_provider_version":"13.25.1","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.securityrule":{"id":"azure.subscription.networkService.securityrule","name":"azure.subscription.networkService.securityrule","fields":{"access":{"name":"access","type":"\u0007","is_mandatory":true,"title":"Security rule access (Allow or Deny)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Security rule description","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"destinationAddressPrefix":{"name":"destinationAddressPrefix","type":"\u0007","is_mandatory":true,"title":"Security rule destination address prefix (CIDR or *)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"destinationAddressPrefixes":{"name":"destinationAddressPrefixes","type":"\u0019\u0007","is_mandatory":true,"title":"Security rule destination address prefixes (list form; empty when only `destinationAddressPrefix` is set)","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"destinationApplicationSecurityGroups":{"name":"destinationApplicationSecurityGroups","type":"\u0019\u001bazure.subscription.networkService.appSecurityGroup","title":"Application security groups the rule targets as destination","min_provider_version":"13.11.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"destinationPortRange":{"name":"destinationPortRange","type":"\u0019\n","is_mandatory":true,"title":"Security rule destination port range","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"destinationPortRanges":{"name":"destinationPortRanges","type":"\u0019\u0007","is_mandatory":true,"title":"Security rule destination port ranges (raw list form preserving CIDR-style entries; empty when only `destinationPortRange` is set)","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"direction":{"name":"direction","type":"\u0007","is_mandatory":true,"title":"Security rule direction (outbound or inbound)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Security rule etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Security rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Security rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Security rule priority (100-4096, lower is higher priority)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Security rule properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Security rule protocol (Tcp, Udp, Icmp, Esp, Ah, or *)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the rule (e.g., \"Succeeded\", \"Failed\", \"Updating\")","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceAddressPrefix":{"name":"sourceAddressPrefix","type":"\u0007","is_mandatory":true,"title":"Security rule source address prefix (CIDR or *)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceAddressPrefixes":{"name":"sourceAddressPrefixes","type":"\u0019\u0007","is_mandatory":true,"title":"Security rule source address prefixes (list form; empty when only `sourceAddressPrefix` is set)","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceApplicationSecurityGroups":{"name":"sourceApplicationSecurityGroups","type":"\u0019\u001bazure.subscription.networkService.appSecurityGroup","title":"Application security groups the rule sources traffic from","min_provider_version":"13.11.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourcePortRange":{"name":"sourcePortRange","type":"\u0007","is_mandatory":true,"title":"Security rule source port range","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourcePortRanges":{"name":"sourcePortRanges","type":"\u0019\u0007","is_mandatory":true,"title":"Security rule source port ranges (list form; empty when only `sourcePortRange` is set)","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network security rule","private":true,"min_provider_version":"9.0.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.serviceEndpointPolicy":{"id":"azure.subscription.networkService.serviceEndpointPolicy","name":"azure.subscription.networkService.serviceEndpointPolicy","fields":{"definition":{"name":"definition","type":"\u001bazure.subscription.networkService.serviceEndpointPolicy.definition","title":"Azure service endpoint policy definition","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"definitions":{"name":"definitions","type":"\u0019\u001bazure.subscription.networkService.serviceEndpointPolicy.definition","is_mandatory":true,"title":"Policy definitions restricting which resources are accessible","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Service endpoint policy etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Service endpoint policy ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Service endpoint policy kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Service endpoint policy location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Service endpoint policy name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceAlias":{"name":"serviceAlias","type":"\u0007","is_mandatory":true,"title":"Service alias the policy applies to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnets":{"name":"subnets","type":"\u0019\u001bazure.subscription.networkService.subnet","title":"Subnets associated with the policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Service endpoint policy tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Service endpoint policy type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure service endpoint policy","desc":"Service-endpoint policy that restricts which Azure service resources can be reached from a subnet using service endpoints. Surfaces the policy's service-endpoint-policy definitions (the allowed Azure resource IDs), the contextual service alias, the subnets the policy is applied to, and the resource GUID.","min_provider_version":"13.3.3","defaults":"name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.serviceEndpointPolicy.definition":{"id":"azure.subscription.networkService.serviceEndpointPolicy.definition","name":"azure.subscription.networkService.serviceEndpointPolicy.definition","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description (max 140 chars)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Service endpoint policy definition etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Service endpoint policy definition ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Service endpoint policy definition name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"service":{"name":"service","type":"\u0007","is_mandatory":true,"title":"Service endpoint name (e.g. \"Microsoft.Storage\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceResources":{"name":"serviceResources","type":"\u0019\u0007","is_mandatory":true,"title":"List of service resources allowed by this definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Service endpoint policy definition type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure service endpoint policy definition","private":true,"min_provider_version":"13.3.3","defaults":"name service","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.subnet":{"id":"azure.subscription.networkService.subnet","name":"azure.subscription.networkService.subnet","fields":{"addressPrefix":{"name":"addressPrefix","type":"\u0007","is_mandatory":true,"title":"Subnet address prefix","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"addressPrefixes":{"name":"addressPrefixes","type":"\u0019\u0007","is_mandatory":true,"title":"Subnet address prefixes (list form; populated when the subnet has multiple prefixes, e.g., dual-stack IPv4+IPv6)","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultOutboundAccess":{"name":"defaultOutboundAccess","type":"\u0004","is_mandatory":true,"title":"Whether default outbound access is enabled for VMs in the subnet","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"delegation":{"name":"delegation","type":"\u001bazure.subscription.networkService.subnet.delegation","title":"Azure subnet service delegation","desc":"Single service delegation on a subnet. Delegations grant a PaaS service (for example, Azure Container Instances or App Service VNet integration) permission to inject managed resources directly into the subnet. Audit queries flag unexpected delegations such as a production application subnet delegated to a service it should not host.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"delegations":{"name":"delegations","type":"\u0019\u001bazure.subscription.networkService.subnet.delegation","is_mandatory":true,"title":"Service delegations configured on the subnet (e.g., Microsoft.ContainerInstance/containerGroups)","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Subnet etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Subnet ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipAllocations":{"name":"ipAllocations","type":"\u0019\u001bazure.subscription.networkService.ipAllocation","title":"IP allocations reserving address space in the subnet","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipConfigurations":{"name":"ipConfigurations","type":"\u0019\u001bazure.subscription.networkService.virtualNetworkGateway.ipConfig","title":"List of IP configurations for the subnet","min_provider_version":"9.0.10","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Subnet name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"natGateway":{"name":"natGateway","type":"\u001bazure.subscription.networkService.natGateway","title":"The NAT gateway this subnet is associated with, if any","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkSecurityGroup":{"name":"networkSecurityGroup","type":"\u001bazure.subscription.networkService.securityGroup","title":"Network Security Group attached to the subnet; null when no NSG is associated","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointNetworkPolicies":{"name":"privateEndpointNetworkPolicies","type":"\u0007","is_mandatory":true,"title":"Whether network policies are applied to private endpoints in the subnet","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpoints":{"name":"privateEndpoints","type":"\u0019\u001bazure.subscription.networkService.privateEndpoint","title":"Private endpoints deployed in the subnet","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateLinkServiceNetworkPolicies":{"name":"privateLinkServiceNetworkPolicies","type":"\u0007","is_mandatory":true,"title":"Whether network policies are applied to private link services in the subnet","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Subnet properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"routeTable":{"name":"routeTable","type":"\u001bazure.subscription.networkService.routeTable","title":"Route table attached to the subnet; null when no route table is associated","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceEndpoint":{"name":"serviceEndpoint","type":"\u001bazure.subscription.networkService.subnet.serviceEndpoint","title":"Azure subnet service endpoint","desc":"Single service endpoint configured on a subnet. Service endpoints route traffic from the subnet to a PaaS service over the Azure backbone instead of the public internet, scoped to the service and optionally to specific locations. Audit queries typically look for unexpected services (e.g., a database subnet with `Microsoft.Storage` enabled) or endpoints whose `provisioningState` has fallen out of `Succeeded`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"serviceEndpoints":{"name":"serviceEndpoints","type":"\u0019\u001bazure.subscription.networkService.subnet.serviceEndpoint","is_mandatory":true,"title":"Service endpoints configured on the subnet (e.g., Microsoft.Storage, Microsoft.Sql, Microsoft.KeyVault)","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Subnet type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetwork":{"name":"virtualNetwork","type":"\u001bazure.subscription.networkService.virtualNetwork","title":"Virtual network the subnet belongs to; null when the subnet ID has no parent virtual network","desc":"Resolves the parent virtual network so its peerings and address space can be traversed, extending a reachability path from the subnet to peered networks that can reach it.","min_provider_version":"13.26.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure VNet subnet","desc":"Subnet inside an Azure Virtual Network. Surfaces the IPv4 and IPv6 address prefixes, the attached network security group and route table, NAT gateway, service endpoints and service-endpoint policies, delegations to PaaS services, the `privateEndpointNetworkPolicies` and `privateLinkServiceNetworkPolicies` flags, and the IP allocation method.","min_provider_version":"9.0.8","defaults":"id name addressPrefix","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.subnet.delegation":{"id":"azure.subscription.networkService.subnet.delegation","name":"azure.subscription.networkService.subnet.delegation","fields":{"actions":{"name":"actions","type":"\u0019\u0007","is_mandatory":true,"title":"Actions delegated to the service (e.g., \"Microsoft.Network/virtualNetworks/subnets/join/action\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Delegation name (the customer-supplied label for the delegation)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the delegation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceName":{"name":"serviceName","type":"\u0007","is_mandatory":true,"title":"Delegated service (e.g., \"Microsoft.ContainerInstance/containerGroups\", \"Microsoft.Web/serverFarms\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure subnet service delegation","desc":"Single service delegation on a subnet. Delegations grant a PaaS service (for example, Azure Container Instances or App Service VNet integration) permission to inject managed resources directly into the subnet. Audit queries flag unexpected delegations such as a production application subnet delegated to a service it should not host.","private":true,"min_provider_version":"13.12.2","defaults":"name serviceName provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.subnet.serviceEndpoint":{"id":"azure.subscription.networkService.subnet.serviceEndpoint","name":"azure.subscription.networkService.subnet.serviceEndpoint","fields":{"locations":{"name":"locations","type":"\u0019\u0007","is_mandatory":true,"title":"Locations the service endpoint is enabled for; empty when scoped to all locations","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the service endpoint (e.g., \"Succeeded\", \"Updating\", \"Failed\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"service":{"name":"service","type":"\u0007","is_mandatory":true,"title":"Service the endpoint routes traffic to (e.g., \"Microsoft.Storage\", \"Microsoft.Sql\", \"Microsoft.KeyVault\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure subnet service endpoint","desc":"Single service endpoint configured on a subnet. Service endpoints route traffic from the subnet to a PaaS service over the Azure backbone instead of the public internet, scoped to the service and optionally to specific locations. Audit queries typically look for unexpected services (e.g., a database subnet with `Microsoft.Storage` enabled) or endpoints whose `provisioningState` has fallen out of `Succeeded`.","private":true,"min_provider_version":"13.12.2","defaults":"service provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.trafficManagerProfile":{"id":"azure.subscription.networkService.trafficManagerProfile","name":"azure.subscription.networkService.trafficManagerProfile","fields":{"allowedEndpointRecordTypes":{"name":"allowedEndpointRecordTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed endpoint record types (e.g., \"DomainName\", \"IPv4Address\", \"IPv6Address\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dnsConfig":{"name":"dnsConfig","type":"\n","is_mandatory":true,"title":"DNS settings: relativeName, ttl, fqdn","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpoint":{"name":"endpoint","type":"\u001bazure.subscription.networkService.trafficManagerProfile.endpoint","title":"Traffic Manager endpoint","desc":"Single endpoint inside a Traffic Manager profile, either an Azure resource (`AzureEndpoints`), an external FQDN/IP (`ExternalEndpoints`), or a child profile (`NestedEndpoints`). Surfaces the `target` or `targetResourceId`, the `status` of the endpoint, `endpointMonitorStatus` (the most recent probe result), `weight` (for Weighted routing), `priority` (for Priority routing), `geoMapping` (for Geographic routing), `subnets` (for Subnet routing), `customHeaders` overrides, `endpointLocation` (for Performance routing), and child-profile thresholds (`minChildEndpoints`, `minChildEndpointsIPv4`, `minChildEndpointsIPv6`). The `alwaysServe` flag indicates that the endpoint should remain in the routing decision even when probes fail.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"endpoints":{"name":"endpoints","type":"\u0019\u001bazure.subscription.networkService.trafficManagerProfile.endpoint","is_mandatory":true,"title":"Endpoints configured on the profile","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Traffic Manager profile ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Traffic Manager profile location (\"global\" for most profiles)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxReturn":{"name":"maxReturn","type":"\u0005","is_mandatory":true,"title":"Maximum number of endpoints returned for MultiValue routing","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"monitorConfig":{"name":"monitorConfig","type":"\n","is_mandatory":true,"title":"Endpoint health monitoring settings: protocol, port, path, intervals, expected status codes, custom headers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Traffic Manager profile name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"profileStatus":{"name":"profileStatus","type":"\u0007","is_mandatory":true,"title":"Profile status","desc":"Deprecated in favor of status, which exposes this as a boolean.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Traffic Manager profile properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0004","is_mandatory":true,"title":"Whether the profile is enabled","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Traffic Manager profile tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trafficRoutingMethod":{"name":"trafficRoutingMethod","type":"\u0007","is_mandatory":true,"title":"Traffic routing method (\"Performance\", \"Weighted\", \"Priority\", \"Geographic\", \"MultiValue\", \"Subnet\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trafficViewEnrollmentStatus":{"name":"trafficViewEnrollmentStatus","type":"\u0007","is_mandatory":true,"title":"Traffic View enrollment status (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Traffic Manager profile resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Traffic Manager profile","desc":"Traffic Manager profile, the DNS-level global load balancer that resolves a single hostname to one of many backends based on a routing method. Surfaces the `trafficRoutingMethod` (Performance, Weighted, Priority, Geographic, MultiValue, Subnet), the `status` of the profile, the `dnsConfig` (relativeName, ttl, fqdn) that controls the resolver-facing record, the `monitorConfig` (protocol, port, path, intervals, expected status codes, custom headers) that governs endpoint probing, and the per-endpoint configuration through [[azure.subscription.networkService.trafficManagerProfile.endpoint]].","min_provider_version":"13.12.2","defaults":"id name location trafficRoutingMethod status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.trafficManagerProfile.endpoint":{"id":"azure.subscription.networkService.trafficManagerProfile.endpoint","name":"azure.subscription.networkService.trafficManagerProfile.endpoint","fields":{"alwaysServe":{"name":"alwaysServe","type":"\u0007","is_mandatory":true,"title":"\"Enabled\" keeps the endpoint in the routing decision even when probes fail","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"customHeaders":{"name":"customHeaders","type":"\u0019\n","is_mandatory":true,"title":"Custom headers sent during health probes (each entry has name, value)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpointLocation":{"name":"endpointLocation","type":"\u0007","is_mandatory":true,"title":"Geographic location of the endpoint (used by Performance routing)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpointMonitorStatus":{"name":"endpointMonitorStatus","type":"\u0007","is_mandatory":true,"title":"Most recent monitor probe result (\"CheckingEndpoint\", \"Online\", \"Degraded\", \"Disabled\", \"Inactive\", \"Stopped\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpointStatus":{"name":"endpointStatus","type":"\u0007","is_mandatory":true,"title":"Endpoint status","desc":"Deprecated in favor of status, which exposes this as a boolean.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"geoMapping":{"name":"geoMapping","type":"\u0019\u0007","is_mandatory":true,"title":"Countries/regions mapped to this endpoint (used by Geographic routing)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Endpoint ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minChildEndpoints":{"name":"minChildEndpoints","type":"\u0005","is_mandatory":true,"title":"Minimum healthy child endpoints required for a NestedEndpoints parent to be considered available","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minChildEndpointsIPv4":{"name":"minChildEndpointsIPv4","type":"\u0005","is_mandatory":true,"title":"Minimum healthy IPv4 (A-record) child endpoints required for a NestedEndpoints parent","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minChildEndpointsIPv6":{"name":"minChildEndpointsIPv6","type":"\u0005","is_mandatory":true,"title":"Minimum healthy IPv6 (AAAA-record) child endpoints required for a NestedEndpoints parent","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Endpoint name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Endpoint priority (1-1000, lower = higher priority), used by Priority routing","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Endpoint properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0004","is_mandatory":true,"title":"Whether the endpoint is enabled","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnets":{"name":"subnets","type":"\u0019\n","is_mandatory":true,"title":"Subnets mapped to this endpoint (used by Subnet routing); each entry has first, last, scope","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"Fully-qualified DNS name or IP of the endpoint (returned in DNS responses)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"targetResourceId":{"name":"targetResourceId","type":"\u0007","is_mandatory":true,"title":"Azure resource ID for endpoints of type AzureEndpoints or NestedEndpoints","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Endpoint resource type (carries the endpoint kind, e.g., \"Microsoft.Network/trafficManagerProfiles/azureEndpoints\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"weight":{"name":"weight","type":"\u0005","is_mandatory":true,"title":"Endpoint weight (1-1000), used by Weighted routing","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Traffic Manager endpoint","desc":"Single endpoint inside a Traffic Manager profile, either an Azure resource (`AzureEndpoints`), an external FQDN/IP (`ExternalEndpoints`), or a child profile (`NestedEndpoints`). Surfaces the `target` or `targetResourceId`, the `status` of the endpoint, `endpointMonitorStatus` (the most recent probe result), `weight` (for Weighted routing), `priority` (for Priority routing), `geoMapping` (for Geographic routing), `subnets` (for Subnet routing), `customHeaders` overrides, `endpointLocation` (for Performance routing), and child-profile thresholds (`minChildEndpoints`, `minChildEndpointsIPv4`, `minChildEndpointsIPv6`). The `alwaysServe` flag indicates that the endpoint should remain in the routing decision even when probes fail.","private":true,"min_provider_version":"13.12.2","defaults":"name type status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualAppliance":{"id":"azure.subscription.networkService.virtualAppliance","name":"azure.subscription.networkService.virtualAppliance","fields":{"addressPrefix":{"name":"addressPrefix","type":"\u0007","is_mandatory":true,"title":"Address prefix assigned to the appliance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"asn":{"name":"asn","type":"\u0005","is_mandatory":true,"title":"BGP ASN of the appliance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bundledScaleUnit":{"name":"bundledScaleUnit","type":"\u0007","is_mandatory":true,"title":"Bundled scale unit sizing the appliance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deploymentType":{"name":"deploymentType","type":"\u0007","is_mandatory":true,"title":"Deployment type (for example PartnerManaged for SaaS appliances)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Virtual appliance etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Virtual appliance ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Virtual appliance location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"marketplaceVersion":{"name":"marketplaceVersion","type":"\u0007","is_mandatory":true,"title":"Marketplace version of the appliance image","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Virtual appliance name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the appliance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sshPublicKey":{"name":"sshPublicKey","type":"\u0007","is_mandatory":true,"title":"Public key used for SSH login to the appliance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Virtual appliance tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Virtual appliance resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vendor":{"name":"vendor","type":"\u0007","is_mandatory":true,"title":"Appliance vendor","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualHub":{"name":"virtualHub","type":"\u001bazure.subscription.networkService.virtualHub","title":"Virtual hub the appliance is deployed in","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure network virtual appliance","desc":"A third-party network virtual appliance (NVA) deployed into a Virtual WAN hub, such as a partner firewall or SD-WAN device. Surfaces the appliance vendor, version and scale unit, its BGP ASN, deployment type, and the virtual hub it runs in. Select by the appliance's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualHub":{"id":"azure.subscription.networkService.virtualHub","name":"azure.subscription.networkService.virtualHub","fields":{"addressPrefix":{"name":"addressPrefix","type":"\u0007","is_mandatory":true,"title":"CIDR carved out for the hub itself","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"allowBranchToBranchTraffic":{"name":"allowBranchToBranchTraffic","type":"\u0004","is_mandatory":true,"title":"Whether branch-to-branch transit is allowed for the underlying VirtualRouter hub","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azureFirewall":{"name":"azureFirewall","type":"\u001bazure.subscription.networkService.firewall","title":"Azure Firewall attached to this hub for Secure Virtual Hub deployments","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Virtual Hub etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hubRoutingPreference":{"name":"hubRoutingPreference","type":"\u0007","is_mandatory":true,"title":"Hub routing preference (\"ExpressRoute\", \"VpnGateway\", \"ASPath\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Virtual Hub ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Hub kind (set to \"RouteServer\" for Route Server deployments; empty for standard hubs)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Virtual Hub location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Virtual Hub name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"preferredRoutingGateway":{"name":"preferredRoutingGateway","type":"\u0007","is_mandatory":true,"title":"Preferred gateway for on-prem traffic (\"ExpressRoute\", \"VpnGateway\", \"None\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Virtual Hub properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"routeTable":{"name":"routeTable","type":"\u001bazure.subscription.networkService.virtualHub.routeTable","title":"Virtual Hub route table","desc":"Route table inside a Virtual Hub, the construct that stores user-defined routes for connections that select this table. Surfaces the `routes` (each with `destinationType`, `destinations`, `nextHopType`, `nextHop`), the `labels` that connections use to associate or propagate to this table, and the read-only `associatedConnections` (connections whose traffic this table routes) and `propagatingConnections` (connections that advertise into this table). Use this to audit east-west and on-prem reachability decisions inside a Secure Virtual Hub.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"routeTables":{"name":"routeTables","type":"\u0019\u001bazure.subscription.networkService.virtualHub.routeTable","title":"Hub route tables defined inside this hub","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"routingState":{"name":"routingState","type":"\u0007","is_mandatory":true,"title":"Current routing state (\"None\", \"Provisioning\", \"Provisioned\", \"Failed\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityProviderName":{"name":"securityProviderName","type":"\u0007","is_mandatory":true,"title":"Security Provider name configured for Secure Virtual Hub deployments","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\u0007","is_mandatory":true,"title":"Hub SKU (\"Standard\" or \"Basic\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Virtual Hub tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualRouterAsn":{"name":"virtualRouterAsn","type":"\u0005","is_mandatory":true,"title":"ASN of the embedded VirtualRouter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualRouterIps":{"name":"virtualRouterIps","type":"\u0019\u0007","is_mandatory":true,"title":"VirtualRouter IP addresses","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualWan":{"name":"virtualWan","type":"\u001bazure.subscription.networkService.virtualWan","title":"The Virtual WAN this hub belongs to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vnetConnection":{"name":"vnetConnection","type":"\u001bazure.subscription.networkService.virtualHub.vnetConnection","title":"Virtual Hub VNet connection","desc":"Connection between a Virtual Hub and a spoke virtual network. Surfaces the `enableInternetSecurity` flag (whether the secured hub firewalls Internet egress for the spoke), the linked `remoteVirtualNetwork()`, the `routingConfiguration` (associated route table, propagated route tables and labels, static routes), and the `provisioningState`. Use this to audit which spokes are firewalled by the hub and which route tables govern their traffic.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"vnetConnections":{"name":"vnetConnections","type":"\u0019\u001bazure.subscription.networkService.virtualHub.vnetConnection","title":"VNet connections attached to this hub","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual Hub","desc":"Virtual Hub, the regional core of a Virtual WAN deployment that provides routing, transit, and gateway hosting. Surfaces the `addressPrefix` CIDR carved out for the hub, the `sku` and `kind` (regular hub or Route Server), the `allowBranchToBranchTraffic` policy, the `hubRoutingPreference` (ExpressRoute / VPN / ASPath), the BGP-router parameters (`virtualRouterAsn`, `virtualRouterIps`), the linked `virtualWan()`, the linked `azureFirewall()` for Secure Virtual Hub deployments, and the routing surfaces through [[azure.subscription.networkService.virtualHub.routeTable]] and [[azure.subscription.networkService.virtualHub.vnetConnection]].","min_provider_version":"13.12.2","defaults":"id name location sku","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualHub.routeTable":{"id":"azure.subscription.networkService.virtualHub.routeTable","name":"azure.subscription.networkService.virtualHub.routeTable","fields":{"associatedConnectionIds":{"name":"associatedConnectionIds","type":"\u0019\u0007","is_mandatory":true,"title":"Resource IDs of connections whose traffic is routed by this table","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Route table etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Route table ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"labels":{"name":"labels","type":"\u0019\u0007","is_mandatory":true,"title":"Labels used by connections to associate or propagate to this route table","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Route table name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"propagatingConnectionIds":{"name":"propagatingConnectionIds","type":"\u0019\u0007","is_mandatory":true,"title":"Resource IDs of connections that advertise into this table","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the route table","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"routes":{"name":"routes","type":"\u0019\n","is_mandatory":true,"title":"Routes contained in the table (each entry has destinationType, destinations, nextHopType, nextHop)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Route table resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Virtual Hub route table","desc":"Route table inside a Virtual Hub, the construct that stores user-defined routes for connections that select this table. Surfaces the `routes` (each with `destinationType`, `destinations`, `nextHopType`, `nextHop`), the `labels` that connections use to associate or propagate to this table, and the read-only `associatedConnections` (connections whose traffic this table routes) and `propagatingConnections` (connections that advertise into this table). Use this to audit east-west and on-prem reachability decisions inside a Secure Virtual Hub.","private":true,"min_provider_version":"13.12.2","defaults":"id name provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualHub.vnetConnection":{"id":"azure.subscription.networkService.virtualHub.vnetConnection","name":"azure.subscription.networkService.virtualHub.vnetConnection","fields":{"enableInternetSecurity":{"name":"enableInternetSecurity","type":"\u0004","is_mandatory":true,"title":"Whether secured-hub Internet-egress filtering is enabled for the spoke","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Connection etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connection ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"remoteVirtualNetwork":{"name":"remoteVirtualNetwork","type":"\u001bazure.subscription.networkService.virtualNetwork","title":"The spoke virtual network this connection attaches to the hub","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"routingConfiguration":{"name":"routingConfiguration","type":"\n","is_mandatory":true,"title":"Routing configuration (associated route table, propagated route tables/labels, static routes)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Virtual Hub VNet connection","desc":"Connection between a Virtual Hub and a spoke virtual network. Surfaces the `enableInternetSecurity` flag (whether the secured hub firewalls Internet egress for the spoke), the linked `remoteVirtualNetwork()`, the `routingConfiguration` (associated route table, propagated route tables and labels, static routes), and the `provisioningState`. Use this to audit which spokes are firewalled by the hub and which route tables govern their traffic.","private":true,"min_provider_version":"13.12.2","defaults":"id name provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualNetwork":{"id":"azure.subscription.networkService.virtualNetwork","name":"azure.subscription.networkService.virtualNetwork","fields":{"addressPrefixes":{"name":"addressPrefixes","type":"\u0019\u0007","is_mandatory":true,"title":"Address space CIDR prefixes for the virtual network","min_provider_version":"13.0.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultNatGateway":{"name":"defaultNatGateway","type":"\u001bazure.subscription.networkService.natGateway","title":"Default public NAT gateway providing outbound SNAT for subnets that do not have their own NAT gateway","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dhcpOptions":{"name":"dhcpOptions","type":"\u001bazure.subscription.networkService.virtualNetwork.dhcpOptions","is_mandatory":true,"title":"Virtual Network DHCP options","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableDdosProtection":{"name":"enableDdosProtection","type":"\u0004","is_mandatory":true,"title":"Whether DDoS protection is enabled for all the protected resources in the virtual network","min_provider_version":"9.0.10","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableVmProtection":{"name":"enableVmProtection","type":"\u0004","is_mandatory":true,"title":"Whether VM protection is enabled for all the subnets in the virtual network","min_provider_version":"9.0.10","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionEnabled":{"name":"encryptionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether encryption is enabled on the virtual network","min_provider_version":"13.0.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionEnforcement":{"name":"encryptionEnforcement","type":"\u0007","is_mandatory":true,"title":"Encryption enforcement policy: AllowUnencrypted, DropUnencrypted","min_provider_version":"13.0.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Virtual Network etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"flowLogs":{"name":"flowLogs","type":"\u0019\u001bazure.subscription.networkService.watcher.flowlog","title":"Flow logs that target this virtual network","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"flowTimeoutInMinutes":{"name":"flowTimeoutInMinutes","type":"\u0005","is_mandatory":true,"title":"FlowTimeout value in minutes for the virtual network","min_provider_version":"13.0.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Virtual Network ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Virtual Network location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Virtual Network name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peering":{"name":"peering","type":"\u001bazure.subscription.networkService.virtualNetwork.peering","title":"Azure VNet peering","desc":"Peering between two Azure Virtual Networks. Surfaces the peering state (Initiated, Connected, Disconnected), the remote virtual network reference, allow-virtual-network-access / allow-forwarded-traffic / allow-gateway-transit / use-remote-gateways flags, the remote address space, the peering sync level (FullyInSync vs LocalAndRemoteNotInSync), the `peeringSyncLevel`, and the `doNotVerifyRemoteGateways` setting.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"peerings":{"name":"peerings","type":"\u0019\u001bazure.subscription.networkService.virtualNetwork.peering","title":"List of virtual network peerings","min_provider_version":"13.0.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Virtual Network properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"The provisioning state of the virtual network: Succeeded, Updating, Deleting, Failed, Creating, Canceled","min_provider_version":"13.0.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnets":{"name":"subnets","type":"\u0019\u001bazure.subscription.networkService.subnet","is_mandatory":true,"title":"List of subnets within the virtual network","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Virtual Network tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Virtual Network type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual Network (VNet)","desc":"Azure Virtual Network and its connectivity surface. Surfaces the IPv4 and IPv6 address spaces, configured DNS servers, the linked DDoS protection plan, encryption settings, BGP communities, the `enableVmProtection` and `enableDdosProtection` flags, the `subnets()` defined inside the VNet, and the `peerings()` to other virtual networks.","min_provider_version":"9.0.8","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualNetwork.dhcpOptions":{"id":"azure.subscription.networkService.virtualNetwork.dhcpOptions","name":"azure.subscription.networkService.virtualNetwork.dhcpOptions","fields":{"dnsServers":{"name":"dnsServers","type":"\u0019\u0007","is_mandatory":true,"title":"The DNS servers, used by the virtual network","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"DHCP options ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual Network (VNet) DHCP options","private":true,"min_provider_version":"9.0.10","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualNetwork.peering":{"id":"azure.subscription.networkService.virtualNetwork.peering","name":"azure.subscription.networkService.virtualNetwork.peering","fields":{"allowForwardedTraffic":{"name":"allowForwardedTraffic","type":"\u0004","is_mandatory":true,"title":"Whether forwarded traffic from VMs in the local vnet is allowed in the remote vnet","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"allowGatewayTransit":{"name":"allowGatewayTransit","type":"\u0004","is_mandatory":true,"title":"Whether gateway links can be used in remote virtual networking to link to this vnet","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"allowVirtualNetworkAccess":{"name":"allowVirtualNetworkAccess","type":"\u0004","is_mandatory":true,"title":"Whether VMs in the local vnet can access VMs in the remote vnet","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Peering resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Peering name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peeringState":{"name":"peeringState","type":"\u0007","is_mandatory":true,"title":"The status of the virtual network peering: Connected, Disconnected, Initiated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"peeringSyncLevel":{"name":"peeringSyncLevel","type":"\u0007","is_mandatory":true,"title":"The peering sync status: FullyInSync, LocalNotInSync, RemoteNotInSync, LocalAndRemoteNotInSync","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"The provisioning state: Succeeded, Updating, Deleting, Failed, Creating, Canceled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"remoteVirtualNetwork":{"name":"remoteVirtualNetwork","type":"\u001bazure.subscription.networkService.virtualNetwork","title":"The peered remote virtual network","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"remoteVirtualNetworkEncryptionEnabled":{"name":"remoteVirtualNetworkEncryptionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether traffic between the two VNets is encrypted (Azure global VNet peering encryption)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"remoteVirtualNetworkEncryptionEnforcement":{"name":"remoteVirtualNetworkEncryptionEnforcement","type":"\u0007","is_mandatory":true,"title":"Encryption enforcement for the remote VNet (\"AllowUnencrypted\" or \"DropUnencrypted\")","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"remoteVirtualNetworkId":{"name":"remoteVirtualNetworkId","type":"\u0007","is_mandatory":true,"title":"The remote virtual network reference ID","desc":"Deprecated in favor of remoteVirtualNetwork.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"useRemoteGateways":{"name":"useRemoteGateways","type":"\u0004","is_mandatory":true,"title":"Whether remote gateways can be used on this virtual network","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure VNet peering","desc":"Peering between two Azure Virtual Networks. Surfaces the peering state (Initiated, Connected, Disconnected), the remote virtual network reference, allow-virtual-network-access / allow-forwarded-traffic / allow-gateway-transit / use-remote-gateways flags, the remote address space, the peering sync level (FullyInSync vs LocalAndRemoteNotInSync), the `peeringSyncLevel`, and the `doNotVerifyRemoteGateways` setting.","min_provider_version":"13.0.2","defaults":"id name peeringState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualNetworkGateway":{"id":"azure.subscription.networkService.virtualNetworkGateway","name":"azure.subscription.networkService.virtualNetworkGateway","fields":{"aadAudience":{"name":"aadAudience","type":"\u0007","is_mandatory":true,"title":"Microsoft Entra audience (application ID) used for Entra-based point-to-site authentication","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"aadIssuer":{"name":"aadIssuer","type":"\u0007","is_mandatory":true,"title":"Microsoft Entra issuer used for Entra-based point-to-site authentication","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"aadTenant":{"name":"aadTenant","type":"\u0007","is_mandatory":true,"title":"Microsoft Entra tenant URL used for Entra-based point-to-site authentication","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the virtual network gateway is active","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"addressPrefixes":{"name":"addressPrefixes","type":"\u0019\u0007","is_mandatory":true,"title":"A list of address blocks reserved for this virtual network in CIDR notation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bgpSettings":{"name":"bgpSettings","type":"\u001bazure.subscription.networkService.bgpSettings","title":"VNet gateway BGP settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connection":{"name":"connection","type":"\u001bazure.subscription.networkService.virtualNetworkGateway.connection","title":"Azure Virtual Network (VNet) gateway connection","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"connections":{"name":"connections","type":"\u0019\u001bazure.subscription.networkService.virtualNetworkGateway.connection","title":"Applicable connections for the gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableIPSecReplayProtection":{"name":"disableIPSecReplayProtection","type":"\u0004","is_mandatory":true,"title":"Whether IP sec replay protection is disabled for this VNet gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableBgp":{"name":"enableBgp","type":"\u0004","is_mandatory":true,"title":"Whether BGP is enabled for this virtual network gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableBgpRouteTranslationForNat":{"name":"enableBgpRouteTranslationForNat","type":"\u0004","is_mandatory":true,"title":"Whether BGP route translation is enabled for this VNet gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableDNSForwarding":{"name":"enableDNSForwarding","type":"\u0004","is_mandatory":true,"title":"Whether DNS forwarding is enabled for this VNet gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablePrivateIPAddress":{"name":"enablePrivateIPAddress","type":"\u0004","is_mandatory":true,"title":"Whether private IP must be enabled for connections","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"VNet gateway etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"gatewayDefaultSite":{"name":"gatewayDefaultSite","type":"\u001bazure.subscription.networkService.localNetworkGateway","title":"The local network gateway used as the default site for forced tunneling, if configured","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"gatewayType":{"name":"gatewayType","type":"\u0007","is_mandatory":true,"title":"VNet gateway type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"VNet gateway ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"inboundDNSForwardingEndpoint":{"name":"inboundDNSForwardingEndpoint","type":"\u0007","is_mandatory":true,"title":"The IP address allocated by the gateway to which DNS requests can be sent","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipConfig":{"name":"ipConfig","type":"\u001bazure.subscription.networkService.virtualNetworkGateway.ipConfig","title":"Azure Virtual Network (VNet) gateway IP configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"ipConfigurations":{"name":"ipConfigurations","type":"\u0019\u001bazure.subscription.networkService.virtualNetworkGateway.ipConfig","title":"VNet gateway IP configurations","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"VNet gateway location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"VNet gateway name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"natRule":{"name":"natRule","type":"\u001bazure.subscription.networkService.virtualNetworkGateway.natRule","title":"Azure Virtual Network (VNet) gateway NAT rule","desc":"A single NAT rule on a VPN gateway, used to translate overlapping on-premises and Azure address spaces so a site-to-site tunnel can be established between networks that share a CIDR. Surfaces the NAT direction in mode (\"EgressSnat\" or \"IngressSnat\"), the allocation natRuleType (\"Static\" or \"Dynamic\"), the address-space and port-range mappings in internalMappings and externalMappings, and the gateway IP configuration the rule is bound to.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"natRules":{"name":"natRules","type":"\u0019\u001bazure.subscription.networkService.virtualNetworkGateway.natRule","title":"VNet gateway NAT rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"VNet gateway properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"VNet gateway provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"radiusAuthenticationConfigured":{"name":"radiusAuthenticationConfigured","type":"\u0004","is_mandatory":true,"title":"Whether RADIUS authentication is configured for point-to-site clients; the RADIUS shared secret is never returned","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuCapacity":{"name":"skuCapacity","type":"\u0005","is_mandatory":true,"title":"VNet gateway SKU capacity","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"VNet gateway SKU name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"VNet gateway tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"VNet gateway resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vpnClientAddressPool":{"name":"vpnClientAddressPool","type":"\u0019\u0007","is_mandatory":true,"title":"Address pool (CIDRs) assigned to point-to-site VPN clients","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vpnClientAuthenticationTypes":{"name":"vpnClientAuthenticationTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Point-to-site client authentication types enabled (\"AAD\", \"Certificate\", \"Radius\"); empty when P2S is not configured","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vpnClientConfiguration":{"name":"vpnClientConfiguration","type":"\n","is_mandatory":true,"title":"VPN client configuration, set only when P2S is configured","desc":"Deprecated in favor of vpnClientAuthenticationTypes, vpnClientAddressPool, aadTenant, aadAudience, aadIssuer, and radiusAuthenticationConfigured.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"vpnClientIpsecPolicies":{"name":"vpnClientIpsecPolicies","type":"\u0019\u001bazure.subscription.networkService.virtualNetworkGateway.connection.ipsecPolicy","title":"Custom IPsec/IKE policies negotiated for point-to-site VPN clients","desc":"Custom cryptographic policies applied to point-to-site client connections, each surfacing the key-exchange and data-channel algorithms, Diffie-Hellman groups, and security-association lifetimes. Empty when the gateway has no point-to-site configuration or uses Azure default cryptography.","min_provider_version":"13.29.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vpnGatewayGeneration":{"name":"vpnGatewayGeneration","type":"\u0007","is_mandatory":true,"title":"VNet gateway generation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vpnType":{"name":"vpnType","type":"\u0007","is_mandatory":true,"title":"VNet gateway VPN type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure VPN/ExpressRoute gateway","desc":"Virtual network gateway used for VPN, ExpressRoute, or LocalGateway connectivity. Surfaces the gateway type, VPN type (RouteBased or PolicyBased), generation, SKU, IP configuration, BGP settings (ASN, peering address), VPN client configuration (address pool, root and revoked certificates, RADIUS server), the active-active flag, and any associated VPN connections and disaster-recovery settings.","min_provider_version":"9.0.8","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualNetworkGateway.connection":{"id":"azure.subscription.networkService.virtualNetworkGateway.connection","name":"azure.subscription.networkService.virtualNetworkGateway.connection","fields":{"connectionMode":{"name":"connectionMode","type":"\u0007","is_mandatory":true,"title":"Connection mode (one of: \"Default\", \"InitiatorOnly\", \"ResponderOnly\")","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionProtocol":{"name":"connectionProtocol","type":"\u0007","is_mandatory":true,"title":"Connection protocol (one of: \"IKEv1\", \"IKEv2\")","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionStatus":{"name":"connectionStatus","type":"\u0007","is_mandatory":true,"title":"Current connection status (one of: \"Unknown\", \"Connecting\", \"Connected\", \"NotConnected\")","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionType":{"name":"connectionType","type":"\u0007","is_mandatory":true,"title":"Connection type (one of: \"IPsec\", \"Vnet2Vnet\", \"ExpressRoute\", \"VPNClient\")","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dpdTimeoutSeconds":{"name":"dpdTimeoutSeconds","type":"\u0005","is_mandatory":true,"title":"Dead-peer-detection timeout, in seconds","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"egressBytesTransferred":{"name":"egressBytesTransferred","type":"\u0005","is_mandatory":true,"title":"Total egress bytes transferred over this connection","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableBgp":{"name":"enableBgp","type":"\u0004","is_mandatory":true,"title":"Whether BGP is enabled for this connection","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"VNet gateway Connection etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"VNet gateway connection ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ingressBytesTransferred":{"name":"ingressBytesTransferred","type":"\u0005","is_mandatory":true,"title":"Total ingress bytes transferred over this connection","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipsecPolicies":{"name":"ipsecPolicies","type":"\u0019\u001bazure.subscription.networkService.virtualNetworkGateway.connection.ipsecPolicy","title":"Custom IPsec/IKE cryptographic policies negotiated for this connection; empty when the connection uses Azure defaults","min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipsecPolicy":{"name":"ipsecPolicy","type":"\u001bazure.subscription.networkService.virtualNetworkGateway.connection.ipsecPolicy","title":"IPsec/IKE policy of a virtual network gateway","desc":"Custom IPsec/IKE cryptographic policy applied to a virtual network gateway. This covers both site-to-site connection policies (from `virtualNetworkGateway.connections.ipsecPolicies`) and point-to-site client policies (from `virtualNetworkGateway.vpnClientIpsecPolicies`). Surfaces the key-exchange and data-channel algorithms, `ikeEncryption` and `ikeIntegrity` for IKE, `ipsecEncryption` and `ipsecIntegrity` for IPsec, together with the `dhGroup` and `pfsGroup` Diffie-Hellman groups and the security-association lifetime (`saLifeTimeSeconds`) and payload size (`saDataSizeKilobytes`). Use it to assert that tunnels negotiate strong cryptographic parameters.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"localNetworkGateway2":{"name":"localNetworkGateway2","type":"\u001bazure.subscription.networkService.localNetworkGateway","title":"The local network gateway peered to the primary VNet gateway (only set for IPsec connections)","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"VNet gateway Connection location","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"VNet gateway Connection name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"VNet gateway Connection properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the connection","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"routingConfiguration":{"name":"routingConfiguration","type":"\n","is_mandatory":true,"title":"Associated and propagated route tables governing routing for this connection","min_provider_version":"13.25.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"routingWeight":{"name":"routingWeight","type":"\u0005","is_mandatory":true,"title":"Routing weight applied to this connection","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"VNet gateway Connection type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"useLocalAzureIpAddress":{"name":"useLocalAzureIpAddress","type":"\u0004","is_mandatory":true,"title":"Whether the connection uses a private local Azure IP","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"usePolicyBasedTrafficSelectors":{"name":"usePolicyBasedTrafficSelectors","type":"\u0004","is_mandatory":true,"title":"Whether policy-based traffic selectors are enabled","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkGateway2":{"name":"virtualNetworkGateway2","type":"\u001bazure.subscription.networkService.virtualNetworkGateway","title":"The peer virtual network gateway (only set for Vnet2Vnet connections)","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual Network (VNet) gateway connection","private":true,"min_provider_version":"9.0.8","defaults":"id name connectionType connectionStatus","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualNetworkGateway.connection.ipsecPolicy":{"id":"azure.subscription.networkService.virtualNetworkGateway.connection.ipsecPolicy","name":"azure.subscription.networkService.virtualNetworkGateway.connection.ipsecPolicy","fields":{"dhGroup":{"name":"dhGroup","type":"\u0007","is_mandatory":true,"title":"Diffie-Hellman group used in the key-exchange negotiation","desc":"One of: \"None\", \"DHGroup1\", \"DHGroup2\", \"DHGroup14\", \"DHGroup24\", \"DHGroup2048\", \"ECP256\", \"ECP384\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy ID (connection ID + positional index; not stable if policy ordering changes server-side)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ikeEncryption":{"name":"ikeEncryption","type":"\u0007","is_mandatory":true,"title":"IKE encryption algorithm for the key-exchange negotiation (one of: \"DES\", \"DES3\", \"AES128\", \"AES192\", \"AES256\", \"GCMAES128\", \"GCMAES256\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ikeIntegrity":{"name":"ikeIntegrity","type":"\u0007","is_mandatory":true,"title":"IKE integrity algorithm for the key-exchange negotiation (one of: \"MD5\", \"SHA1\", \"SHA256\", \"SHA384\", \"GCMAES128\", \"GCMAES256\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipsecEncryption":{"name":"ipsecEncryption","type":"\u0007","is_mandatory":true,"title":"IPsec encryption algorithm for the data channel","desc":"One of: \"None\", \"DES\", \"DES3\", \"AES128\", \"AES192\", \"AES256\", \"GCMAES128\", \"GCMAES192\", \"GCMAES256\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipsecIntegrity":{"name":"ipsecIntegrity","type":"\u0007","is_mandatory":true,"title":"IPsec integrity algorithm for the data channel (one of: \"MD5\", \"SHA1\", \"SHA256\", \"GCMAES128\", \"GCMAES192\", \"GCMAES256\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"pfsGroup":{"name":"pfsGroup","type":"\u0007","is_mandatory":true,"title":"Diffie-Hellman group used for perfect forward secrecy in the data channel","desc":"One of: \"None\", \"PFS1\", \"PFS2\", \"PFS14\", \"PFS24\", \"PFS2048\", \"PFSMM\", \"ECP256\", \"ECP384\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"saDataSizeKilobytes":{"name":"saDataSizeKilobytes","type":"\u0005","is_mandatory":true,"title":"IPsec security association payload size, in kilobytes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"saLifeTimeSeconds":{"name":"saLifeTimeSeconds","type":"\u0005","is_mandatory":true,"title":"IPsec security association lifetime, in seconds","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"IPsec/IKE policy of a virtual network gateway","desc":"Custom IPsec/IKE cryptographic policy applied to a virtual network gateway. This covers both site-to-site connection policies (from `virtualNetworkGateway.connections.ipsecPolicies`) and point-to-site client policies (from `virtualNetworkGateway.vpnClientIpsecPolicies`). Surfaces the key-exchange and data-channel algorithms, `ikeEncryption` and `ikeIntegrity` for IKE, `ipsecEncryption` and `ipsecIntegrity` for IPsec, together with the `dhGroup` and `pfsGroup` Diffie-Hellman groups and the security-association lifetime (`saLifeTimeSeconds`) and payload size (`saDataSizeKilobytes`). Use it to assert that tunnels negotiate strong cryptographic parameters.","private":true,"min_provider_version":"13.11.3","defaults":"ikeEncryption ipsecEncryption dhGroup pfsGroup","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualNetworkGateway.ipConfig":{"id":"azure.subscription.networkService.virtualNetworkGateway.ipConfig","name":"azure.subscription.networkService.virtualNetworkGateway.ipConfig","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"VNet gateway IP Configuration etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"VNet gateway IP Configuration ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"VNet gateway IP Configuration name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateIpAddress":{"name":"privateIpAddress","type":"\u0007","is_mandatory":true,"title":"VNet gateway IP Configuration private IP address","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"VNet gateway IP Configuration properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicIpAddress":{"name":"publicIpAddress","type":"\u001bazure.subscription.networkService.ipAddress","title":"The public IP address, associated with this IP configuration","min_provider_version":"9.0.10","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual Network (VNet) gateway IP configuration","private":true,"min_provider_version":"9.0.8","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualNetworkGateway.natRule":{"id":"azure.subscription.networkService.virtualNetworkGateway.natRule","name":"azure.subscription.networkService.virtualNetworkGateway.natRule","fields":{"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"VNet gateway NAT rule etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"externalMappings":{"name":"externalMappings","type":"\u0019\n","is_mandatory":true,"title":"Address spaces and port ranges the internal mappings are translated to","desc":"Each entry has an `addressSpace` CIDR and an optional `portRange`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"VNet gateway NAT rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"internalMappings":{"name":"internalMappings","type":"\u0019\n","is_mandatory":true,"title":"Private address spaces and port ranges translated on the internal side","desc":"Each entry has an `addressSpace` CIDR and an optional `portRange`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipConfigurationId":{"name":"ipConfigurationId","type":"\u0007","is_mandatory":true,"title":"Gateway IP configuration this NAT rule applies to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Source NAT direction","desc":"One of EgressSnat (translates the Azure address space on the way out) or IngressSnat (translates the on-premises address space on the way in).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"VNet gateway NAT rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"natRuleType":{"name":"natRuleType","type":"\u0007","is_mandatory":true,"title":"NAT rule allocation type","desc":"One of Static (a one-to-one address mapping) or Dynamic (addresses are allocated from the pool as connections are established).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw NAT rule properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the NAT rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual Network (VNet) gateway NAT rule","desc":"A single NAT rule on a VPN gateway, used to translate overlapping on-premises and Azure address spaces so a site-to-site tunnel can be established between networks that share a CIDR. Surfaces the NAT direction in mode (\"EgressSnat\" or \"IngressSnat\"), the allocation natRuleType (\"Static\" or \"Dynamic\"), the address-space and port-range mappings in internalMappings and externalMappings, and the gateway IP configuration the rule is bound to.","private":true,"min_provider_version":"13.33.3","defaults":"name mode natRuleType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualNetworkTap":{"id":"azure.subscription.networkService.virtualNetworkTap","name":"azure.subscription.networkService.virtualNetworkTap","fields":{"destinationPort":{"name":"destinationPort","type":"\u0005","is_mandatory":true,"title":"VXLAN destination port that receives the tapped traffic","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Virtual network tap etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Virtual network tap ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Virtual network tap location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Virtual network tap name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the tap","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceGuid":{"name":"resourceGuid","type":"\u0007","is_mandatory":true,"title":"Resource GUID of the tap","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Virtual network tap tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Virtual network tap resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure virtual network tap","desc":"A traffic-mirroring configuration that copies the traffic of tapped network interface IP configurations to a collector destination. Surfaces the VXLAN destination port and provisioning state. Select by the tap's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualRouter":{"id":"azure.subscription.networkService.virtualRouter","name":"azure.subscription.networkService.virtualRouter","fields":{"asn":{"name":"asn","type":"\u0005","is_mandatory":true,"title":"BGP ASN of the router","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Virtual router etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostedSubnet":{"name":"hostedSubnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet the router is hosted on","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Virtual router ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ips":{"name":"ips","type":"\u0019\u0007","is_mandatory":true,"title":"Router IP addresses","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Virtual router location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Virtual router name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the router","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Virtual router tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Virtual router resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure virtual router","desc":"A BGP-capable virtual router hosted on a subnet or gateway that exchanges routes with peered network virtual appliances. Surfaces the router ASN, its router IPs, and the subnet it is hosted on. Select by the router's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.virtualWan":{"id":"azure.subscription.networkService.virtualWan","name":"azure.subscription.networkService.virtualWan","fields":{"allowBranchToBranchTraffic":{"name":"allowBranchToBranchTraffic","type":"\u0004","is_mandatory":true,"title":"Whether branch-to-branch traffic is allowed through the WAN","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"allowVnetToVnetTraffic":{"name":"allowVnetToVnetTraffic","type":"\u0004","is_mandatory":true,"title":"Whether VNet-to-VNet traffic is allowed through the WAN","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableVpnEncryption":{"name":"disableVpnEncryption","type":"\u0004","is_mandatory":true,"title":"Whether VPN encryption is disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Virtual WAN etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Virtual WAN ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Virtual WAN location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Virtual WAN name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"office365LocalBreakoutCategory":{"name":"office365LocalBreakoutCategory","type":"\u0007","is_mandatory":true,"title":"Office 365 local breakout category (\"Optimize\", \"OptimizeAndAllow\", \"All\", \"None\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Virtual WAN properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Virtual WAN tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualHubs":{"name":"virtualHubs","type":"\u0019\u001bazure.subscription.networkService.virtualHub","title":"Virtual Hubs that belong to this Virtual WAN","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualWanType":{"name":"virtualWanType","type":"\u0007","is_mandatory":true,"title":"Virtual WAN type (\"Standard\" or \"Basic\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vpnSites":{"name":"vpnSites","type":"\u0019\u001bazure.subscription.networkService.vpnSite","title":"VPN sites that belong to this Virtual WAN","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual WAN","desc":"Virtual WAN, the global transit-network construct that stitches together Virtual Hubs across regions, on-premises sites, and ExpressRoute circuits. Surfaces the `allowBranchToBranchTraffic` and `allowVnetToVnetTraffic` permissions, the `disableVpnEncryption` flag, the `office365LocalBreakoutCategory` for Office 365 traffic, the `virtualWanType` (\"Standard\" or \"Basic\"), and the `provisioningState`. The hubs that belong to the WAN are reachable through [[azure.subscription.networkService.virtualHub]] filtered by `virtualWan.id`.","min_provider_version":"13.12.2","defaults":"id name location virtualWanType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.vpnGateway":{"id":"azure.subscription.networkService.vpnGateway","name":"azure.subscription.networkService.vpnGateway","fields":{"bgpRouteTranslationForNatEnabled":{"name":"bgpRouteTranslationForNatEnabled","type":"\u0004","is_mandatory":true,"title":"Whether BGP route translation for NAT is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bgpSettings":{"name":"bgpSettings","type":"\u001bazure.subscription.networkService.bgpSettings","title":"BGP speaker settings for the gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connection":{"name":"connection","type":"\u001bazure.subscription.networkService.vpnGateway.connection","title":"Virtual WAN VPN gateway connection","desc":"A single site-to-site connection between a Virtual WAN VPN gateway and an on-premises VPN site. Surfaces the connection status, negotiated bandwidth and byte counters, BGP and internet-security flags, and the VPN site it connects to. Select by the connection's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"connections":{"name":"connections","type":"\u0019\u001bazure.subscription.networkService.vpnGateway.connection","title":"VPN connections terminated by the gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"VPN gateway etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"VPN gateway ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"VPN gateway location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"VPN gateway name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"routingPreferenceInternet":{"name":"routingPreferenceInternet","type":"\u0004","is_mandatory":true,"title":"Whether the public IP interface uses the internet routing preference","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scaleUnit":{"name":"scaleUnit","type":"\u0005","is_mandatory":true,"title":"Scale unit (throughput/capacity) of the gateway","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"VPN gateway tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"VPN gateway resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualHub":{"name":"virtualHub","type":"\u001bazure.subscription.networkService.virtualHub","title":"Virtual hub the gateway is deployed in","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual WAN VPN gateway","desc":"A site-to-site VPN gateway deployed inside a Virtual WAN hub that terminates IPsec tunnels from on-premises VPN sites. Surfaces the scale unit, BGP and NAT settings, the virtual hub it belongs to, and the individual VPN connections it terminates. Select by the gateway's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.vpnGateway.connection":{"id":"azure.subscription.networkService.vpnGateway.connection","name":"azure.subscription.networkService.vpnGateway.connection","fields":{"bandwidthMbps":{"name":"bandwidthMbps","type":"\u0005","is_mandatory":true,"title":"Expected bandwidth in Mbps","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bgpEnabled":{"name":"bgpEnabled","type":"\u0004","is_mandatory":true,"title":"Whether BGP is enabled on the connection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionStatus":{"name":"connectionStatus","type":"\u0007","is_mandatory":true,"title":"Connection status (Connected, Connecting, NotConnected, Unknown)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"egressBytesTransferred":{"name":"egressBytesTransferred","type":"\u0005","is_mandatory":true,"title":"Total egress bytes transferred over the connection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Connection etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connection ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ingressBytesTransferred":{"name":"ingressBytesTransferred","type":"\u0005","is_mandatory":true,"title":"Total ingress bytes transferred over the connection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"internetSecurityEnabled":{"name":"internetSecurityEnabled","type":"\u0004","is_mandatory":true,"title":"Whether internet security is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Tunnel protocol used by the connection (IKEv1, IKEv2)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"remoteVpnSite":{"name":"remoteVpnSite","type":"\u001bazure.subscription.networkService.vpnSite","title":"On-premises VPN site the connection terminates","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"routingWeight":{"name":"routingWeight","type":"\u0005","is_mandatory":true,"title":"Routing weight of the connection","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Virtual WAN VPN gateway connection","desc":"A single site-to-site connection between a Virtual WAN VPN gateway and an on-premises VPN site. Surfaces the connection status, negotiated bandwidth and byte counters, BGP and internet-security flags, and the VPN site it connects to. Select by the connection's Azure resource ID.","private":true,"min_provider_version":"13.25.1","defaults":"name connectionStatus","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.vpnServerConfiguration":{"id":"azure.subscription.networkService.vpnServerConfiguration","name":"azure.subscription.networkService.vpnServerConfiguration","fields":{"authenticationTypes":{"name":"authenticationTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Accepted client authentication types (Certificate, Radius, AAD)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"VPN server configuration etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"VPN server configuration ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"VPN server configuration location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"VPN server configuration name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"radiusServerAddress":{"name":"radiusServerAddress","type":"\u0007","is_mandatory":true,"title":"RADIUS server address used for point-to-site client authentication","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"VPN server configuration tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"VPN server configuration resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vpnProtocols":{"name":"vpnProtocols","type":"\u0019\u0007","is_mandatory":true,"title":"Tunneling protocols offered to clients (IkeV2, OpenVPN)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure point-to-site VPN server configuration","desc":"A reusable point-to-site VPN server configuration that P2S gateways reference to authenticate and tunnel remote client connections. Surfaces the enabled tunneling protocols, the accepted authentication types, and the RADIUS server address used for client authentication. Select by the configuration's Azure resource ID.","min_provider_version":"13.25.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.vpnSite":{"id":"azure.subscription.networkService.vpnSite","name":"azure.subscription.networkService.vpnSite","fields":{"addressPrefixes":{"name":"addressPrefixes","type":"\u0019\u0007","is_mandatory":true,"title":"CIDRs advertised by the branch","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bgpAsn":{"name":"bgpAsn","type":"\u0005","is_mandatory":true,"title":"BGP ASN announced by the branch","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bgpPeerWeight":{"name":"bgpPeerWeight","type":"\u0005","is_mandatory":true,"title":"BGP peer weight applied to routes received from this branch","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"bgpPeeringAddress":{"name":"bgpPeeringAddress","type":"\u0007","is_mandatory":true,"title":"BGP peering address used by the branch","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deviceModel":{"name":"deviceModel","type":"\u0007","is_mandatory":true,"title":"Device model reported for the branch hardware","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deviceVendor":{"name":"deviceVendor","type":"\u0007","is_mandatory":true,"title":"Device vendor reported for the branch hardware","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"VPN site etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"VPN site ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipAddress":{"name":"ipAddress","type":"\u0007","is_mandatory":true,"title":"Public IP the Virtual WAN VPN gateway peers with","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isSecuritySite":{"name":"isSecuritySite","type":"\u0004","is_mandatory":true,"title":"Whether the site is registered as a security-partner site","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"linkSpeedInMbps":{"name":"linkSpeedInMbps","type":"\u0005","is_mandatory":true,"title":"Link speed in Mbps reported for the branch","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"VPN site location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"VPN site name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"o365Policy":{"name":"o365Policy","type":"\n","is_mandatory":true,"title":"Office 365 traffic-category breakout policy applied to this site","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"VPN site properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the site","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"siteKeySet":{"name":"siteKeySet","type":"\u0004","is_mandatory":true,"title":"Whether a pre-shared key is configured for site-to-site authentication (the secret itself is not exposed)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"VPN site tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualWan":{"name":"virtualWan","type":"\u001bazure.subscription.networkService.virtualWan","title":"The Virtual WAN this site is registered against","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vpnSiteLinks":{"name":"vpnSiteLinks","type":"\u0019\n","is_mandatory":true,"title":"Per-link details (IP, FQDN, BGP properties, link-speed) for multi-link sites","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Virtual WAN VPN site","desc":"VPN site, the registered on-prem branch endpoint that terminates a site-to-site IPsec tunnel into a Virtual WAN's VPN gateway. Surfaces the `ipAddress` (the public IP the gateway peers with), the `addressPrefixes` advertised by the branch, the BGP settings (`bgpAsn`, `bgpPeeringAddress`, `bgpPeerWeight`), device metadata (`deviceVendor`, `deviceModel`, `linkSpeedInMbps`), the `isSecuritySite` flag identifying the site as a security-partner site, the `o365Policy` controlling Office 365 traffic categories, `siteKeySet` indicating whether a pre-shared key is configured (the secret itself is not exposed), the typed `virtualWan()` ref to the parent WAN, and the per-link detail in `vpnSiteLinks` (each carrying its own IP, link connection speed, and BGP properties).","min_provider_version":"13.12.2","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.wafConfig":{"id":"azure.subscription.networkService.wafConfig","name":"azure.subscription.networkService.wafConfig","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the WAF configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kind of WAF configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the WAF configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Properties for the WAF configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type of WAF configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Application Gateway WAF config","desc":"Legacy WAF configuration attached directly to an Application Gateway (used by older v1 SKUs). Surfaces the WAF `mode` (Detection / Prevention), the rule set type and version, firewall mode flags, the `enabled` state, request-body limits, and disabled rule groups. Newer deployments use a typed `applicationFirewallPolicy` resource instead.","min_provider_version":"11.3.3","defaults":"id name type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.watcher":{"id":"azure.subscription.networkService.watcher","name":"azure.subscription.networkService.watcher","fields":{"connectionMonitor":{"name":"connectionMonitor","type":"\u001bazure.subscription.networkService.watcher.connectionMonitor","title":"Network Watcher connection monitor","desc":"Connection-monitor instance, Network Watcher's continuous reachability and latency check between source and destination endpoints. Surfaces the `endpoints` (each carrying a resource ID or address), the `testConfigurations` (protocol, port, frequency, success thresholds, trace-route behavior), the `testGroups` binding endpoint sets to configurations, and the `outputs` describing where results are written (typically a Log Analytics workspace). Also surfaces `monitoringIntervalInSeconds`, `autoStart`, `monitoringStatus`, `connectionMonitorType`, `provisioningState`, and free-form `notes`. Use this to audit which production paths are continuously verified and where the telemetry lands.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"connectionMonitors":{"name":"connectionMonitors","type":"\u0019\u001bazure.subscription.networkService.watcher.connectionMonitor","title":"Connection monitor instances on the watcher","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Network watcher etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"flowLogs":{"name":"flowLogs","type":"\u0019\u001bazure.subscription.networkService.watcher.flowlog","title":"Network watcher flow logs","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"flowlog":{"name":"flowlog","type":"\u001bazure.subscription.networkService.watcher.flowlog","title":"Azure Network Watcher flow log","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Network watcher ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Network watcher location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Network watcher name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"packetCapture":{"name":"packetCapture","type":"\u001bazure.subscription.networkService.watcher.packetCapture","title":"Network Watcher packet capture session","desc":"Packet-capture session configured on a Network Watcher. Surfaces the `target` resource being captured (a VM or VMSS, with `targetType` distinguishing them), the `bytesToCapturePerPacket` truncation, the `timeLimitInSeconds` and `totalBytesPerSession` upper bounds, whether `continuousCapture` rotation is enabled, per-flow `filters` (protocol, source/destination IP and port), the `storageLocation` (storage account ID, blob path, on-VM file path), and the `provisioningState` of the session. Use this to audit which production workloads have ongoing packet capture and where the captured traffic is being written.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"packetCaptures":{"name":"packetCaptures","type":"\u0019\u001bazure.subscription.networkService.watcher.packetCapture","title":"Packet capture sessions on the watcher","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Network watcher properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Network watcher provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Network watcher tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Network watcher type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Network Watcher","private":true,"min_provider_version":"9.0.1","defaults":"name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.watcher.connectionMonitor":{"id":"azure.subscription.networkService.watcher.connectionMonitor","name":"azure.subscription.networkService.watcher.connectionMonitor","fields":{"autoStart":{"name":"autoStart","type":"\u0004","is_mandatory":true,"title":"Whether the monitor starts automatically once created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionMonitorType":{"name":"connectionMonitorType","type":"\u0007","is_mandatory":true,"title":"Connection monitor type (\"MultiEndpoint\" or \"SingleSourceDestination\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpoints":{"name":"endpoints","type":"\u0019\n","is_mandatory":true,"title":"Endpoints participating in the monitor (each with name, resource ID or address, type)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Connection monitor etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connection monitor ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Connection monitor location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"monitoringIntervalInSeconds":{"name":"monitoringIntervalInSeconds","type":"\u0005","is_mandatory":true,"title":"Monitoring interval in seconds","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"monitoringStatus":{"name":"monitoringStatus","type":"\u0007","is_mandatory":true,"title":"Current monitoring status (e.g., \"Running\", \"Stopped\", \"NotStarted\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection monitor name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"notes":{"name":"notes","type":"\u0007","is_mandatory":true,"title":"Free-form notes associated with the monitor","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"outputs":{"name":"outputs","type":"\u0019\n","is_mandatory":true,"title":"Destinations for monitor output (typically Log Analytics workspaces)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Connection monitor properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the monitor","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Connection monitor tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"testConfigurations":{"name":"testConfigurations","type":"\u0019\n","is_mandatory":true,"title":"Test configurations (protocol, TCP/HTTP/ICMP settings, frequency, thresholds)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"testGroups":{"name":"testGroups","type":"\u0019\n","is_mandatory":true,"title":"Test groups binding sources, destinations, and test configurations","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Connection monitor type (resource type)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network Watcher connection monitor","desc":"Connection-monitor instance, Network Watcher's continuous reachability and latency check between source and destination endpoints. Surfaces the `endpoints` (each carrying a resource ID or address), the `testConfigurations` (protocol, port, frequency, success thresholds, trace-route behavior), the `testGroups` binding endpoint sets to configurations, and the `outputs` describing where results are written (typically a Log Analytics workspace). Also surfaces `monitoringIntervalInSeconds`, `autoStart`, `monitoringStatus`, `connectionMonitorType`, `provisioningState`, and free-form `notes`. Use this to audit which production paths are continuously verified and where the telemetry lands.","private":true,"min_provider_version":"13.12.2","defaults":"name location monitoringStatus","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.watcher.flowlog":{"id":"azure.subscription.networkService.watcher.flowlog","name":"azure.subscription.networkService.watcher.flowlog","fields":{"analytics":{"name":"analytics","type":"\n","is_mandatory":true,"title":"Network watcher flow log analytics","desc":"Deprecated in favor of trafficAnalyticsEnabled, trafficAnalyticsInterval, and trafficAnalyticsWorkspaceId.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the network watcher flow log is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Network watcher flow log etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"format":{"name":"format","type":"\u0007","is_mandatory":true,"title":"Network watcher flow log format","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Network watcher flow log ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Network watcher flow log location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Network watcher flow log name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Network watcher flow log provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionDays":{"name":"retentionDays","type":"\u0005","is_mandatory":true,"title":"Number of days flow logs are retained; 0 means logs are retained indefinitely","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionEnabled":{"name":"retentionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether a retention policy is enforced on the flow logs","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionPolicy":{"name":"retentionPolicy","type":"\n","is_mandatory":true,"title":"Network watcher flow log retention policy","desc":"Deprecated in favor of retentionEnabled and retentionDays.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"storageAccountId":{"name":"storageAccountId","type":"\u0007","is_mandatory":true,"title":"Network watcher flow log storage account identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Network watcher flow log tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"targetResourceGuid":{"name":"targetResourceGuid","type":"\u0007","is_mandatory":true,"title":"Network watcher flow log target resource guid","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"targetResourceId":{"name":"targetResourceId","type":"\u0007","is_mandatory":true,"title":"Network watcher flow log target resource identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trafficAnalyticsEnabled":{"name":"trafficAnalyticsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Traffic Analytics is enabled for the flow logs","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trafficAnalyticsInterval":{"name":"trafficAnalyticsInterval","type":"\u0005","is_mandatory":true,"title":"Traffic Analytics processing interval, in minutes","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trafficAnalyticsWorkspaceId":{"name":"trafficAnalyticsWorkspaceId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the Log Analytics workspace Traffic Analytics writes to","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Network watcher flow log type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Network watcher flow log version","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Network Watcher flow log","private":true,"min_provider_version":"9.0.1","defaults":"name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.networkService.watcher.packetCapture":{"id":"azure.subscription.networkService.watcher.packetCapture","name":"azure.subscription.networkService.watcher.packetCapture","fields":{"bytesToCapturePerPacket":{"name":"bytesToCapturePerPacket","type":"\u0005","is_mandatory":true,"title":"Number of bytes captured per packet; remaining bytes are truncated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"continuousCapture":{"name":"continuousCapture","type":"\u0004","is_mandatory":true,"title":"Whether rotating multi-file continuous capture is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Packet capture etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"filters":{"name":"filters","type":"\u0019\n","is_mandatory":true,"title":"Per-flow capture filters (protocol, local/remote IP and port)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Packet capture ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Packet capture name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Packet capture properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the capture session","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageLocation":{"name":"storageLocation","type":"\n","is_mandatory":true,"title":"Where the capture is written (storage account ID, blob path, VM local path)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"Resource ID of the VM or VMSS being captured","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"targetType":{"name":"targetType","type":"\u0007","is_mandatory":true,"title":"Type of the captured resource (\"AzureVM\" or \"AzureVMSS\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timeLimitInSeconds":{"name":"timeLimitInSeconds","type":"\u0005","is_mandatory":true,"title":"Maximum duration of the capture session in seconds","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"totalBytesPerSession":{"name":"totalBytesPerSession","type":"\u0005","is_mandatory":true,"title":"Maximum size of the capture output in bytes","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network Watcher packet capture session","desc":"Packet-capture session configured on a Network Watcher. Surfaces the `target` resource being captured (a VM or VMSS, with `targetType` distinguishing them), the `bytesToCapturePerPacket` truncation, the `timeLimitInSeconds` and `totalBytesPerSession` upper bounds, whether `continuousCapture` rotation is enabled, per-flow `filters` (protocol, source/destination IP and port), the `storageLocation` (storage account ID, blob path, on-VM file path), and the `provisioningState` of the session. Use this to audit which production workloads have ongoing packet capture and where the captured traffic is being written.","private":true,"min_provider_version":"13.12.2","defaults":"name target provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.policy":{"id":"azure.subscription.policy","name":"azure.subscription.policy","fields":{"assignment":{"name":"assignment","type":"\u001bazure.subscription.policy.assignment","title":"Azure Policy assignment","desc":"Assignment of a policy definition or initiative to a scope, which puts the policy into effect. The enforcementMode field distinguishes active enforcement from audit-only evaluation (Default vs DoNotEnforce), and scope records whether the assignment is inherited from a containing management group or applied directly to the subscription.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"assignments":{"name":"assignments","type":"\u0019\u001bazure.subscription.policy.assignment","title":"List of policy assignments in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"complianceSummary":{"name":"complianceSummary","type":"\u001bazure.subscription.policy.complianceSummary","title":"Aggregate policy compliance summary for the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"definition":{"name":"definition","type":"\u001bazure.subscription.policy.definition","title":"Azure Policy definition","desc":"Single policy rule and the effect it produces (for example deny, audit, append, or deployIfNotExists). The policyType field records whether the definition ships with Azure or is custom, and policyRule holds the if/then condition evaluated against resources. Selecting definitions by their category metadata or effect helps audit which controls are available to assign.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"definitions":{"name":"definitions","type":"\u0019\u001bazure.subscription.policy.definition","title":"List of policy definitions available in the subscription","min_provider_version":"13.12.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"exemption":{"name":"exemption","type":"\u001bazure.subscription.policy.exemption","title":"Azure Policy exemption","desc":"Exemption that suspends policy enforcement for a resource, resource group, or subscription, so an assignment stops flagging or blocking the exempted scope. The exemptionCategory field records why it was granted (Waiver or Mitigated) and expiresOn records when enforcement resumes. Auditing exemptions surfaces intentional gaps in governance coverage.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"exemptions":{"name":"exemptions","type":"\u0019\u001bazure.subscription.policy.exemption","title":"List of policy exemptions in the subscription","min_provider_version":"13.12.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"setDefinition":{"name":"setDefinition","type":"\u001bazure.subscription.policy.setDefinition","title":"Azure Policy initiative","desc":"Initiative (policy set) that groups multiple policy definitions under a single assignable unit, so related controls are applied together. The policyDefinitions field lists the grouped definitions and their parameters, and policyType records whether the initiative ships with Azure or is custom.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"setDefinitions":{"name":"setDefinitions","type":"\u0019\u001bazure.subscription.policy.setDefinition","title":"List of policy initiatives (set definitions) available in the subscription","min_provider_version":"13.12.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u001bazure.subscription.policy.state","title":"Azure Policy compliance state","desc":"The latest compliance evaluation of a single resource against a single policy: whether the resource is compliant, the effect the policy applies, and the assignment and definition responsible. Where the aggregate compliance summary reports counts, these records name the specific non-compliant resources, so audits can enumerate exactly what fails which control. Filter by `complianceState` to isolate non-compliant resources.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"states":{"name":"states","type":"\u0019\u001bazure.subscription.policy.state","title":"Per-resource policy compliance states in the subscription","desc":"Enumerates the latest compliance evaluation of every resource against every applicable policy, so the result set can be large on subscriptions with many resources and assignments. Fetched only when queried; filter by `complianceState` to isolate non-compliant resources.","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Policy service","desc":"Azure Policy governance for a subscription, covering the policy assignments in effect, the definitions and initiatives they draw from, the exemptions that suspend enforcement, and an aggregate compliance summary. Use it to audit which governance controls are applied and where resources fall out of compliance.","private":true,"min_provider_version":"11.2.0","defaults":"subscriptionId","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.policy.assignment":{"id":"azure.subscription.policy.assignment","name":"azure.subscription.policy.assignment","fields":{"assignmentId":{"name":"assignmentId","type":"\u0007","is_mandatory":true,"title":"Policy assignment resource ID","min_provider_version":"13.12.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enforcementMode":{"name":"enforcementMode","type":"\u0007","is_mandatory":true,"title":"Policy enforcement Mode","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy definition ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"parameters":{"name":"parameters","type":"\n","is_mandatory":true,"title":"Parameter values supplied to the assigned policy","desc":"Keyed by parameter name, with each value an object holding a `value` field that carries the argument passed to the definition.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Policy scope","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Policy assignment","desc":"Assignment of a policy definition or initiative to a scope, which puts the policy into effect. The enforcementMode field distinguishes active enforcement from audit-only evaluation (Default vs DoNotEnforce), and scope records whether the assignment is inherited from a containing management group or applied directly to the subscription.","private":true,"min_provider_version":"11.2.0","defaults":"name enforcementMode","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.policy.complianceSummary":{"id":"azure.subscription.policy.complianceSummary","name":"azure.subscription.policy.complianceSummary","fields":{"assignments":{"name":"assignments","type":"\u0019\n","title":"Per-assignment compliance breakdown","desc":"One entry per policy assignment, each keyed with `policyAssignmentId`, `policySetDefinitionId`, `nonCompliantResources`, and `nonCompliantPolicies`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nonCompliantPolicies":{"name":"nonCompliantPolicies","type":"\u0005","title":"Number of policies with at least one non-compliant resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"nonCompliantResources":{"name":"nonCompliantResources","type":"\u0005","title":"Number of resources currently non-compliant with assigned policies","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyComplianceCounts":{"name":"policyComplianceCounts","type":"\u001a\u0007\u0005","title":"Policy counts keyed by compliance state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceComplianceCounts":{"name":"resourceComplianceCounts","type":"\u001a\u0007\u0005","title":"Resource counts keyed by compliance state, for example Compliant, NonCompliant, Conflict, Exempt","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Policy compliance summary","desc":"Aggregate compliance rollup for the subscription, reporting how many resources and policies are out of compliance along with per-state and per-assignment breakdowns. Use it to gauge overall governance health without enumerating individual policy states.","private":true,"min_provider_version":"13.12.1","defaults":"nonCompliantResources nonCompliantPolicies","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.policy.definition":{"id":"azure.subscription.policy.definition","name":"azure.subscription.policy.definition","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of what the policy enforces","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name of the policy definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy definition resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metadata":{"name":"metadata","type":"\n","is_mandatory":true,"title":"Open-ended metadata such as category and version information","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Resource types the policy evaluates, for example All, Indexed, or a Microsoft.*.Data mode","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy definition name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"parameters":{"name":"parameters","type":"\n","is_mandatory":true,"title":"Parameter definitions accepted by the policy rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyRule":{"name":"policyRule","type":"\n","is_mandatory":true,"title":"Policy rule expressing the if/then condition and resulting effect","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyType":{"name":"policyType","type":"\u0007","is_mandatory":true,"title":"Origin of the definition: BuiltIn, Custom, Static, or NotSpecified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Definition version in #.#.# format","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Policy definition","desc":"Single policy rule and the effect it produces (for example deny, audit, append, or deployIfNotExists). The policyType field records whether the definition ships with Azure or is custom, and policyRule holds the if/then condition evaluated against resources. Selecting definitions by their category metadata or effect helps audit which controls are available to assign.","private":true,"min_provider_version":"13.12.1","defaults":"name displayName policyType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.policy.exemption":{"id":"azure.subscription.policy.exemption","name":"azure.subscription.policy.exemption","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the exemption was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Reason the exemption was granted","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name of the exemption","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"exemptionCategory":{"name":"exemptionCategory","type":"\u0007","is_mandatory":true,"title":"Exemption category: Waiver or Mitigated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"expiresOn":{"name":"expiresOn","type":"\t","is_mandatory":true,"title":"Time after which the exemption expires and the policy is enforced again","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy exemption resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metadata":{"name":"metadata","type":"\n","is_mandatory":true,"title":"Open-ended metadata attached to the exemption","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy exemption name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyAssignment":{"name":"policyAssignment","type":"\u001bazure.subscription.policy.assignment","title":"Policy assignment the exemption applies to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyDefinitionReferenceIds":{"name":"policyDefinitionReferenceIds","type":"\u0019\u0007","is_mandatory":true,"title":"Reference IDs of the grouped policy definitions exempted within the assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope (resource, resource group, or subscription) the exemption applies to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the exemption was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Policy exemption","desc":"Exemption that suspends policy enforcement for a resource, resource group, or subscription, so an assignment stops flagging or blocking the exempted scope. The exemptionCategory field records why it was granted (Waiver or Mitigated) and expiresOn records when enforcement resumes. Auditing exemptions surfaces intentional gaps in governance coverage.","private":true,"min_provider_version":"13.12.1","defaults":"name exemptionCategory expiresOn","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.policy.setDefinition":{"id":"azure.subscription.policy.setDefinition","name":"azure.subscription.policy.setDefinition","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the initiative","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name of the initiative","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy set definition resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metadata":{"name":"metadata","type":"\n","is_mandatory":true,"title":"Open-ended metadata such as category and version information","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy set definition name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"parameters":{"name":"parameters","type":"\n","is_mandatory":true,"title":"Parameter definitions shared across the grouped policy definitions","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyDefinitions":{"name":"policyDefinitions","type":"\u0019\n","is_mandatory":true,"title":"Policy definitions grouped by this initiative, each with its parameters and reference ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyType":{"name":"policyType","type":"\u0007","is_mandatory":true,"title":"Origin of the initiative: BuiltIn, Custom, Static, or NotSpecified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Initiative version in #.#.# format","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Policy initiative","desc":"Initiative (policy set) that groups multiple policy definitions under a single assignable unit, so related controls are applied together. The policyDefinitions field lists the grouped definitions and their parameters, and policyType records whether the initiative ships with Azure or is custom.","private":true,"min_provider_version":"13.12.1","defaults":"name displayName policyType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.policy.state":{"id":"azure.subscription.policy.state","name":"azure.subscription.policy.state","fields":{"complianceState":{"name":"complianceState","type":"\u0007","is_mandatory":true,"title":"Compliance state (\"Compliant\", \"NonCompliant\", \"Conflict\", \"Exempt\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyAssignment":{"name":"policyAssignment","type":"\u001bazure.subscription.policy.assignment","title":"Policy assignment that produced this state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyAssignmentName":{"name":"policyAssignmentName","type":"\u0007","is_mandatory":true,"title":"Name of the policy assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyAssignmentScope":{"name":"policyAssignmentScope","type":"\u0007","is_mandatory":true,"title":"Scope of the policy assignment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyDefinition":{"name":"policyDefinition","type":"\u001bazure.subscription.policy.definition","title":"Policy definition evaluated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyDefinitionAction":{"name":"policyDefinitionAction","type":"\u0007","is_mandatory":true,"title":"Effect the policy definition applies (e.g. \"deny\", \"audit\", \"deployIfNotExists\", \"append\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyDefinitionCategory":{"name":"policyDefinitionCategory","type":"\u0007","is_mandatory":true,"title":"Category of the policy definition (e.g. \"Security Center\", \"Storage\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyDefinitionName":{"name":"policyDefinitionName","type":"\u0007","is_mandatory":true,"title":"Name of the policy definition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyDefinitionReferenceId":{"name":"policyDefinitionReferenceId","type":"\u0007","is_mandatory":true,"title":"Reference ID of the definition within an initiative (set definition), if applicable","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policySetDefinition":{"name":"policySetDefinition","type":"\u001bazure.subscription.policy.setDefinition","title":"Initiative (set definition) the assignment applies, if any","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policySetDefinitionName":{"name":"policySetDefinitionName","type":"\u0007","is_mandatory":true,"title":"Name of the initiative (set definition), if applicable","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceGroup":{"name":"resourceGroup","type":"\u0007","is_mandatory":true,"title":"Resource group of the evaluated resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceId":{"name":"resourceId","type":"\u0007","is_mandatory":true,"title":"Full ARM resource ID of the evaluated resource","desc":"For example `/subscriptions/\u003csub\u003e/resourceGroups/\u003crg\u003e/providers/Microsoft.Compute/virtualMachines/\u003cvm\u003e`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceLocation":{"name":"resourceLocation","type":"\u0007","is_mandatory":true,"title":"Location of the evaluated resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceType":{"name":"resourceType","type":"\u0007","is_mandatory":true,"title":"Resource type of the evaluated resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timestamp":{"name":"timestamp","type":"\t","is_mandatory":true,"title":"When the evaluation was recorded","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Policy compliance state","desc":"The latest compliance evaluation of a single resource against a single policy: whether the resource is compliant, the effect the policy applies, and the assignment and definition responsible. Where the aggregate compliance summary reports counts, these records name the specific non-compliant resources, so audits can enumerate exactly what fails which control. Filter by `complianceState` to isolate non-compliant resources.","private":true,"min_provider_version":"13.32.1","defaults":"complianceState resourceType policyDefinitionName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.postgreSqlService":{"id":"azure.subscription.postgreSqlService","name":"azure.subscription.postgreSqlService","fields":{"database":{"name":"database","type":"\u001bazure.subscription.postgreSqlService.database","title":"Azure Database for PostgreSQL database","desc":"Individual database hosted on a PostgreSQL single server or flexible server, including its character set and collation. Use it to inventory the databases present on a managed PostgreSQL instance.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"flexibleServer":{"name":"flexibleServer","type":"\u001bazure.subscription.postgreSqlService.flexibleServer","title":"Azure Database for PostgreSQL flexible server","desc":"PostgreSQL Flexible Server instance, the current deployment model for managed PostgreSQL on Azure. Reports the network-exposure controls (publicNetworkAccess, firewallRules, internetReachable), authentication modes (activeDirectoryAuth, passwordAuth), data-at-rest encryption (dataEncryptionType, with optional customer-managed Key Vault keys), backup retention, and Microsoft Defender threat-protection state that together determine the server's security posture.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"flexibleServers":{"name":"flexibleServers","type":"\u0019\u001bazure.subscription.postgreSqlService.flexibleServer","title":"List of PostgreSQL flexible servers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"server":{"name":"server","type":"\u001bazure.subscription.postgreSqlService.server","title":"Azure Database for PostgreSQL server","desc":"PostgreSQL Single Server instance, the earlier managed-PostgreSQL deployment model that Azure is retiring in favor of Flexible Server. Reports SSL enforcement, minimum TLS version, infrastructure (double) encryption, public network access, firewall rules, and backup configuration for auditing legacy servers still in production.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"servers":{"name":"servers","type":"\u0019\u001bazure.subscription.postgreSqlService.server","title":"List of PostgreSQL servers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Database for PostgreSQL","desc":"Managed PostgreSQL databases in a subscription, covering both the current Flexible Server deployment model (flexibleServers) and the earlier Single Server model (servers) that Azure is retiring. Use it to enumerate every managed PostgreSQL instance and audit their network exposure, authentication mode, encryption, and backup posture.","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.postgreSqlService.database":{"id":"azure.subscription.postgreSqlService.database","name":"azure.subscription.postgreSqlService.database","fields":{"charset":{"name":"charset","type":"\u0007","is_mandatory":true,"title":"PostgreSQL database charset","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"collation":{"name":"collation","type":"\u0007","is_mandatory":true,"title":"PostgreSQL database collation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"PostgreSQL database ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"PostgreSQL database name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"PostgreSQL database type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Database for PostgreSQL database","desc":"Individual database hosted on a PostgreSQL single server or flexible server, including its character set and collation. Use it to inventory the databases present on a managed PostgreSQL instance.","private":true,"min_provider_version":"9.0.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.postgreSqlService.flexibleServer":{"id":"azure.subscription.postgreSqlService.flexibleServer","name":"azure.subscription.postgreSqlService.flexibleServer","fields":{"activeDirectoryAuth":{"name":"activeDirectoryAuth","type":"\u0007","is_mandatory":true,"title":"Microsoft Entra (Active Directory) authentication state (\"Enabled\" or \"Disabled\")","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"backupRetentionDays":{"name":"backupRetentionDays","type":"\u0005","is_mandatory":true,"title":"Backup retention period in days","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"configuration":{"name":"configuration","type":"\u0019\u001bazure.subscription.sqlService.configuration","title":"PostgreSQL server configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataEncryptionKey":{"name":"dataEncryptionKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used for primary data encryption (null if system-managed)","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataEncryptionType":{"name":"dataEncryptionType","type":"\u0007","is_mandatory":true,"title":"Data encryption type (\"SystemManaged\" or \"AzureKeyVault\")","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"databases":{"name":"databases","type":"\u0019\u001bazure.subscription.postgreSqlService.database","title":"PostgreSQL server databases","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"firewallRules":{"name":"firewallRules","type":"\u0019\u001bazure.subscription.sqlService.firewallrule","title":"PostgreSQL server firewall rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"geoBackupEncryptionKey":{"name":"geoBackupEncryptionKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used for geo-backup encryption (null if system-managed)","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"geoBackupEncryptionKeyStatus":{"name":"geoBackupEncryptionKeyStatus","type":"\u0007","is_mandatory":true,"title":"Status of the geo-backup encryption key","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"geoRedundantBackup":{"name":"geoRedundantBackup","type":"\u0007","is_mandatory":true,"title":"Geo-redundant backup state (\"Enabled\" or \"Disabled\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"PostgreSQL server ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityType":{"name":"identityType","type":"\u0007","is_mandatory":true,"title":"Type of managed identity configured on the server","desc":"One of \"SystemAssigned\", \"UserAssigned\", \"SystemAssigned,UserAssigned\", or \"None\".","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"internetReachable":{"name":"internetReachable","type":"\u0004","title":"Whether the PostgreSQL flexible server is reachable from the public internet","desc":"True when `publicNetworkAccess` is enabled AND at least one firewall rule opens the server to the entire public internet, a rule whose range spans 0.0.0.0-255.255.255.255. The special \"allow all Azure services\" rule (0.0.0.0-0.0.0.0) does not count, since it admits only Azure-internal IPs.","min_provider_version":"13.20.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"PostgreSQL server location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"PostgreSQL server name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"passwordAuth":{"name":"passwordAuth","type":"\u0007","is_mandatory":true,"title":"Password-based authentication state (\"Enabled\" or \"Disabled\")","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"primaryEncryptionKeyStatus":{"name":"primaryEncryptionKeyStatus","type":"\u0007","is_mandatory":true,"title":"Status of the primary encryption key","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the server's system-assigned managed identity; empty when no system-assigned identity is enabled","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections for the PostgreSQL flexible server","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw Azure Resource Manager properties of the PostgreSQL flexible server","desc":"Full ServerProperties object as returned by Azure Resource Manager, keyed by fields such as `administratorLogin`, `version`, `minorVersion`, `state`, `fullyQualifiedDomainName`, `availabilityZone`, `storage`, `backup`, `network`, `highAvailability`, `maintenanceWindow`, `authConfig`, and `dataEncryption`. The security-relevant values are also surfaced as typed fields (version, activeDirectoryAuth, passwordAuth, dataEncryptionType, publicNetworkAccess, geoRedundantBackup, backupRetentionDays).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access state (\"Enabled\" or \"Disabled\")","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"PostgreSQL server tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Tenant ID of the server's managed identity","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"threatProtectionState":{"name":"threatProtectionState","type":"\u0007","title":"Microsoft Defender for Cloud advanced threat protection state (\"Enabled\", \"Disabled\", or \"New\")","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"PostgreSQL server type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities attached to the server","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"PostgreSQL flexible server engine version","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Database for PostgreSQL flexible server","desc":"PostgreSQL Flexible Server instance, the current deployment model for managed PostgreSQL on Azure. Reports the network-exposure controls (publicNetworkAccess, firewallRules, internetReachable), authentication modes (activeDirectoryAuth, passwordAuth), data-at-rest encryption (dataEncryptionType, with optional customer-managed Key Vault keys), backup retention, and Microsoft Defender threat-protection state that together determine the server's security posture.","private":true,"min_provider_version":"11.0.9","defaults":"name location properties.version properties.state properties.fullyQualifiedDomainName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.postgreSqlService.server":{"id":"azure.subscription.postgreSqlService.server","name":"azure.subscription.postgreSqlService.server","fields":{"backupRetentionDays":{"name":"backupRetentionDays","type":"\u0005","is_mandatory":true,"title":"Backup retention period in days","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"configuration":{"name":"configuration","type":"\u0019\u001bazure.subscription.sqlService.configuration","title":"PostgreSQL server configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"databases":{"name":"databases","type":"\u0019\u001bazure.subscription.postgreSqlService.database","title":"PostgreSQL server databases","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"firewallRules":{"name":"firewallRules","type":"\u0019\u001bazure.subscription.sqlService.firewallrule","title":"PostgreSQL server firewall rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"geoRedundantBackup":{"name":"geoRedundantBackup","type":"\u0007","is_mandatory":true,"title":"Geo-redundant backup state (\"Enabled\" or \"Disabled\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"PostgreSQL server ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"infrastructureEncryption":{"name":"infrastructureEncryption","type":"\u0004","is_mandatory":true,"title":"Whether infrastructure encryption is enabled (double encryption)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"internetReachable":{"name":"internetReachable","type":"\u0004","title":"Whether the PostgreSQL server is reachable from the public internet","desc":"True when `publicNetworkAccess` is enabled AND at least one firewall rule opens the server to the entire public internet, a rule whose range spans 0.0.0.0-255.255.255.255. The special \"allow all Azure services\" rule (0.0.0.0-0.0.0.0) does not count, since it admits only Azure-internal IPs.","min_provider_version":"13.20.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"PostgreSQL server location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minimalTlsVersion":{"name":"minimalTlsVersion","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version enforced on the server","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"PostgreSQL server name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw Azure Resource Manager properties of the PostgreSQL server","desc":"Full ServerProperties object as returned by Azure Resource Manager, keyed by fields such as `administratorLogin`, `version`, `userVisibleState`, `fullyQualifiedDomainName`, `sslEnforcement`, `minimalTlsVersion`, `publicNetworkAccess`, `infrastructureEncryption`, `earliestRestoreDate`, and `storageProfile`. The security-relevant values are also surfaced as typed fields (sslEnforcement, minimalTlsVersion, publicNetworkAccess, infrastructureEncryption, version, backupRetentionDays, geoRedundantBackup).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access state for the server (\"Enabled\" or \"Disabled\")","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslEnforcement":{"name":"sslEnforcement","type":"\u0004","is_mandatory":true,"title":"Whether SSL enforcement is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"PostgreSQL server tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"PostgreSQL server type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"PostgreSQL server engine version","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Database for PostgreSQL server","desc":"PostgreSQL Single Server instance, the earlier managed-PostgreSQL deployment model that Azure is retiring in favor of Flexible Server. Reports SSL enforcement, minimum TLS version, infrastructure (double) encryption, public network access, firewall rules, and backup configuration for auditing legacy servers still in production.","private":true,"min_provider_version":"9.0.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.privateEndpointConnection":{"id":"azure.subscription.privateEndpointConnection","name":"azure.subscription.privateEndpointConnection","fields":{"connectionState":{"name":"connectionState","type":"\u001bazure.subscription.privateEndpointConnection.connectionState","title":"Connection state for a private endpoint connection","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Private endpoint connection ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipAddresses":{"name":"ipAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Private endpoint connection IP addresses","desc":"Addresses allocated to the connection, when the owning service reports them. Most Azure services omit them from the connection read model and return an empty list; the addresses are always available through privateEndpoint and its network interfaces.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Private endpoint connection name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpoint":{"name":"privateEndpoint","type":"\u001bazure.subscription.networkService.privateEndpoint","title":"Associated private endpoint","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointId":{"name":"privateEndpointId","type":"\u0007","is_mandatory":true,"title":"Raw private endpoint resource ID","desc":"Deprecated in favor of `privateEndpoint()`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"privateLinkServiceConnectionState":{"name":"privateLinkServiceConnectionState","type":"\u001bazure.subscription.privateEndpointConnection.connectionState","is_mandatory":true,"title":"Private link service connection state details","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw private endpoint connection properties","desc":"Unmodified properties object from the Azure API. Keys include `privateEndpoint` (an object whose `id` is the linked private endpoint resource ID), `privateLinkServiceConnectionState` (an object with `status`, `description`, and `actionsRequired`), and `provisioningState`. These same values are exposed as the typed privateEndpoint, privateLinkServiceConnectionState, and provisioningState fields on this resource.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the private endpoint connection","desc":"Lifecycle state of the connection, typically one of Succeeded, Creating, Updating, Deleting, or Failed.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Private endpoint connection type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure private endpoint connection","private":true,"min_provider_version":"11.4.4","defaults":"id name type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.privateEndpointConnection.connectionState":{"id":"azure.subscription.privateEndpointConnection.connectionState","name":"azure.subscription.privateEndpointConnection.connectionState","fields":{"actionsRequired":{"name":"actionsRequired","type":"\u0007","is_mandatory":true,"title":"Required actions for the private link service connection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the private link service connection state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the private link service connection","desc":"Approval state of the connection request, one of Pending, Approved, Rejected, or Disconnected. A Pending or Rejected status means traffic over the private endpoint is not yet established.","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Connection state for a private endpoint connection","private":true,"min_provider_version":"11.4.4","defaults":"status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.purviewService":{"id":"azure.subscription.purviewService","name":"azure.subscription.purviewService","fields":{"account":{"name":"account","type":"\u001bazure.subscription.purviewService.account","title":"Microsoft Purview account","desc":"Single Purview account, the tenant-scoped governance hub that hosts the data catalog, scanning, classification, and lineage surfaces. The `publicNetworkAccess` field confirms whether the account is reachable from the public internet; `managedResourceGroupName` and `managedResources` locate the Purview-managed Storage and Event Hub resources backing the account; `endpoints` gives the catalog, scan, and guardian URIs; and `privateEndpointConnections` lists the approved private-link bindings.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"accounts":{"name":"accounts","type":"\u0019\u001bazure.subscription.purviewService.account","title":"Microsoft Purview accounts in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Purview","desc":"Microsoft Purview accounts in the subscription. Each account is a tenant-scoped data-governance and sensitive-data-discovery hub that catalogs data assets across Azure (Storage, SQL, Synapse, Cosmos DB, Power BI) and external clouds. The `accounts` list holds the per-region Purview accounts, where their public-network-access posture, managed-resource-group bindings, SKU, and public endpoints are queryable.","private":true,"min_provider_version":"13.11.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.purviewService.account":{"id":"azure.subscription.purviewService.account","name":"azure.subscription.purviewService.account","fields":{"cloudConnectors":{"name":"cloudConnectors","type":"\n","is_mandatory":true,"title":"Cloud connectors for external (AWS) scanning, with the externally surfaced AWS external ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the account was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"Principal name that created the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdByObjectId":{"name":"createdByObjectId","type":"\u0007","is_mandatory":true,"title":"Object ID of the principal that created the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpoints":{"name":"endpoints","type":"\n","is_mandatory":true,"title":"Public endpoints of the account, with keys `catalog`, `guardian`, `scan`","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"friendlyName":{"name":"friendlyName","type":"\u0007","is_mandatory":true,"title":"Friendly display name for the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Full resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Identity configuration (SystemAssigned, UserAssigned, principalId, tenantId)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Location of the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedResourceGroupName":{"name":"managedResourceGroupName","type":"\u0007","is_mandatory":true,"title":"Name of the Purview-managed resource group that backs this account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedResources":{"name":"managedResources","type":"\n","is_mandatory":true,"title":"Resource identifiers of the managed resources (storage account, event hub namespace, resource group ID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the Purview account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\n","is_mandatory":true,"title":"Approved private-endpoint connections for the account","desc":"Each entry carries `id`, `name`, `type`, and a `properties` object holding `privateEndpoint.id`, `provisioningState`, and a `privateLinkServiceConnectionState` with `status` (Approved, Pending, Rejected, Disconnected, or Unknown), `description`, and `actionsRequired`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Unmodeled raw properties returned by the Azure API","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state: Succeeded, Failed, Canceled, Creating, Deleting, Moving, SoftDeleting, SoftDeleted, or Unknown","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access state: Enabled, Disabled, or NotSpecified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"Account SKU (name, capacity)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Tags on the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Purview account","desc":"Single Purview account, the tenant-scoped governance hub that hosts the data catalog, scanning, classification, and lineage surfaces. The `publicNetworkAccess` field confirms whether the account is reachable from the public internet; `managedResourceGroupName` and `managedResources` locate the Purview-managed Storage and Event Hub resources backing the account; `endpoints` gives the catalog, scan, and guardian URIs; and `privateEndpointConnections` lists the approved private-link bindings.","private":true,"min_provider_version":"13.11.2","defaults":"name location publicNetworkAccess provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.recoveryServicesService":{"id":"azure.subscription.recoveryServicesService","name":"azure.subscription.recoveryServicesService","fields":{"deletedVault":{"name":"deletedVault","type":"\u001bazure.subscription.recoveryServicesService.deletedVault","title":"Soft-deleted Azure Recovery Services vault","desc":"Recovery Services vault that has been deleted but is retained in a soft-deleted state until Azure permanently purges it. Surfaces the time the vault was deleted, the scheduled purge time, and the resource ID of the original vault, so an auditor can review the recovery window and undelete opportunities before data is lost. Deleted vaults are enumerated per Azure region.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"deletedVaults":{"name":"deletedVaults","type":"\u0019\u001bazure.subscription.recoveryServicesService.deletedVault","title":"Soft-deleted recovery services vaults awaiting permanent purge","min_provider_version":"13.30.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vault":{"name":"vault","type":"\u001bazure.subscription.recoveryServicesService.vault","title":"Azure Recovery Services vault","desc":"Storage container for Azure Backup and Azure Site Recovery that holds backup policies, protected items, and the encryption, redundancy, and network configuration governing how backup data is stored and reached. Query a vault to audit whether soft delete and immutability protect backups from tampering, whether public network access is disabled, whether customer-managed keys encrypt the data, and whether multi-user authorization guards destructive operations. The securitySettings, encryption, redundancySettings, and monitoringSettings sub-resources carry the detailed state.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"vaults":{"name":"vaults","type":"\u0019\u001bazure.subscription.recoveryServicesService.vault","title":"List of recovery services vaults","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Recovery Services","private":true,"min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.recoveryServicesService.deletedVault":{"id":"azure.subscription.recoveryServicesService.deletedVault","name":"azure.subscription.recoveryServicesService.deletedVault","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Deleted vault resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Azure region the vault was deleted in","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Deleted vault name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"purgeAt":{"name":"purgeAt","type":"\t","is_mandatory":true,"title":"Time the vault will be permanently purged (UTC)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vaultDeletionTime":{"name":"vaultDeletionTime","type":"\t","is_mandatory":true,"title":"Time the vault was deleted (UTC)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vaultResourceId":{"name":"vaultResourceId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the deleted vault","desc":"Identifies the original vault that was deleted. The vault no longer exists as a live resource, so only its resource ID is retained.","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Soft-deleted Azure Recovery Services vault","desc":"Recovery Services vault that has been deleted but is retained in a soft-deleted state until Azure permanently purges it. Surfaces the time the vault was deleted, the scheduled purge time, and the resource ID of the original vault, so an auditor can review the recovery window and undelete opportunities before data is lost. Deleted vaults are enumerated per Azure region.","private":true,"min_provider_version":"13.30.1","defaults":"name vaultDeletionTime purgeAt","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.recoveryServicesService.vault":{"id":"azure.subscription.recoveryServicesService.vault","name":"azure.subscription.recoveryServicesService.vault","fields":{"backupConfig":{"name":"backupConfig","type":"\u001bazure.subscription.recoveryServicesService.vault.backupConfig","title":"Backup vault configuration (from backup API)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"backupPolicies":{"name":"backupPolicies","type":"\u0019\u001bazure.subscription.recoveryServicesService.vault.backupPolicy","title":"Backup policies","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"backupPolicy":{"name":"backupPolicy","type":"\u001bazure.subscription.recoveryServicesService.vault.backupPolicy","title":"Backup policy in a Recovery Services vault","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"backupStorageVersion":{"name":"backupStorageVersion","type":"\u0007","is_mandatory":true,"title":"Backup storage version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"costManagementGranularityLevel":{"name":"costManagementGranularityLevel","type":"\u0007","is_mandatory":true,"title":"Cost management report granularity (\"ProtectedItemLevel\", \"ProtectedItemWithParentTag\", or \"VaultLevel\"); empty when unset","min_provider_version":"13.30.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryption":{"name":"encryption","type":"\u001bazure.subscription.recoveryServicesService.vault.encryption","title":"Encryption settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Vault resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity configuration","desc":"Managed identity block of the vault, with keys `type` (one of \"SystemAssigned\", \"UserAssigned\", \"SystemAssigned, UserAssigned\", or \"None\"), `principalId` and `tenantId` for the system-assigned identity, and `userAssignedIdentities` mapping each assigned identity resource ID to its client and principal IDs. See userAssignedIdentities for the resolved user-assigned identity resources.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Vault location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"monitoringSettings":{"name":"monitoringSettings","type":"\u001bazure.subscription.recoveryServicesService.vault.monitoringSettings","title":"Monitoring and alerting settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Vault name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointStateForBackup":{"name":"privateEndpointStateForBackup","type":"\u0007","is_mandatory":true,"title":"Private endpoint state for backup (\"None\" or \"Enabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointStateForSiteRecovery":{"name":"privateEndpointStateForSiteRecovery","type":"\u0007","is_mandatory":true,"title":"Private endpoint state for site recovery (\"None\" or \"Enabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"protectedItem":{"name":"protectedItem","type":"\u001bazure.subscription.recoveryServicesService.vault.protectedItem","title":"Protected (backed-up) item in a Recovery Services vault","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"protectedItems":{"name":"protectedItems","type":"\u0019\u001bazure.subscription.recoveryServicesService.vault.protectedItem","title":"Protected (backed-up) items","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"redundancySettings":{"name":"redundancySettings","type":"\u001bazure.subscription.recoveryServicesService.vault.redundancySettings","title":"Storage redundancy settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secureScore":{"name":"secureScore","type":"\u0007","is_mandatory":true,"title":"Secure score (\"Adequate\", \"Maximum\", \"Minimum\", or \"None\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securitySettings":{"name":"securitySettings","type":"\u001bazure.subscription.recoveryServicesService.vault.securitySettings","title":"Security settings (soft delete, immutability, enhanced security)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"SKU name (\"Standard\" or \"RS0\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Vault tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities associated with the vault","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Recovery Services vault","desc":"Storage container for Azure Backup and Azure Site Recovery that holds backup policies, protected items, and the encryption, redundancy, and network configuration governing how backup data is stored and reached. Query a vault to audit whether soft delete and immutability protect backups from tampering, whether public network access is disabled, whether customer-managed keys encrypt the data, and whether multi-user authorization guards destructive operations. The securitySettings, encryption, redundancySettings, and monitoringSettings sub-resources carry the detailed state.","min_provider_version":"13.3.3","defaults":"id name location skuName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.recoveryServicesService.vault.backupConfig":{"id":"azure.subscription.recoveryServicesService.vault.backupConfig","name":"azure.subscription.recoveryServicesService.vault.backupConfig","fields":{"enhancedSecurityState":{"name":"enhancedSecurityState","type":"\u0007","is_mandatory":true,"title":"Enhanced security state (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Backup config identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"softDeleteFeatureState":{"name":"softDeleteFeatureState","type":"\u0007","is_mandatory":true,"title":"Soft delete feature state (\"AlwaysON\", \"Enabled\", or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"softDeleteRetentionPeriodInDays":{"name":"softDeleteRetentionPeriodInDays","type":"\u0005","is_mandatory":true,"title":"Soft delete retention period in days","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageType":{"name":"storageType","type":"\u0007","is_mandatory":true,"title":"Storage type (\"GeoRedundant\", \"LocallyRedundant\", or \"ZoneRedundant\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageTypeState":{"name":"storageTypeState","type":"\u0007","is_mandatory":true,"title":"Storage type lock state (\"Locked\" or \"Unlocked\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Backup vault configuration (soft delete, storage type)","private":true,"min_provider_version":"13.3.3","defaults":"softDeleteFeatureState storageType","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.recoveryServicesService.vault.backupPolicy":{"id":"azure.subscription.recoveryServicesService.vault.backupPolicy","name":"azure.subscription.recoveryServicesService.vault.backupPolicy","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Backup policy resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Backup policy name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Backup policy properties","desc":"Raw policy definition whose shape is selected by the `backupManagementType` discriminator key (for example \"AzureIaasVM\", \"AzureSql\", \"AzureStorage\" for file shares, or \"AzureWorkload\" for SQL and SAP HANA in a VM). Along with the discriminator, common keys carry the schedule and retention rules that define the backup cadence.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Backup policy in a Recovery Services vault","private":true,"min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.recoveryServicesService.vault.encryption":{"id":"azure.subscription.recoveryServicesService.vault.encryption","name":"azure.subscription.recoveryServicesService.vault.encryption","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Encryption identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"infrastructureEncryption":{"name":"infrastructureEncryption","type":"\u0007","is_mandatory":true,"title":"Infrastructure encryption state (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"key":{"name":"key","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used for encryption","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultKeyUri":{"name":"keyVaultKeyUri","type":"\u0007","is_mandatory":true,"title":"Key Vault key URI for CMK encryption","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Encryption settings for a Recovery Services vault","private":true,"min_provider_version":"13.3.3","defaults":"infrastructureEncryption","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.recoveryServicesService.vault.monitoringSettings":{"id":"azure.subscription.recoveryServicesService.vault.monitoringSettings","name":"azure.subscription.recoveryServicesService.vault.monitoringSettings","fields":{"alertsForAllFailoverIssues":{"name":"alertsForAllFailoverIssues","type":"\u0007","is_mandatory":true,"title":"Alerts for all failover issues (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"alertsForAllJobFailures":{"name":"alertsForAllJobFailures","type":"\u0007","is_mandatory":true,"title":"Alerts for all job failures (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"alertsForAllReplicationIssues":{"name":"alertsForAllReplicationIssues","type":"\u0007","is_mandatory":true,"title":"Alerts for all replication issues (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"alertsForCriticalOperations":{"name":"alertsForCriticalOperations","type":"\u0007","is_mandatory":true,"title":"Alerts for critical operations (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"emailNotificationsForSiteRecovery":{"name":"emailNotificationsForSiteRecovery","type":"\u0007","is_mandatory":true,"title":"Email notifications for site recovery (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Monitoring settings identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Monitoring and alerting settings for a Recovery Services vault","private":true,"min_provider_version":"13.3.3","defaults":"alertsForAllJobFailures","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.recoveryServicesService.vault.protectedItem":{"id":"azure.subscription.recoveryServicesService.vault.protectedItem","name":"azure.subscription.recoveryServicesService.vault.protectedItem","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Protected item resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Protected item name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Protected item properties","desc":"Raw protected-item definition whose shape is selected by the `protectedItemType` discriminator key (for example \"Microsoft.Compute/virtualMachines\", \"AzureFileShareProtectedItem\", or the SQL and SAP HANA workload types). Common keys include `backupManagementType`, `workloadType`, `policyId`, and the time and health status of the most recent backup.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Protected (backed-up) item in a Recovery Services vault","private":true,"min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.recoveryServicesService.vault.redundancySettings":{"id":"azure.subscription.recoveryServicesService.vault.redundancySettings","name":"azure.subscription.recoveryServicesService.vault.redundancySettings","fields":{"crossRegionRestore":{"name":"crossRegionRestore","type":"\u0007","is_mandatory":true,"title":"Cross-region restore setting (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Redundancy settings identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageRedundancy":{"name":"storageRedundancy","type":"\u0007","is_mandatory":true,"title":"Standard tier storage redundancy (\"GeoRedundant\", \"LocallyRedundant\", or \"ZoneRedundant\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Storage redundancy settings for a Recovery Services vault","private":true,"min_provider_version":"13.3.3","defaults":"storageRedundancy crossRegionRestore","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.recoveryServicesService.vault.securitySettings":{"id":"azure.subscription.recoveryServicesService.vault.securitySettings","name":"azure.subscription.recoveryServicesService.vault.securitySettings","fields":{"enhancedSecurityState":{"name":"enhancedSecurityState","type":"\u0007","is_mandatory":true,"title":"Enhanced security state (\"Enabled\", \"Disabled\", or \"AlwaysON\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Security settings identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immutabilityState":{"name":"immutabilityState","type":"\u0007","is_mandatory":true,"title":"Immutability state (\"Disabled\", \"Locked\", or \"Unlocked\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"multiUserAuthorization":{"name":"multiUserAuthorization","type":"\u0007","is_mandatory":true,"title":"Multi-User Authorization state (\"Enabled\", \"Disabled\", or \"Invalid\"); Enabled requires a Resource Guard for destructive ops","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"softDeleteRetentionPeriodInDays":{"name":"softDeleteRetentionPeriodInDays","type":"\u0005","is_mandatory":true,"title":"Soft delete retention period in days","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"softDeleteState":{"name":"softDeleteState","type":"\u0007","is_mandatory":true,"title":"Soft delete state (\"Enabled\", \"Disabled\", or \"AlwaysON\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceScanConfigurationState":{"name":"sourceScanConfigurationState","type":"\u0007","is_mandatory":true,"title":"Source-scan configuration state (\"Enabled\" or \"Disabled\") for backup item discovery","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Security settings for a Recovery Services vault","private":true,"min_provider_version":"13.3.3","defaults":"softDeleteState immutabilityState multiUserAuthorization","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.resource":{"id":"azure.subscription.resource","name":"azure.subscription.resource","fields":{"changedTime":{"name":"changedTime","type":"\t","is_mandatory":true,"title":"When the resource was last changed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdTime":{"name":"createdTime","type":"\t","is_mandatory":true,"title":"When the resource was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Resource identity","desc":"Managed identity assigned to the resource, with keys type, principalId, tenantId, and userAssignedIdentities. The type is one of None, SystemAssigned, UserAssigned, or \"SystemAssigned, UserAssigned\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Resource kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Resource location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedBy":{"name":"managedBy","type":"\u0007","is_mandatory":true,"title":"ID of the resource that manages this resource","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"plan":{"name":"plan","type":"\n","is_mandatory":true,"title":"Resource plan","desc":"Azure Marketplace purchase plan for resources deployed from a Marketplace offer, with keys name (plan ID), product (offer ID), publisher, promotionCode, and version.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Resource provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"Resource SKU","desc":"Billing and capacity tier of the resource, with keys name, tier, size, family, model, and capacity.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.21.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure resource","desc":"Generic Azure Resource Manager inventory record for a single resource in a subscription, covering resources of every type (compute, storage, networking, and so on) in one uniform shape. Useful for cross-cutting audits: locating resources by tags, location, or type, checking provisioningState, or reviewing the managed identity attached through identity. Deep, type-specific properties are not populated on this record; query the dedicated resource for a given type when you need those.","private":true,"min_provider_version":"9.0.0","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.resourcegroup":{"id":"azure.subscription.resourcegroup","name":"azure.subscription.resourcegroup","fields":{"deployments":{"name":"deployments","type":"\u0019\u001bazure.subscription.deployment","title":"Azure Resource Manager deployments in the resource group","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource group ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Resource group location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedBy":{"name":"managedBy","type":"\u0007","is_mandatory":true,"title":"ID of the resource that manages this resource group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource group name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Resource group provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource group tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource group type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure resource group","desc":"Logical container that holds related Azure resources and defines a shared location, tag set, and lifecycle boundary for them. Resource groups anchor governance and access control: tags drive cost and ownership policy, location constrains where child resources may live, and provisioningState reports the outcome of the last management operation. A non-empty managedBy marks a group created and owned by another service (for example a managed application or cluster), which should not be modified directly. The deployments field lists the Azure Resource Manager deployments run into the group.","private":true,"min_provider_version":"9.0.0","defaults":"name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.searchService":{"id":"azure.subscription.searchService","name":"azure.subscription.searchService","fields":{"service":{"name":"service","type":"\u001bazure.subscription.searchService.service","title":"Azure AI Search service","desc":"Single Azure AI Search service, the managed service that hosts search indexes, indexers, and data sources. Because the indexes it serves often contain sensitive or business-critical content, its exposure and encryption posture matter: `publicNetworkAccess` and `networkRuleSet` govern reachability from the public internet, `cmkEnforcement` and `cmkEncryptionComplianceStatus` cover customer-managed-key encryption of indexes, and `disableLocalAuth` reports whether API-key authentication is turned off in favor of Microsoft Entra ID.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"services":{"name":"services","type":"\u0019\u001bazure.subscription.searchService.service","title":"Azure AI Search services in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure AI Search","desc":"Azure AI Search services in the subscription. Each service hosts search indexes that frequently hold sensitive or business-critical content, making this the entry point for auditing their public-network exposure, customer-managed-key encryption, and authentication posture.","private":true,"min_provider_version":"13.11.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.searchService.service":{"id":"azure.subscription.searchService.service","name":"azure.subscription.searchService.service","fields":{"cmkEncryptionComplianceStatus":{"name":"cmkEncryptionComplianceStatus","type":"\u0007","is_mandatory":true,"title":"Compliance status for customer-managed-key encryption of indexes (\"Compliant\" or \"NonCompliant\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkEnforcement":{"name":"cmkEnforcement","type":"\u0007","is_mandatory":true,"title":"Customer-managed-key encryption enforcement policy (\"Enabled\", \"Disabled\", or \"Unspecified\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether API-key (local) authentication is disabled, leaving Microsoft Entra ID as the only method","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endpoint":{"name":"endpoint","type":"\u0007","is_mandatory":true,"title":"The endpoint URL of the search service","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostingMode":{"name":"hostingMode","type":"\u0007","is_mandatory":true,"title":"Capacity mode for the service (\"default\" or \"highDensity\"); \"highDensity\" applies only to the standard3 SKU","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Search service resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity configuration","desc":"Keys: `type` (\"None\", \"SystemAssigned\", \"UserAssigned\", or \"SystemAssigned, UserAssigned\"), `userAssignedIdentities` (map of user-assigned identity resource IDs), and the read-only `principalId` and `tenantId` of the system-assigned identity.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Search service location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Search service name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkRuleSet":{"name":"networkRuleSet","type":"\n","is_mandatory":true,"title":"IP firewall rules governing public access","desc":"Keys: `bypass` (\"AzureServices\" lets requests from Azure trusted services skip the IP rules, \"None\" allows no origin to bypass them) and `ipRules`, a list of `{value}` entries where each value is a single IPv4 address or a CIDR range permitted to reach the service endpoint. These rules apply only when `publicNetworkAccess` is \"enabled\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"partitionCount":{"name":"partitionCount","type":"\u0005","is_mandatory":true,"title":"Number of partitions, which determine index size and document-count limits","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the service (\"succeeded\", \"provisioning\", or \"failed\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether the service is reachable from the public internet (\"enabled\" or \"disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicaCount":{"name":"replicaCount","type":"\u0005","is_mandatory":true,"title":"Number of replicas, which determine query throughput and high availability","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"SKU details (name: free, basic, standard, standard2, standard3, storage_optimized_l1, storage_optimized_l2)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Operational status of the service (\"running\", \"provisioning\", \"deleting\", \"degraded\", \"disabled\", \"error\", or \"stopped\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Search service tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure AI Search service","desc":"Single Azure AI Search service, the managed service that hosts search indexes, indexers, and data sources. Because the indexes it serves often contain sensitive or business-critical content, its exposure and encryption posture matter: `publicNetworkAccess` and `networkRuleSet` govern reachability from the public internet, `cmkEnforcement` and `cmkEncryptionComplianceStatus` cover customer-managed-key encryption of indexes, and `disableLocalAuth` reports whether API-key authentication is turned off in favor of Microsoft Entra ID.","min_provider_version":"13.11.3","defaults":"id name location publicNetworkAccess","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sentinelService":{"id":"azure.subscription.sentinelService","name":"azure.subscription.sentinelService","fields":{"alertRule":{"name":"alertRule","type":"\u001bazure.subscription.sentinelService.alertRule","title":"Microsoft Sentinel analytics rule","desc":"Single Sentinel analytics rule. Rules detect threats by running KQL queries on workspace data (Scheduled), correlating alerts across data sources (Fusion), or forwarding alerts from other Microsoft security products (MicrosoftSecurityIncidentCreation). Use `kind` to filter by rule type and `enabled` to identify active detection coverage. Kind-specific configuration (KQL query, trigger thresholds, source product filters) is in `properties`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"automationRule":{"name":"automationRule","type":"\u001bazure.subscription.sentinelService.automationRule","title":"Microsoft Sentinel automation rule","desc":"A rule that automatically triages and responds to incidents or alerts in a Sentinel workspace: it runs actions (change status or severity, assign an owner, add tags, run a Logic Apps playbook) when its trigger and conditions match. Surfaces whether the rule is enabled, what it triggers on, its evaluation order, and its actions. Select by the rule's Azure resource ID. Audit these to confirm incidents are automatically handled and to review which playbooks run on security events.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"incident":{"name":"incident","type":"\u001bazure.subscription.sentinelService.incident","title":"Microsoft Sentinel incident","desc":"A security incident raised in a Sentinel workspace: a case grouping related alerts for investigation and response. Surfaces the title, severity, and status, the classification recorded when an incident is closed, the assigned owner, the labels applied to it, the activity and lifecycle timestamps, and the analytics rules that contributed to it. Audit these to find open, unassigned, or high-severity incidents and to measure how long incidents stay unresolved. Select by the incident's Azure resource ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"ID of the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"watchlist":{"name":"watchlist","type":"\u001bazure.subscription.sentinelService.watchlist","title":"Microsoft Sentinel watchlist","desc":"A reference list of items (IP ranges, user accounts, asset inventories, allow or deny lists) that Sentinel detections, hunting queries, and automation reference by name. Surfaces the alias used to reference it, the source and provider, the search key, and the creation and update provenance. Select by the watchlist's Azure resource ID. Audit these to govern which reference lists shape detection logic.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"workspace":{"name":"workspace","type":"\u001bazure.subscription.sentinelService.workspace","title":"Microsoft Sentinel onboarded Log Analytics workspace","desc":"Log Analytics workspace with Microsoft Sentinel enabled. Surfaces the workspace identity plus the analytics rules and data connectors configured on it. The underlying Log Analytics workspace is reachable via `workspace` for retention, network, and access settings.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"workspaces":{"name":"workspaces","type":"\u0019\u001bazure.subscription.sentinelService.workspace","title":"Sentinel-onboarded Log Analytics workspaces in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Sentinel","desc":"Microsoft Sentinel onboarding and analytics surface in a subscription. Sentinel is layered on a Log Analytics workspace via the SecurityInsights solution; a Log Analytics workspace appears under `workspaces` only when Sentinel has been onboarded on it. Use this to audit which subscriptions have Sentinel coverage, which analytics rules are active, and which data connectors are ingesting telemetry.","private":true,"min_provider_version":"13.12.2","defaults":"subscriptionId","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sentinelService.alertRule":{"id":"azure.subscription.sentinelService.alertRule","name":"azure.subscription.sentinelService.alertRule","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name shown on alerts created by this rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Rule kind (\"Scheduled\", \"Fusion\", \"MicrosoftSecurityIncidentCreation\", \"MLBehaviorAnalytics\", \"NRT\", \"ThreatIntelligence\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Kind-specific properties (e.g., for Scheduled rules: query, queryFrequency, queryPeriod, triggerThreshold)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Severity assigned to alerts created by this rule (\"Informational\", \"Low\", \"Medium\", \"High\"); empty when the kind has no severity","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tactics":{"name":"tactics","type":"\u0019\u0007","is_mandatory":true,"title":"MITRE ATT\u0026CK tactics the rule maps to (e.g., \"Persistence\", \"PrivilegeEscalation\", \"Exfiltration\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Sentinel analytics rule","desc":"Single Sentinel analytics rule. Rules detect threats by running KQL queries on workspace data (Scheduled), correlating alerts across data sources (Fusion), or forwarding alerts from other Microsoft security products (MicrosoftSecurityIncidentCreation). Use `kind` to filter by rule type and `enabled` to identify active detection coverage. Kind-specific configuration (KQL query, trigger thresholds, source product filters) is in `properties`.","private":true,"min_provider_version":"13.12.2","defaults":"name kind enabled severity displayName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sentinelService.automationRule":{"id":"azure.subscription.sentinelService.automationRule","name":"azure.subscription.sentinelService.automationRule","fields":{"actions":{"name":"actions","type":"\u0019\n","is_mandatory":true,"title":"Actions run when the rule matches","desc":"Each entry describes an action by `actionType` (e.g. ModifyProperties, RunPlaybook), its `order`, and the action-specific configuration.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdBy":{"name":"createdBy","type":"\n","is_mandatory":true,"title":"Principal that created the rule","desc":"Keys: `objectId`, `email`, `name`, and `userPrincipalName`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdTime":{"name":"createdTime","type":"\t","is_mandatory":true,"title":"When the rule was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedBy":{"name":"lastModifiedBy","type":"\n","is_mandatory":true,"title":"Principal that last modified the rule","desc":"Keys: `objectId`, `email`, `name`, and `userPrincipalName`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedTime":{"name":"lastModifiedTime","type":"\t","is_mandatory":true,"title":"When the rule was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Automation rule resource name (a GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"order":{"name":"order","type":"\u0005","is_mandatory":true,"title":"Evaluation order relative to other automation rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"triggeringLogic":{"name":"triggeringLogic","type":"\n","is_mandatory":true,"title":"Full triggering logic","desc":"Keys: `isEnabled`, `triggersOn`, `triggersWhen`, `expirationTimeUtc`, and `conditions`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"triggersOn":{"name":"triggersOn","type":"\u0007","is_mandatory":true,"title":"What the rule triggers on (\"Incidents\" or \"Alerts\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"triggersWhen":{"name":"triggersWhen","type":"\u0007","is_mandatory":true,"title":"When the rule triggers (\"Created\" or \"Updated\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Sentinel automation rule","desc":"A rule that automatically triages and responds to incidents or alerts in a Sentinel workspace: it runs actions (change status or severity, assign an owner, add tags, run a Logic Apps playbook) when its trigger and conditions match. Surfaces whether the rule is enabled, what it triggers on, its evaluation order, and its actions. Select by the rule's Azure resource ID. Audit these to confirm incidents are automatically handled and to review which playbooks run on security events.","private":true,"min_provider_version":"13.32.1","defaults":"displayName order isEnabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sentinelService.incident":{"id":"azure.subscription.sentinelService.incident","name":"azure.subscription.sentinelService.incident","fields":{"classification":{"name":"classification","type":"\u0007","is_mandatory":true,"title":"Classification recorded when the incident was closed (\"TruePositive\", \"BenignPositive\", \"FalsePositive\", \"Undetermined\"); empty while open","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"classificationComment":{"name":"classificationComment","type":"\u0007","is_mandatory":true,"title":"Free-text comment recorded with the classification","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"classificationReason":{"name":"classificationReason","type":"\u0007","is_mandatory":true,"title":"Classification reason (\"SuspiciousActivity\", \"SuspiciousButExpected\", \"IncorrectAlertLogic\", \"InaccurateData\"); empty while open","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdTime":{"name":"createdTime","type":"\t","is_mandatory":true,"title":"When the incident was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Incident description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"firstActivityTime":{"name":"firstActivityTime","type":"\t","is_mandatory":true,"title":"Time of the first activity in the incident","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"incidentNumber":{"name":"incidentNumber","type":"\u0005","is_mandatory":true,"title":"Sequential incident number shown in the portal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"incidentUrl":{"name":"incidentUrl","type":"\u0007","is_mandatory":true,"title":"Deep-link URL to the incident in the Azure portal","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"labels":{"name":"labels","type":"\u0019\u0007","is_mandatory":true,"title":"Labels applied to the incident","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastActivityTime":{"name":"lastActivityTime","type":"\t","is_mandatory":true,"title":"Time of the last activity in the incident","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedTime":{"name":"lastModifiedTime","type":"\t","is_mandatory":true,"title":"When the incident was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Incident resource name (a GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ownerAssignedTo":{"name":"ownerAssignedTo","type":"\u0007","is_mandatory":true,"title":"Display name of the user the incident is assigned to; empty when unassigned","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ownerEmail":{"name":"ownerEmail","type":"\u0007","is_mandatory":true,"title":"Email of the assigned owner; empty when unassigned","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ownerObjectId":{"name":"ownerObjectId","type":"\u0007","is_mandatory":true,"title":"Entra object ID of the assigned owner; empty when unassigned","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ownerUserPrincipalName":{"name":"ownerUserPrincipalName","type":"\u0007","is_mandatory":true,"title":"User principal name of the assigned owner; empty when unassigned","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"relatedAnalyticRuleIds":{"name":"relatedAnalyticRuleIds","type":"\u0019\u0007","is_mandatory":true,"title":"ARM resource IDs of the analytics rules related to the incident","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Severity (\"High\", \"Medium\", \"Low\", \"Informational\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (\"New\", \"Active\", \"Closed\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Incident title","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Sentinel incident","desc":"A security incident raised in a Sentinel workspace: a case grouping related alerts for investigation and response. Surfaces the title, severity, and status, the classification recorded when an incident is closed, the assigned owner, the labels applied to it, the activity and lifecycle timestamps, and the analytics rules that contributed to it. Audit these to find open, unassigned, or high-severity incidents and to measure how long incidents stay unresolved. Select by the incident's Azure resource ID.","private":true,"min_provider_version":"13.32.1","defaults":"incidentNumber title severity status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sentinelService.watchlist":{"id":"azure.subscription.sentinelService.watchlist","name":"azure.subscription.sentinelService.watchlist","fields":{"contentType":{"name":"contentType","type":"\u0007","is_mandatory":true,"title":"Content type of the raw content (e.g. \"text/csv\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"When the watchlist was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdBy":{"name":"createdBy","type":"\n","is_mandatory":true,"title":"Principal that created the watchlist","desc":"Keys: `objectId`, `email`, and `name`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultDuration":{"name":"defaultDuration","type":"\u0007","is_mandatory":true,"title":"Default retention duration for items (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"itemsSearchKey":{"name":"itemsSearchKey","type":"\u0007","is_mandatory":true,"title":"Column used as the search key for lookups","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"labels":{"name":"labels","type":"\u0019\u0007","is_mandatory":true,"title":"Labels applied to the watchlist","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Watchlist resource name (a GUID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provider":{"name":"provider","type":"\u0007","is_mandatory":true,"title":"Provider of the watchlist (e.g. \"Microsoft\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Source of the watchlist (\"Local file\" or \"Remote storage\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Tenant that owns the watchlist","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"updated":{"name":"updated","type":"\t","is_mandatory":true,"title":"When the watchlist was last updated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"updatedBy":{"name":"updatedBy","type":"\n","is_mandatory":true,"title":"Principal that last updated the watchlist","desc":"Keys: `objectId`, `email`, and `name`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"uploadStatus":{"name":"uploadStatus","type":"\u0007","is_mandatory":true,"title":"Upload status of the watchlist content","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"watchlistAlias":{"name":"watchlistAlias","type":"\u0007","is_mandatory":true,"title":"Alias used to reference the watchlist from queries and automation","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Sentinel watchlist","desc":"A reference list of items (IP ranges, user accounts, asset inventories, allow or deny lists) that Sentinel detections, hunting queries, and automation reference by name. Surfaces the alias used to reference it, the source and provider, the search key, and the creation and update provenance. Select by the watchlist's Azure resource ID. Audit these to govern which reference lists shape detection logic.","private":true,"min_provider_version":"13.32.1","defaults":"watchlistAlias displayName provider","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sentinelService.workspace":{"id":"azure.subscription.sentinelService.workspace","name":"azure.subscription.sentinelService.workspace","fields":{"alertRules":{"name":"alertRules","type":"\u0019\u001bazure.subscription.sentinelService.alertRule","title":"Sentinel analytics rules configured on the workspace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"automationRules":{"name":"automationRules","type":"\u0019\u001bazure.subscription.sentinelService.automationRule","title":"Automation rules (incident-triage and response automation) in the workspace","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataConnectors":{"name":"dataConnectors","type":"\u0019\n","title":"Data connectors ingesting telemetry into the workspace","desc":"Each entry is a kind-specific dict with `name`, `kind`, and `properties` describing the connector configuration. Kinds include `OfficeATP`, `AzureActiveDirectory`, `AzureSecurityCenter`, `MicrosoftDefenderAdvancedThreatProtection`, and many others.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the underlying Log Analytics workspace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"incidents":{"name":"incidents","type":"\u0019\u001bazure.subscription.sentinelService.incident","title":"Security incidents raised in the workspace","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Workspace name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceGroup":{"name":"resourceGroup","type":"\u0007","is_mandatory":true,"title":"Resource group containing the workspace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription that owns the workspace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"watchlists":{"name":"watchlists","type":"\u0019\u001bazure.subscription.sentinelService.watchlist","title":"Watchlists (reference lists used by detections and hunting) in the workspace","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workspace":{"name":"workspace","type":"\u001bazure.subscription.monitorService.workspace","title":"The underlying Log Analytics workspace","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Sentinel onboarded Log Analytics workspace","desc":"Log Analytics workspace with Microsoft Sentinel enabled. Surfaces the workspace identity plus the analytics rules and data connectors configured on it. The underlying Log Analytics workspace is reachable via `workspace` for retention, network, and access settings.","private":true,"min_provider_version":"13.12.2","defaults":"name resourceGroup subscriptionId","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.serviceBusService":{"id":"azure.subscription.serviceBusService","name":"azure.subscription.serviceBusService","fields":{"authorizationRule":{"name":"authorizationRule","type":"\u001bazure.subscription.serviceBusService.authorizationRule","title":"Service Bus shared access signature authorization rule","desc":"Shared access signature (SAS) policy attached to a Service Bus namespace, queue, or topic, selected by `name`. The `rights` list enumerates the granted permissions: Listen, Send, or Manage. A rule that grants Manage (including the default RootManageSharedAccessKey) confers full control of the entity, so audit these to find over-privileged keys and to confirm SAS access is scoped to the minimum each client needs.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"namespace":{"name":"namespace","type":"\u001bazure.subscription.serviceBusService.namespace","title":"Azure Service Bus namespace","desc":"Messaging scope that owns the queues, topics, and subscriptions of a Service Bus deployment. The SKU and tier (Basic, Standard, Premium) set the available feature set, while `disableLocalAuth`, the customer-managed key encryption settings, and the network rule set govern how clients authenticate and which networks may reach the namespace. Query these to confirm SAS-key access is disabled, public reachability is restricted, and encryption uses a managed key.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"namespaces":{"name":"namespaces","type":"\u0019\u001bazure.subscription.serviceBusService.namespace","title":"List of Service Bus namespaces","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Service Bus service","desc":"Service Bus messaging across the subscription. The `namespaces` field lists every Service Bus namespace, each exposing its SKU and tier, network access controls, encryption settings, and the queues, topics, and subscriptions defined inside it.","private":true,"min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.serviceBusService.authorizationRule":{"id":"azure.subscription.serviceBusService.authorizationRule","name":"azure.subscription.serviceBusService.authorizationRule","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Authorization rule resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Authorization rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rights":{"name":"rights","type":"\u0019\u0007","is_mandatory":true,"title":"Granted rights (Listen, Send, Manage)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Service Bus shared access signature authorization rule","desc":"Shared access signature (SAS) policy attached to a Service Bus namespace, queue, or topic, selected by `name`. The `rights` list enumerates the granted permissions: Listen, Send, or Manage. A rule that grants Manage (including the default RootManageSharedAccessKey) confers full control of the entity, so audit these to find over-privileged keys and to confirm SAS access is scoped to the minimum each client needs.","private":true,"min_provider_version":"13.32.1","defaults":"name rights","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.serviceBusService.namespace":{"id":"azure.subscription.serviceBusService.namespace","name":"azure.subscription.serviceBusService.namespace","fields":{"authorizationRules":{"name":"authorizationRules","type":"\u0019\u001bazure.subscription.serviceBusService.authorizationRule","title":"Shared access signature (SAS) authorization rules on the namespace","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeySource":{"name":"cmkKeySource","type":"\u0007","is_mandatory":true,"title":"CMK key source (\"Microsoft.KeyVault\" when CMK is configured; empty for platform-managed)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKeys":{"name":"cmkKeys","type":"\u0019\n","is_mandatory":true,"title":"Customer-managed encryption keys (Key Vault references) configured for this namespace","desc":"Each entry has keys `keyName`, `keyVaultUri`, `keyVersion`, and `identity` (the user-assigned identity used to reach the vault).","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the namespace was created","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether local (SAS key) authentication is disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Namespace resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Namespace location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Namespace name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkRuleSet":{"name":"networkRuleSet","type":"\n","title":"Raw namespace network rule set","desc":"Deprecated in favor of `networkRules()`.","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"networkRules":{"name":"networkRules","type":"\u001bazure.subscription.serviceBusService.namespace.networkRules","title":"Namespace network rules (default action, public network access, IP / VNet rules, trusted-service access)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections to the namespace","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"queue":{"name":"queue","type":"\u001bazure.subscription.serviceBusService.namespace.queue","title":"Azure Service Bus queue","desc":"First-in-first-out message queue within a Service Bus namespace, selected by `name`. The `status` controls whether send and receive are enabled, `messageCount` and `deadLetterMessageCount` report backlog and poison-message volume, and `requiresSession`, `requiresDuplicateDetection`, and `maxDeliveryCount` govern delivery semantics.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"queues":{"name":"queues","type":"\u0019\u001bazure.subscription.serviceBusService.namespace.queue","title":"Queues in this namespace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requireInfrastructureEncryption":{"name":"requireInfrastructureEncryption","type":"\u0004","is_mandatory":true,"title":"Whether double encryption (infrastructure layer + CMK) is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceBusEndpoint":{"name":"serviceBusEndpoint","type":"\u0007","is_mandatory":true,"title":"Service Bus endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"SKU details","desc":"Keys: `name` and `tier` (Basic, Standard, or Premium) plus `capacity` (messaging unit count, Premium only).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Namespace status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Namespace tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"topic":{"name":"topic","type":"\u001bazure.subscription.serviceBusService.namespace.topic","title":"Azure Service Bus topic","desc":"Publish-subscribe messaging entity within a Service Bus namespace, selected by `name`. Messages sent to the topic fan out to its `subscriptions`. The `status`, `enablePartitioning`, `supportOrdering`, and `requiresDuplicateDetection` fields describe its availability and delivery behavior.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"topics":{"name":"topics","type":"\u0019\u001bazure.subscription.serviceBusService.namespace.topic","title":"Topics in this namespace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zoneRedundant":{"name":"zoneRedundant","type":"\u0004","is_mandatory":true,"title":"Whether the namespace is zone-redundant","min_provider_version":"13.4.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Service Bus namespace","desc":"Messaging scope that owns the queues, topics, and subscriptions of a Service Bus deployment. The SKU and tier (Basic, Standard, Premium) set the available feature set, while `disableLocalAuth`, the customer-managed key encryption settings, and the network rule set govern how clients authenticate and which networks may reach the namespace. Query these to confirm SAS-key access is disabled, public reachability is restricted, and encryption uses a managed key.","min_provider_version":"13.3.3","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.serviceBusService.namespace.networkRules":{"id":"azure.subscription.serviceBusService.namespace.networkRules","name":"azure.subscription.serviceBusService.namespace.networkRules","fields":{"defaultAction":{"name":"defaultAction","type":"\u0007","is_mandatory":true,"title":"Default action for traffic that does not match any rule (\"Allow\" or \"Deny\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipRules":{"name":"ipRules","type":"\u0019\n","is_mandatory":true,"title":"IP allow rules. Each entry is `{ipMask, action}` where `action` is \"Allow\".","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether traffic is allowed over the public network (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trustedServiceAccessEnabled":{"name":"trustedServiceAccessEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Microsoft-owned trusted services can bypass the rule set","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkRule":{"name":"virtualNetworkRule","type":"\u001bazure.subscription.serviceBusService.namespace.networkRules.virtualNetworkRule","title":"Service Bus namespace virtual network rule","desc":"Single VNet rule attached to a Service Bus namespace, resolving to the referenced `subnet`. The `ignoreMissingVnetServiceEndpoint` flag indicates whether the rule permits traffic from the subnet even when the subnet has not yet enabled the Microsoft.ServiceBus service endpoint.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualNetworkRules":{"name":"virtualNetworkRules","type":"\u0019\u001bazure.subscription.serviceBusService.namespace.networkRules.virtualNetworkRule","is_mandatory":true,"title":"Virtual network rules; each references a subnet","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Service Bus namespace network rule set","desc":"Network access policy governing which traffic may reach a Service Bus namespace. `defaultAction` (Allow or Deny) applies to traffic that matches no rule, `publicNetworkAccess` toggles public reachability, and `trustedServiceAccessEnabled` lets Microsoft-owned services bypass the rule set. The `ipRules` and `virtualNetworkRules` lists enumerate the allowed IP ranges and subnets.","private":true,"min_provider_version":"13.12.2","defaults":"defaultAction publicNetworkAccess trustedServiceAccessEnabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.serviceBusService.namespace.networkRules.virtualNetworkRule":{"id":"azure.subscription.serviceBusService.namespace.networkRules.virtualNetworkRule","name":"azure.subscription.serviceBusService.namespace.networkRules.virtualNetworkRule","fields":{"ignoreMissingVnetServiceEndpoint":{"name":"ignoreMissingVnetServiceEndpoint","type":"\u0004","is_mandatory":true,"title":"Whether to allow traffic from the subnet even if the Microsoft.ServiceBus service endpoint is not yet enabled on it","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet referenced by the rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Service Bus namespace virtual network rule","desc":"Single VNet rule attached to a Service Bus namespace, resolving to the referenced `subnet`. The `ignoreMissingVnetServiceEndpoint` flag indicates whether the rule permits traffic from the subnet even when the subnet has not yet enabled the Microsoft.ServiceBus service endpoint.","private":true,"min_provider_version":"13.12.2","defaults":"ignoreMissingVnetServiceEndpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.serviceBusService.namespace.queue":{"id":"azure.subscription.serviceBusService.namespace.queue","name":"azure.subscription.serviceBusService.namespace.queue","fields":{"authorizationRules":{"name":"authorizationRules","type":"\u0019\u001bazure.subscription.serviceBusService.authorizationRule","title":"Shared access signature (SAS) authorization rules on the queue","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the queue was created","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deadLetterMessageCount":{"name":"deadLetterMessageCount","type":"\u0005","is_mandatory":true,"title":"Number of messages in the dead-letter sub-queue","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultMessageTimeToLive":{"name":"defaultMessageTimeToLive","type":"\u0007","is_mandatory":true,"title":"Default time-to-live for messages (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablePartitioning":{"name":"enablePartitioning","type":"\u0004","is_mandatory":true,"title":"Whether partitioning is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Queue resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lockDuration":{"name":"lockDuration","type":"\u0007","is_mandatory":true,"title":"Lock duration (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxDeliveryCount":{"name":"maxDeliveryCount","type":"\u0005","is_mandatory":true,"title":"Maximum delivery count before dead-lettering","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxSizeInMegabytes":{"name":"maxSizeInMegabytes","type":"\u0005","is_mandatory":true,"title":"Maximum queue size in megabytes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"messageCount":{"name":"messageCount","type":"\u0005","is_mandatory":true,"title":"Number of messages in the queue","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Queue name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requiresDuplicateDetection":{"name":"requiresDuplicateDetection","type":"\u0004","is_mandatory":true,"title":"Whether duplicate detection is required","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requiresSession":{"name":"requiresSession","type":"\u0004","is_mandatory":true,"title":"Whether sessions are required","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Queue status (Active, Disabled, SendDisabled, ReceiveDisabled)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Service Bus queue","desc":"First-in-first-out message queue within a Service Bus namespace, selected by `name`. The `status` controls whether send and receive are enabled, `messageCount` and `deadLetterMessageCount` report backlog and poison-message volume, and `requiresSession`, `requiresDuplicateDetection`, and `maxDeliveryCount` govern delivery semantics.","private":true,"min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.serviceBusService.namespace.topic":{"id":"azure.subscription.serviceBusService.namespace.topic","name":"azure.subscription.serviceBusService.namespace.topic","fields":{"authorizationRules":{"name":"authorizationRules","type":"\u0019\u001bazure.subscription.serviceBusService.authorizationRule","title":"Shared access signature (SAS) authorization rules on the topic","min_provider_version":"13.32.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the topic was created","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultMessageTimeToLive":{"name":"defaultMessageTimeToLive","type":"\u0007","is_mandatory":true,"title":"Default time-to-live for messages (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enablePartitioning":{"name":"enablePartitioning","type":"\u0004","is_mandatory":true,"title":"Whether partitioning is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Topic resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxSizeInMegabytes":{"name":"maxSizeInMegabytes","type":"\u0005","is_mandatory":true,"title":"Maximum topic size in megabytes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Topic name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requiresDuplicateDetection":{"name":"requiresDuplicateDetection","type":"\u0004","is_mandatory":true,"title":"Whether duplicate detection is required","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Topic status (Active, Disabled, SendDisabled)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscription":{"name":"subscription","type":"\u001bazure.subscription.serviceBusService.namespace.topic.subscription","title":"Azure Service Bus topic subscription","desc":"Named subscription attached to a Service Bus topic, selected by `name`, that receives a copy of the topic's messages. The `status`, `messageCount`, `deadLetterMessageCount`, `maxDeliveryCount`, and `requiresSession` fields describe its delivery state and semantics.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subscriptionCount":{"name":"subscriptionCount","type":"\u0005","is_mandatory":true,"title":"Number of subscriptions on the topic","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptions":{"name":"subscriptions","type":"\u0019\u001bazure.subscription.serviceBusService.namespace.topic.subscription","title":"Subscriptions on this topic","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"supportOrdering":{"name":"supportOrdering","type":"\u0004","is_mandatory":true,"title":"Whether ordering is supported","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Service Bus topic","desc":"Publish-subscribe messaging entity within a Service Bus namespace, selected by `name`. Messages sent to the topic fan out to its `subscriptions`. The `status`, `enablePartitioning`, `supportOrdering`, and `requiresDuplicateDetection` fields describe its availability and delivery behavior.","private":true,"min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.serviceBusService.namespace.topic.subscription":{"id":"azure.subscription.serviceBusService.namespace.topic.subscription","name":"azure.subscription.serviceBusService.namespace.topic.subscription","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the subscription was created","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deadLetterMessageCount":{"name":"deadLetterMessageCount","type":"\u0005","is_mandatory":true,"title":"Number of messages in the dead-letter sub-queue","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultMessageTimeToLive":{"name":"defaultMessageTimeToLive","type":"\u0007","is_mandatory":true,"title":"Default time-to-live for messages (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Subscription resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lockDuration":{"name":"lockDuration","type":"\u0007","is_mandatory":true,"title":"Lock duration (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maxDeliveryCount":{"name":"maxDeliveryCount","type":"\u0005","is_mandatory":true,"title":"Maximum delivery count before dead-lettering","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"messageCount":{"name":"messageCount","type":"\u0005","is_mandatory":true,"title":"Number of messages in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Subscription name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requiresSession":{"name":"requiresSession","type":"\u0004","is_mandatory":true,"title":"Whether sessions are required","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Subscription status (Active, Disabled, ReceiveDisabled)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Service Bus topic subscription","desc":"Named subscription attached to a Service Bus topic, selected by `name`, that receives a copy of the topic's messages. The `status`, `messageCount`, `deadLetterMessageCount`, `maxDeliveryCount`, and `requiresSession` fields describe its delivery state and semantics.","private":true,"min_provider_version":"13.3.3","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.signalRService":{"id":"azure.subscription.signalRService","name":"azure.subscription.signalRService","fields":{"instances":{"name":"instances","type":"\u0019\u001bazure.subscription.signalRService.signalR","title":"Azure SignalR Service instances in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"signalR":{"name":"signalR","type":"\u001bazure.subscription.signalRService.signalR","title":"Azure SignalR Service instance","desc":"Single Azure SignalR Service instance providing real-time WebSocket messaging. The `publicNetworkAccess` field confirms whether the instance is reachable from the public internet, `disableLocalAuth` and `disableAadAuth` report which authentication methods are enabled, `clientCertEnabled` reports whether mutual TLS client certificates are required, and `networkAclsDefaultAction` is the default network rule applied when no ACL matches.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SignalR Service","desc":"Real-time messaging (WebSockets) service instances in the subscription, each available through `instances`. SignalR delivers server-to-client push messaging for applications. Auditing the instances surfaces public network exposure and the authentication methods enabled on each.","private":true,"min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.signalRService.signalR":{"id":"azure.subscription.signalRService.signalR","name":"azure.subscription.signalRService.signalR","fields":{"clientCertEnabled":{"name":"clientCertEnabled","type":"\u0004","is_mandatory":true,"title":"Whether mutual TLS client certificate authentication is required","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableAadAuth":{"name":"disableAadAuth","type":"\u0004","is_mandatory":true,"title":"Whether Microsoft Entra ID (AAD) authentication is disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether access-key (local) authentication is disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"externalIp":{"name":"externalIp","type":"\u0007","is_mandatory":true,"title":"External IP of the instance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostName":{"name":"hostName","type":"\u0007","is_mandatory":true,"title":"Public hostname clients connect to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"SignalR resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Identity configuration","desc":"Managed identity assigned to the instance with keys `type` (None, SystemAssigned, or UserAssigned), `userAssignedIdentities`, `principalId`, and `tenantId`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Service mode kind (\"SignalR\" or \"RawWebSockets\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"SignalR resource location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"SignalR resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkAclsDefaultAction":{"name":"networkAclsDefaultAction","type":"\u0007","is_mandatory":true,"title":"Default action applied when no network ACL matches (\"Allow\" or \"Deny\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections to the instance","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether the instance is reachable from the public internet (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"SKU details","desc":"Pricing tier of the instance with keys `name` (e.g. Standard_S1, Free_F1), `tier` (Free, Basic, Standard, or Premium), `capacity` (unit count), `family`, and `size`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"SignalR resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Service software version","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SignalR Service instance","desc":"Single Azure SignalR Service instance providing real-time WebSocket messaging. The `publicNetworkAccess` field confirms whether the instance is reachable from the public internet, `disableLocalAuth` and `disableAadAuth` report which authentication methods are enabled, `clientCertEnabled` reports whether mutual TLS client certificates are required, and `networkAclsDefaultAction` is the default network rule applied when no ACL matches.","min_provider_version":"13.16.2","defaults":"id name location publicNetworkAccess","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService":{"id":"azure.subscription.sqlService","name":"azure.subscription.sqlService","fields":{"configuration":{"name":"configuration","type":"\u001bazure.subscription.sqlService.configuration","title":"Azure SQL configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"database":{"name":"database","type":"\u001bazure.subscription.sqlService.database","title":"Azure SQL Database service database","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"databaseusage":{"name":"databaseusage","type":"\u001bazure.subscription.sqlService.databaseusage","title":"Azure SQL Database service database usage","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"firewallrule":{"name":"firewallrule","type":"\u001bazure.subscription.sqlService.firewallrule","title":"Azure SQL firewall rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"managedInstance":{"name":"managedInstance","type":"\u001bazure.subscription.sqlService.managedInstance","title":"Azure SQL Managed Instance","desc":"Fully-managed SQL Server instance deployed inside a virtual network, pairing broad SQL Server engine compatibility with platform-managed backups, patching, and high availability. Exposes the security-relevant posture of the instance: the minimum TLS version enforced, whether the public data endpoint is reachable from outside the virtual network, the connection type override, zone redundancy, current and requested backup storage redundancy, and the managed identity and customer-managed-key encryption configuration. The subnet the instance is joined to is reachable through subnet, and the managed databases it hosts through databases.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"managedInstances":{"name":"managedInstances","type":"\u0019\u001bazure.subscription.sqlService.managedInstance","title":"List of SQL managed instances","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"server":{"name":"server","type":"\u001bazure.subscription.sqlService.server","title":"Azure SQL Database server","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"servers":{"name":"servers","type":"\u0019\u001bazure.subscription.sqlService.server","title":"List of servers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkRule":{"name":"virtualNetworkRule","type":"\u001bazure.subscription.sqlService.virtualNetworkRule","title":"Azure SQL virtual network rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"vulnerabilityAssessmentScan":{"name":"vulnerabilityAssessmentScan","type":"\u001bazure.subscription.sqlService.vulnerabilityAssessmentScan","title":"Azure SQL Database vulnerability assessment scan record (shared between server and database scope)","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true}},"title":"Azure SQL","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.configuration":{"id":"azure.subscription.sqlService.configuration","name":"azure.subscription.sqlService.configuration","fields":{"allowedValues":{"name":"allowedValues","type":"\u0007","is_mandatory":true,"title":"SQL configuration allowed values","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataType":{"name":"dataType","type":"\u0007","is_mandatory":true,"title":"SQL configuration data type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultValue":{"name":"defaultValue","type":"\u0007","is_mandatory":true,"title":"SQL configuration default value","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"SQL configuration description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"SQL configuration ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"SQL configuration name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"SQL configuration source","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"SQL configuration type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"SQL configuration value","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL configuration","private":true,"min_provider_version":"9.0.1","defaults":"name value","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.database":{"id":"azure.subscription.sqlService.database","name":"azure.subscription.sqlService.database","fields":{"advancedThreatProtection":{"name":"advancedThreatProtection","type":"\u001bazure.subscription.sqlService.database.advancedthreatprotection","title":"SQL database advanced threat protection settings","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"advancedthreatprotection":{"name":"advancedthreatprotection","type":"\u001bazure.subscription.sqlService.database.advancedthreatprotection","title":"Azure SQL Database advanced threat protection settings","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"advisor":{"name":"advisor","type":"\u0019\n","title":"Automatic tuning advisors for the database","desc":"Raw Database Advisor objects returned by Azure SQL. Each entry has `id`, `name`, `type`, and a `properties` object whose `recommendedActions` list holds the index and query-plan recommendations Azure SQL generated for the database.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"auditingPolicy":{"name":"auditingPolicy","type":"\n","title":"Raw database auditing policy","desc":"Deprecated in favor of `blobAuditingPolicy`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"backupShortTermRetentionPolicy":{"name":"backupShortTermRetentionPolicy","type":"\u001bazure.subscription.sqlService.database.backupshorttermretentionpolicy","title":"SQL database backup short-term retention policy","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"backupshorttermretentionpolicy":{"name":"backupshorttermretentionpolicy","type":"\u001bazure.subscription.sqlService.database.backupshorttermretentionpolicy","title":"Azure SQL Database backup short-term retention policy","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"blobAuditingPolicy":{"name":"blobAuditingPolicy","type":"\u001bazure.subscription.sqlService.database.blobAuditingPolicy","title":"Database-level SQL Auditing (blob auditing) policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"collation":{"name":"collation","type":"\u0007","is_mandatory":true,"title":"SQL database collation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionPolicy":{"name":"connectionPolicy","type":"\n","title":"Legacy per-database connection policy","desc":"Deprecated, please use `azure.subscription.sqlService.server.connectionType`. Azure SQL DB has no per-database connection policy.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"createMode":{"name":"createMode","type":"\u0007","is_mandatory":true,"title":"SQL database create mode","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationDate":{"name":"creationDate","type":"\t","is_mandatory":true,"title":"SQL database create date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataMaskingPolicy":{"name":"dataMaskingPolicy","type":"\u001bazure.subscription.sqlService.database.dataMaskingPolicy","title":"Database-level Dynamic Data Masking (DDM) policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataMaskingRule":{"name":"dataMaskingRule","type":"\u001bazure.subscription.sqlService.database.dataMaskingRule","title":"Azure SQL Database Dynamic Data Masking rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"databaseId":{"name":"databaseId","type":"\u0007","is_mandatory":true,"title":"Database ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultSecondaryLocation":{"name":"defaultSecondaryLocation","type":"\u0007","is_mandatory":true,"title":"SQL database default secondary location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"earliestRestoreDate":{"name":"earliestRestoreDate","type":"\t","is_mandatory":true,"title":"SQL database earliest restore date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"edition":{"name":"edition","type":"\u0007","is_mandatory":true,"title":"SQL database edition","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"elasticPoolName":{"name":"elasticPoolName","type":"\u0007","is_mandatory":true,"title":"SQL database elastic pool name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"failoverGroupId":{"name":"failoverGroupId","type":"\u0007","is_mandatory":true,"title":"SQL database failover group ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"geoBackupPolicy":{"name":"geoBackupPolicy","type":"\u001bazure.subscription.sqlService.database.geoBackupPolicy","title":"Database-level geo backup policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"SQL database ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ledgerDigestUpload":{"name":"ledgerDigestUpload","type":"\u001bazure.subscription.sqlService.database.ledgerDigestUpload","title":"Database-level immutable ledger digest upload configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"longTermRetentionPolicy":{"name":"longTermRetentionPolicy","type":"\u001bazure.subscription.sqlService.database.longtermretentionpolicy","title":"SQL database backup long-term retention policy","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"longtermretentionpolicy":{"name":"longtermretentionpolicy","type":"\u001bazure.subscription.sqlService.database.longtermretentionpolicy","title":"Azure SQL Database backup long-term retention policy","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"maxSizeBytes":{"name":"maxSizeBytes","type":"\u0005","is_mandatory":true,"title":"SQL database maximum byte size","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"SQL database name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"readScale":{"name":"readScale","type":"\u0007","is_mandatory":true,"title":"SQL database read scale","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"recoveryServicesRecoveryPointResourceId":{"name":"recoveryServicesRecoveryPointResourceId","type":"\u0007","is_mandatory":true,"title":"SQL database recovery services recovery point ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requestedServiceObjectiveName":{"name":"requestedServiceObjectiveName","type":"\u0007","is_mandatory":true,"title":"SQL database requested objective name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"restorePointInTime":{"name":"restorePointInTime","type":"\t","is_mandatory":true,"title":"SQL database restore point in time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sampleName":{"name":"sampleName","type":"\u0007","is_mandatory":true,"title":"SQL database sample name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityAlertPolicy":{"name":"securityAlertPolicy","type":"\u001bazure.subscription.sqlService.database.securityAlertPolicy","title":"Database-level security alert (threat detection) policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serviceLevelObjective":{"name":"serviceLevelObjective","type":"\u0007","is_mandatory":true,"title":"SQL database service level objective","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceDatabaseDeletionDate":{"name":"sourceDatabaseDeletionDate","type":"\t","is_mandatory":true,"title":"SQL database deletion date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceDatabaseId":{"name":"sourceDatabaseId","type":"\u0007","is_mandatory":true,"title":"SQL database source database ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"SQL database status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"threatDetectionPolicy":{"name":"threatDetectionPolicy","type":"\n","title":"Legacy preview threat detection policy","desc":"Deprecated in favor of `securityAlertPolicy`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"transparentDataEncryption":{"name":"transparentDataEncryption","type":"\n","title":"Raw transparent data encryption configuration","desc":"Deprecated in favor of `transparentDataEncryptionEnabled`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"transparentDataEncryptionEnabled":{"name":"transparentDataEncryptionEnabled","type":"\u0004","title":"Whether Transparent Data Encryption is enabled for this database","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"SQL database type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"usage":{"name":"usage","type":"\u0019\u001bazure.subscription.sqlService.databaseusage","title":"SQL database usage","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vulnerabilityAssessment":{"name":"vulnerabilityAssessment","type":"\u001bazure.subscription.sqlService.database.vulnerabilityAssessment","title":"Database-level vulnerability assessment configuration and scans","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zoneRedundant":{"name":"zoneRedundant","type":"\u0004","is_mandatory":true,"title":"Whether the database is zone redundant","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database service database","private":true,"min_provider_version":"9.0.1","defaults":"name edition zoneRedundant status creationDate maxSizeBytes earliestRestoreDate","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.database.advancedthreatprotection":{"id":"azure.subscription.sqlService.database.advancedthreatprotection","name":"azure.subscription.sqlService.database.advancedthreatprotection","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"UTC creation time of the policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Threat protection state (\"Enabled\", \"Disabled\", or \"New\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database advanced threat protection settings","private":true,"min_provider_version":"11.4.28","defaults":"state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.database.backupshorttermretentionpolicy":{"id":"azure.subscription.sqlService.database.backupshorttermretentionpolicy","name":"azure.subscription.sqlService.database.backupshorttermretentionpolicy","fields":{"diffBackupIntervalInHours":{"name":"diffBackupIntervalInHours","type":"\u0005","is_mandatory":true,"title":"Differential backup interval in hours (12 or 24)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionDays":{"name":"retentionDays","type":"\u0005","is_mandatory":true,"title":"Backup retention period in days (Point-in-Time Restore window)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database backup short-term retention policy","private":true,"min_provider_version":"11.4.28","defaults":"retentionDays","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.database.blobAuditingPolicy":{"id":"azure.subscription.sqlService.database.blobAuditingPolicy","name":"azure.subscription.sqlService.database.blobAuditingPolicy","fields":{"auditActionsAndGroups":{"name":"auditActionsAndGroups","type":"\u0019\u0007","is_mandatory":true,"title":"SQL audit action groups and individual actions audited by the policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isAzureMonitorTargetEnabled":{"name":"isAzureMonitorTargetEnabled","type":"\u0004","is_mandatory":true,"title":"Whether audit events are sent to Azure Monitor","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isManagedIdentityInUse":{"name":"isManagedIdentityInUse","type":"\u0004","is_mandatory":true,"title":"Whether managed identity is used for the audit storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isStorageSecondaryKeyInUse":{"name":"isStorageSecondaryKeyInUse","type":"\u0004","is_mandatory":true,"title":"Whether the secondary storage account access key is in use","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"queueDelayMs":{"name":"queueDelayMs","type":"\u0005","is_mandatory":true,"title":"Audit log queue delay in milliseconds","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionDays":{"name":"retentionDays","type":"\u0005","is_mandatory":true,"title":"Number of days to retain audit logs in storage (0 = unlimited)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Auditing state (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAccountSubscriptionId":{"name":"storageAccountSubscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription ID of the audit storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageEndpoint":{"name":"storageEndpoint","type":"\u0007","is_mandatory":true,"title":"Audit log storage account blob endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database database-level blob auditing policy","private":true,"min_provider_version":"13.8.2","defaults":"state retentionDays","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.database.dataMaskingPolicy":{"id":"azure.subscription.sqlService.database.dataMaskingPolicy","name":"azure.subscription.sqlService.database.dataMaskingPolicy","fields":{"dataMaskingState":{"name":"dataMaskingState","type":"\u0007","is_mandatory":true,"title":"Data masking state (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"exemptPrincipals":{"name":"exemptPrincipals","type":"\u0007","is_mandatory":true,"title":"Comma-separated list of SQL users excluded from data masking","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Resource kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Resource location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maskingLevel":{"name":"maskingLevel","type":"\u0007","is_mandatory":true,"title":"Masking level","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rules":{"name":"rules","type":"\u0019\u001bazure.subscription.sqlService.database.dataMaskingRule","title":"Data masking rules defined on the database","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database Dynamic Data Masking (DDM) policy","private":true,"min_provider_version":"13.8.2","defaults":"dataMaskingState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.database.dataMaskingRule":{"id":"azure.subscription.sqlService.database.dataMaskingRule","name":"azure.subscription.sqlService.database.dataMaskingRule","fields":{"aliasName":{"name":"aliasName","type":"\u0007","is_mandatory":true,"title":"Alias name for the rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"columnName":{"name":"columnName","type":"\u0007","is_mandatory":true,"title":"Column being masked","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maskingFunction":{"name":"maskingFunction","type":"\u0007","is_mandatory":true,"title":"Masking function (\"Default\", \"CCN\", \"Email\", \"Number\", \"SSN\", \"Text\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"numberFrom":{"name":"numberFrom","type":"\u0007","is_mandatory":true,"title":"Lower bound of the random interval used by the Number masking function","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"numberTo":{"name":"numberTo","type":"\u0007","is_mandatory":true,"title":"Upper bound of the random interval used by the Number masking function","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"prefixSize":{"name":"prefixSize","type":"\u0007","is_mandatory":true,"title":"Number of leading characters preserved by the Text masking function","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replacementString":{"name":"replacementString","type":"\u0007","is_mandatory":true,"title":"Replacement string used by the Text masking function","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ruleId":{"name":"ruleId","type":"\u0007","is_mandatory":true,"title":"Rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ruleState":{"name":"ruleState","type":"\u0007","is_mandatory":true,"title":"Rule state (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Schema of the masked column","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"suffixSize":{"name":"suffixSize","type":"\u0007","is_mandatory":true,"title":"Number of trailing characters preserved by the Text masking function","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tableName":{"name":"tableName","type":"\u0007","is_mandatory":true,"title":"Table of the masked column","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database Dynamic Data Masking rule","private":true,"min_provider_version":"13.8.2","defaults":"schemaName tableName columnName maskingFunction","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.database.geoBackupPolicy":{"id":"azure.subscription.sqlService.database.geoBackupPolicy","name":"azure.subscription.sqlService.database.geoBackupPolicy","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Geo backup state (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageType":{"name":"storageType","type":"\u0007","is_mandatory":true,"title":"Storage type used for geo backups","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database geo backup policy","private":true,"min_provider_version":"13.8.2","defaults":"state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.database.ledgerDigestUpload":{"id":"azure.subscription.sqlService.database.ledgerDigestUpload","name":"azure.subscription.sqlService.database.ledgerDigestUpload","fields":{"digestStorageEndpoint":{"name":"digestStorageEndpoint","type":"\u0007","is_mandatory":true,"title":"Storage endpoint where ledger digests are uploaded","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Ledger digest upload state (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database immutable ledger digest upload configuration","private":true,"min_provider_version":"13.8.2","defaults":"state digestStorageEndpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.database.longtermretentionpolicy":{"id":"azure.subscription.sqlService.database.longtermretentionpolicy","name":"azure.subscription.sqlService.database.longtermretentionpolicy","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"monthlyRetention":{"name":"monthlyRetention","type":"\u0007","is_mandatory":true,"title":"Monthly retention in ISO 8601 duration format (e.g. \"P1M\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"weekOfYear":{"name":"weekOfYear","type":"\u0005","is_mandatory":true,"title":"Week of year for the yearly backup (1-52)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"weeklyRetention":{"name":"weeklyRetention","type":"\u0007","is_mandatory":true,"title":"Weekly retention in ISO 8601 duration format (e.g. \"P1W\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"yearlyRetention":{"name":"yearlyRetention","type":"\u0007","is_mandatory":true,"title":"Yearly retention in ISO 8601 duration format (e.g. \"P1Y\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database backup long-term retention policy","private":true,"min_provider_version":"11.4.28","defaults":"weeklyRetention monthlyRetention","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.database.securityAlertPolicy":{"id":"azure.subscription.sqlService.database.securityAlertPolicy","name":"azure.subscription.sqlService.database.securityAlertPolicy","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"UTC creation time of the policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disabledAlerts":{"name":"disabledAlerts","type":"\u0019\u0007","is_mandatory":true,"title":"List of alert types disabled for this policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"emailAccountAdmins":{"name":"emailAccountAdmins","type":"\u0004","is_mandatory":true,"title":"Whether subscription administrators and database owners receive alert email","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"emailAddresses":{"name":"emailAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Email addresses that receive alert notifications","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionDays":{"name":"retentionDays","type":"\u0005","is_mandatory":true,"title":"Number of days to retain threat detection logs in storage (0 = unlimited)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Alert policy state (\"Enabled\", \"Disabled\", or \"New\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageEndpoint":{"name":"storageEndpoint","type":"\u0007","is_mandatory":true,"title":"Storage account blob endpoint that receives audited events for threat detection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database database-level security alert policy","private":true,"min_provider_version":"13.8.2","defaults":"state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.database.vulnerabilityAssessment":{"id":"azure.subscription.sqlService.database.vulnerabilityAssessment","name":"azure.subscription.sqlService.database.vulnerabilityAssessment","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mailSubscriptionAdmins":{"name":"mailSubscriptionAdmins","type":"\u0004","is_mandatory":true,"title":"Whether subscription administrators are notified after a scan","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"recurringScanEmails":{"name":"recurringScanEmails","type":"\u0019\u0007","is_mandatory":true,"title":"Email addresses notified after a scheduled scan completes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"recurringScansEnabled":{"name":"recurringScansEnabled","type":"\u0004","is_mandatory":true,"title":"Whether recurring scans are enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scans":{"name":"scans","type":"\u0019\u001bazure.subscription.sqlService.vulnerabilityAssessmentScan","title":"Vulnerability assessment scan records for the database","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageContainerPath":{"name":"storageContainerPath","type":"\u0007","is_mandatory":true,"title":"Storage container path that holds VA scan results","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database database-level vulnerability assessment configuration","private":true,"min_provider_version":"13.8.2","defaults":"recurringScansEnabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.databaseusage":{"id":"azure.subscription.sqlService.databaseusage","name":"azure.subscription.sqlService.databaseusage","fields":{"currentValue":{"name":"currentValue","type":"\u0006","is_mandatory":true,"title":"Database usage current value","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Database usage display name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Database usage ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"limit":{"name":"limit","type":"\u0006","is_mandatory":true,"title":"Database usage limit","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Database usage name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resourceName":{"name":"resourceName","type":"\u0007","is_mandatory":true,"title":"Database usage resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"unit":{"name":"unit","type":"\u0007","is_mandatory":true,"title":"Database usage unit","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database service database usage","private":true,"min_provider_version":"9.0.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.firewallrule":{"id":"azure.subscription.sqlService.firewallrule","name":"azure.subscription.sqlService.firewallrule","fields":{"endIpAddress":{"name":"endIpAddress","type":"\u0007","is_mandatory":true,"title":"SQL firewall rule end IP address","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"SQL firewall rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"SQL firewall rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"startIpAddress":{"name":"startIpAddress","type":"\u0007","is_mandatory":true,"title":"SQL firewall rule start IP address","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"SQL firewall rule type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL firewall rule","private":true,"min_provider_version":"9.0.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.managedInstance":{"id":"azure.subscription.sqlService.managedInstance","name":"azure.subscription.sqlService.managedInstance","fields":{"administratorLogin":{"name":"administratorLogin","type":"\u0007","is_mandatory":true,"title":"SQL administrator login name (the admin user, never the password)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"collation":{"name":"collation","type":"\u0007","is_mandatory":true,"title":"Database collation (default for managed databases on this instance)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"currentBackupStorageRedundancy":{"name":"currentBackupStorageRedundancy","type":"\u0007","is_mandatory":true,"title":"Backup storage redundancy currently in use (\"Local\", \"Zone\", \"Geo\", \"GeoZone\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"database":{"name":"database","type":"\u001bazure.subscription.sqlService.managedInstance.database","title":"Azure SQL Managed Instance database","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"databases":{"name":"databases","type":"\u0019\u001bazure.subscription.sqlService.managedInstance.database","title":"Managed databases hosted on this instance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dnsZone":{"name":"dnsZone","type":"\u0007","is_mandatory":true,"title":"DNS zone (paired managed instances share the same DNS zone)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionKey":{"name":"encryptionKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used for transparent data encryption (null when service-managed)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fullyQualifiedDomainName":{"name":"fullyQualifiedDomainName","type":"\u0007","is_mandatory":true,"title":"Fully qualified domain name used to connect to the instance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID of the managed instance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityType":{"name":"identityType","type":"\u0007","is_mandatory":true,"title":"Identity type (\"None\", \"SystemAssigned\", \"UserAssigned\", or \"SystemAssigned,UserAssigned\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"instancePoolId":{"name":"instancePoolId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the parent instance pool (empty for standalone instances)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"licenseType":{"name":"licenseType","type":"\u0007","is_mandatory":true,"title":"License type (\"LicenseIncluded\" or \"BasePrice\" for AHB)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Resource location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maintenanceConfigurationId":{"name":"maintenanceConfigurationId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the maintenance configuration applied to this instance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minimalTlsVersion":{"name":"minimalTlsVersion","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version enforced on the instance (\"None\", \"1.0\", \"1.1\", \"1.2\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Managed instance name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"primaryUserAssignedIdentity":{"name":"primaryUserAssignedIdentity","type":"\u001bazure.subscription.managedIdentity","title":"Primary user-assigned managed identity (null when not configured or only system-assigned)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnectionCount":{"name":"privateEndpointConnectionCount","type":"\u0005","is_mandatory":true,"title":"Number of private endpoint connections to the instance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the instance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"proxyOverride":{"name":"proxyOverride","type":"\u0007","is_mandatory":true,"title":"Connection type to the instance (\"Proxy\", \"Redirect\", or \"Default\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicDataEndpointEnabled":{"name":"publicDataEndpointEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the public data endpoint is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requestedBackupStorageRedundancy":{"name":"requestedBackupStorageRedundancy","type":"\u0007","is_mandatory":true,"title":"Backup storage redundancy requested in the latest configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuFamily":{"name":"skuFamily","type":"\u0007","is_mandatory":true,"title":"SKU family (\"Gen4\" or \"Gen5\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"SKU name (e.g. \"GP_Gen5\", \"BC_Gen5\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuTier":{"name":"skuTier","type":"\u0007","is_mandatory":true,"title":"SKU tier (\"GeneralPurpose\" or \"BusinessCritical\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Runtime state of the instance (\"Ready\", \"Stopped\", etc.)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageSizeInGB":{"name":"storageSizeInGB","type":"\u0005","is_mandatory":true,"title":"Storage size in GB","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnet":{"name":"subnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet the managed instance is joined to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"timezoneId":{"name":"timezoneId","type":"\u0007","is_mandatory":true,"title":"Time zone ID for the instance (Windows time zone identifier)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vCores":{"name":"vCores","type":"\u0005","is_mandatory":true,"title":"Number of vCores allocated to the instance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zoneRedundant":{"name":"zoneRedundant","type":"\u0004","is_mandatory":true,"title":"Whether multi-AZ (zone redundancy) is enabled for the instance","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Managed Instance","desc":"Fully-managed SQL Server instance deployed inside a virtual network, pairing broad SQL Server engine compatibility with platform-managed backups, patching, and high availability. Exposes the security-relevant posture of the instance: the minimum TLS version enforced, whether the public data endpoint is reachable from outside the virtual network, the connection type override, zone redundancy, current and requested backup storage redundancy, and the managed identity and customer-managed-key encryption configuration. The subnet the instance is joined to is reachable through subnet, and the managed databases it hosts through databases.","min_provider_version":"13.10.2","defaults":"name location state vCores skuName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.managedInstance.database":{"id":"azure.subscription.sqlService.managedInstance.database","name":"azure.subscription.sqlService.managedInstance.database","fields":{"catalogCollation":{"name":"catalogCollation","type":"\u0007","is_mandatory":true,"title":"Catalog (metadata) collation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"collation":{"name":"collation","type":"\u0007","is_mandatory":true,"title":"Database collation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createMode":{"name":"createMode","type":"\u0007","is_mandatory":true,"title":"Database create mode (\"Default\", \"PointInTimeRestore\", \"RestoreExternalBackup\", \"Recovery\", \"RestoreLongTermRetentionBackup\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationDate":{"name":"creationDate","type":"\t","is_mandatory":true,"title":"Database creation date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultSecondaryLocation":{"name":"defaultSecondaryLocation","type":"\u0007","is_mandatory":true,"title":"Default secondary location for geo-paired backups","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"earliestRestorePoint":{"name":"earliestRestorePoint","type":"\t","is_mandatory":true,"title":"Earliest restore point in time available for point-in-time restore","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"failoverGroupId":{"name":"failoverGroupId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the failover group the database belongs to (empty when not in a group)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID of the managed database","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Resource location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Database name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Database status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Managed Instance database","private":true,"min_provider_version":"13.10.2","defaults":"name status collation","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.server":{"id":"azure.subscription.sqlService.server","name":"azure.subscription.sqlService.server","fields":{"administrator":{"name":"administrator","type":"\u001bazure.subscription.sqlService.server.administrator","title":"Azure SQL Database server administrator","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"administratorLogin":{"name":"administratorLogin","type":"\u0007","is_mandatory":true,"title":"SQL Database server administrator login","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"advancedThreatProtectionSetting":{"name":"advancedThreatProtectionSetting","type":"\u001bazure.subscription.sqlService.server.advancedThreatProtectionSetting","title":"Server-level Microsoft Defender for SQL advanced threat protection setting","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"auditingPolicy":{"name":"auditingPolicy","type":"\n","title":"Raw server auditing policy","desc":"Deprecated in favor of `blobAuditingPolicy`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"azureAdAdministrators":{"name":"azureAdAdministrators","type":"\u0019\u001bazure.subscription.sqlService.server.administrator","title":"SQL Database server Entra ID administrators","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azureAdOnlyAuthentication":{"name":"azureAdOnlyAuthentication","type":"\u0004","title":"Whether Azure AD-only authentication is enabled (SQL authentication disabled)","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"blobAuditingPolicy":{"name":"blobAuditingPolicy","type":"\u001bazure.subscription.sqlService.server.blobAuditingPolicy","title":"Server-level SQL Auditing (blob auditing) policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionPolicy":{"name":"connectionPolicy","type":"\n","title":"Raw server connection policy","desc":"Deprecated in favor of `connectionType`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"connectionType":{"name":"connectionType","type":"\u0007","title":"Server-wide connection type (\"Default\", \"Proxy\", or \"Redirect\")","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"databases":{"name":"databases","type":"\u0019\u001bazure.subscription.sqlService.database","title":"SQL Database server databases","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"devOpsAuditingSetting":{"name":"devOpsAuditingSetting","type":"\u001bazure.subscription.sqlService.server.devOpsAuditingSetting","title":"Server-level Microsoft Entra ID (Azure AD) DevOps audit setting","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionProtector":{"name":"encryptionProtector","type":"\n","title":"Raw server encryption protector","desc":"Deprecated in favor of `encryptionProtectorConfig`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"encryptionProtectorConfig":{"name":"encryptionProtectorConfig","type":"\u001bazure.subscription.sqlService.server.encryptionProtectorConfig","title":"Server-level Transparent Data Encryption (TDE) protector configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionProtectorKey":{"name":"encryptionProtectorKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used by the encryption protector (null if service-managed)","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionProtectorServerKeyType":{"name":"encryptionProtectorServerKeyType","type":"\u0007","title":"Server key type for the encryption protector (\"AzureKeyVault\" or \"ServiceManaged\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"failoverGroup":{"name":"failoverGroup","type":"\u001bazure.subscription.sqlService.server.failoverGroup","title":"Azure SQL Database auto-failover group","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"failoverGroups":{"name":"failoverGroups","type":"\u0019\u001bazure.subscription.sqlService.server.failoverGroup","title":"Auto-failover groups configured on the server","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"firewallRules":{"name":"firewallRules","type":"\u0019\u001bazure.subscription.sqlService.firewallrule","title":"SQL Database server firewall rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fullyQualifiedDomainName":{"name":"fullyQualifiedDomainName","type":"\u0007","is_mandatory":true,"title":"SQL server fully qualified domain name","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"SQL Database server ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityType":{"name":"identityType","type":"\u0007","is_mandatory":true,"title":"Type of managed identity configured on the server","desc":"One of \"SystemAssigned\", \"UserAssigned\", \"SystemAssigned,UserAssigned\", or \"None\".","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"internetReachable":{"name":"internetReachable","type":"\u0004","title":"Whether the SQL server is reachable from the public internet","desc":"True when `publicNetworkAccess` is enabled AND at least one firewall rule opens the server to the entire public internet, a rule whose range spans 0.0.0.0-255.255.255.255. The special \"allow all Azure services\" rule (0.0.0.0-0.0.0.0) does not count, since it admits only Azure-internal IPs.","min_provider_version":"13.20.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"key":{"name":"key","type":"\u001bazure.subscription.sqlService.server.key","title":"Azure SQL Database server customer-managed (BYOK) encryption key","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"keys":{"name":"keys","type":"\u0019\u001bazure.subscription.sqlService.server.key","title":"Customer-managed encryption keys (BYOK) registered on the server","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"SQL Database server location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minimalTlsVersion":{"name":"minimalTlsVersion","type":"\u0007","is_mandatory":true,"title":"SQL Database server minimum TLS version","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"SQL Database server name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"outboundFirewallRule":{"name":"outboundFirewallRule","type":"\u001bazure.subscription.sqlService.server.outboundFirewallRule","title":"Azure SQL Database server outbound firewall rule (allowed FQDN for outbound traffic)","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"outboundFirewallRules":{"name":"outboundFirewallRules","type":"\u0019\u001bazure.subscription.sqlService.server.outboundFirewallRule","title":"Outbound firewall rules (allowed FQDNs for data egress)","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"primaryUserAssignedIdentity":{"name":"primaryUserAssignedIdentity","type":"\u001bazure.subscription.managedIdentity","title":"Default user-assigned managed identity used by the server (null when none is set)","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the server's system-assigned managed identity; empty when no system-assigned identity is enabled","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private Link endpoint connections to the server","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"SQL Database server properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access state (\"Enabled\" or \"Disabled\")","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicationLink":{"name":"replicationLink","type":"\u001bazure.subscription.sqlService.server.replicationLink","title":"Azure SQL Database geo-replication link","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"replicationLinks":{"name":"replicationLinks","type":"\u0019\u001bazure.subscription.sqlService.server.replicationLink","title":"Geo-replication links from databases on this server to partners","min_provider_version":"13.8.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"restrictOutboundNetworkAccess":{"name":"restrictOutboundNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Outbound network access restriction state (\"Enabled\" or \"Disabled\")","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"securityAlertPolicy":{"name":"securityAlertPolicy","type":"\n","title":"Raw server security alert policy","desc":"Deprecated in favor of `securityAlertPolicyConfig`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"securityAlertPolicyConfig":{"name":"securityAlertPolicyConfig","type":"\u001bazure.subscription.sqlService.server.securityAlertPolicyConfig","title":"Server-level security alert (threat detection) policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"SQL server state","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"SQL Database server tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Tenant ID of the server's system-assigned managed identity","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"threatDetectionPolicy":{"name":"threatDetectionPolicy","type":"\n","title":"Legacy preview threat detection policy","desc":"Deprecated in favor of `securityAlertPolicyConfig` and `advancedThreatProtectionSetting`.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"SQL Database server type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"SQL server version","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkRules":{"name":"virtualNetworkRules","type":"\u0019\u001bazure.subscription.sqlService.virtualNetworkRule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vulnerabilityAssessmentSettings":{"name":"vulnerabilityAssessmentSettings","type":"\u001bazure.subscription.sqlService.server.vulnerabilityassessmentsettings","title":"SQL Database server vulnerability assessment settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vulnerabilityassessmentsettings":{"name":"vulnerabilityassessmentsettings","type":"\u001bazure.subscription.sqlService.server.vulnerabilityassessmentsettings","title":"Azure SQL Database server vulnerability assessment settings","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true}},"title":"Azure SQL Database server","private":true,"min_provider_version":"9.0.1","defaults":"name location properties.version properties.state properties.fullyQualifiedDomainName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.server.administrator":{"id":"azure.subscription.sqlService.server.administrator","name":"azure.subscription.sqlService.server.administrator","fields":{"administratorType":{"name":"administratorType","type":"\u0007","is_mandatory":true,"title":"SQL administrator type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"SQL administrator ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"login":{"name":"login","type":"\u0007","is_mandatory":true,"title":"SQL administrator login","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"SQL administrator name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sid":{"name":"sid","type":"\u0007","is_mandatory":true,"title":"SQL administrator subscription ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"SQL administrator tenant ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"SQL administrator type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database server administrator","private":true,"min_provider_version":"9.0.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.server.advancedThreatProtectionSetting":{"id":"azure.subscription.sqlService.server.advancedThreatProtectionSetting","name":"azure.subscription.sqlService.server.advancedThreatProtectionSetting","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"UTC creation time of the setting","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"ATP state (\"Enabled\", \"Disabled\", or \"New\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database server-scoped Microsoft Defender for SQL advanced threat protection setting","private":true,"min_provider_version":"13.8.2","defaults":"state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.server.blobAuditingPolicy":{"id":"azure.subscription.sqlService.server.blobAuditingPolicy","name":"azure.subscription.sqlService.server.blobAuditingPolicy","fields":{"auditActionsAndGroups":{"name":"auditActionsAndGroups","type":"\u0019\u0007","is_mandatory":true,"title":"SQL audit action groups and individual actions audited by the policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isAzureMonitorTargetEnabled":{"name":"isAzureMonitorTargetEnabled","type":"\u0004","is_mandatory":true,"title":"Whether audit events are sent to Azure Monitor (Log Analytics / Event Hub)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isManagedIdentityInUse":{"name":"isManagedIdentityInUse","type":"\u0004","is_mandatory":true,"title":"Whether managed identity is used for authentication to the audit storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isStorageSecondaryKeyInUse":{"name":"isStorageSecondaryKeyInUse","type":"\u0004","is_mandatory":true,"title":"Whether the secondary storage account access key is in use","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"queueDelayMs":{"name":"queueDelayMs","type":"\u0005","is_mandatory":true,"title":"Audit log queue delay in milliseconds","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionDays":{"name":"retentionDays","type":"\u0005","is_mandatory":true,"title":"Number of days to retain audit logs in storage (0 = unlimited)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Auditing state (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAccountSubscriptionId":{"name":"storageAccountSubscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription ID of the audit storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageEndpoint":{"name":"storageEndpoint","type":"\u0007","is_mandatory":true,"title":"Audit log storage account blob endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database server blob auditing policy (server-level SQL Auditing)","private":true,"min_provider_version":"13.8.2","defaults":"state retentionDays","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.server.devOpsAuditingSetting":{"id":"azure.subscription.sqlService.server.devOpsAuditingSetting","name":"azure.subscription.sqlService.server.devOpsAuditingSetting","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isAzureMonitorTargetEnabled":{"name":"isAzureMonitorTargetEnabled","type":"\u0004","is_mandatory":true,"title":"Whether audit events are sent to Azure Monitor (Log Analytics / Event Hub)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"DevOps audit state (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAccountSubscriptionId":{"name":"storageAccountSubscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription ID of the audit storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageEndpoint":{"name":"storageEndpoint","type":"\u0007","is_mandatory":true,"title":"Audit log storage account blob endpoint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database server Microsoft Entra (Azure AD) DevOps audit setting","private":true,"min_provider_version":"13.8.2","defaults":"state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.server.encryptionProtectorConfig":{"id":"azure.subscription.sqlService.server.encryptionProtectorConfig","name":"azure.subscription.sqlService.server.encryptionProtectorConfig","fields":{"autoRotationEnabled":{"name":"autoRotationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether automatic key rotation is enabled for the protector","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"key":{"name":"key","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key referenced by the protector (null if service-managed)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serverKeyName":{"name":"serverKeyName","type":"\u0007","is_mandatory":true,"title":"Name of the server key referenced by the protector","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serverKeyType":{"name":"serverKeyType","type":"\u0007","is_mandatory":true,"title":"Server key type (\"AzureKeyVault\" or \"ServiceManaged\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subregion":{"name":"subregion","type":"\u0007","is_mandatory":true,"title":"Subregion of the encryption protector","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"thumbprint":{"name":"thumbprint","type":"\u0007","is_mandatory":true,"title":"Key thumbprint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"uri":{"name":"uri","type":"\u0007","is_mandatory":true,"title":"Key Vault key URI (null if service-managed)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database server Transparent Data Encryption (TDE) protector configuration","private":true,"min_provider_version":"13.8.2","defaults":"serverKeyType serverKeyName","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.server.failoverGroup":{"id":"azure.subscription.sqlService.server.failoverGroup","name":"azure.subscription.sqlService.server.failoverGroup","fields":{"databases":{"name":"databases","type":"\u0019\u001bazure.subscription.sqlService.database","title":"Databases included in the failover group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Resource location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Failover group name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"partnerServers":{"name":"partnerServers","type":"\u0019\n","is_mandatory":true,"title":"Partner server descriptors ({id, location, replicationRole})","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"readOnlyEndpoint":{"name":"readOnlyEndpoint","type":"\n","is_mandatory":true,"title":"Read-only endpoint configuration ({failoverPolicy, targetServer})","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"readWriteEndpoint":{"name":"readWriteEndpoint","type":"\n","is_mandatory":true,"title":"Read/write endpoint configuration ({failoverPolicy, failoverWithDataLossGracePeriodMinutes})","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicationRole":{"name":"replicationRole","type":"\u0007","is_mandatory":true,"title":"Replication role of this server in the failover group (\"Primary\" or \"Secondary\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicationState":{"name":"replicationState","type":"\u0007","is_mandatory":true,"title":"Replication state of the failover group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database auto-failover group","private":true,"min_provider_version":"13.8.2","defaults":"name replicationRole replicationState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.server.key":{"id":"azure.subscription.sqlService.server.key","name":"azure.subscription.sqlService.server.key","fields":{"autoRotationEnabled":{"name":"autoRotationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether automatic key rotation is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationDate":{"name":"creationDate","type":"\t","is_mandatory":true,"title":"Key creation date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Resource kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Key resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"serverKeyType":{"name":"serverKeyType","type":"\u0007","is_mandatory":true,"title":"Server key type (\"AzureKeyVault\" or \"ServiceManaged\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subregion":{"name":"subregion","type":"\u0007","is_mandatory":true,"title":"Subregion of the key","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"thumbprint":{"name":"thumbprint","type":"\u0007","is_mandatory":true,"title":"Key thumbprint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"uri":{"name":"uri","type":"\u0007","is_mandatory":true,"title":"Key Vault key URI (null for service-managed keys)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database server customer-managed (BYOK) encryption key","private":true,"min_provider_version":"13.8.2","defaults":"name serverKeyType autoRotationEnabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.server.outboundFirewallRule":{"id":"azure.subscription.sqlService.server.outboundFirewallRule","name":"azure.subscription.sqlService.server.outboundFirewallRule","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Allowed FQDN (the rule name is the FQDN)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the rule","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database server outbound firewall rule (allowed FQDN for outbound traffic)","private":true,"min_provider_version":"13.8.2","defaults":"name provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.server.replicationLink":{"id":"azure.subscription.sqlService.server.replicationLink","name":"azure.subscription.sqlService.server.replicationLink","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isTerminationAllowed":{"name":"isTerminationAllowed","type":"\u0004","is_mandatory":true,"title":"Whether termination of the replication link is allowed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"linkType":{"name":"linkType","type":"\u0007","is_mandatory":true,"title":"Replication link type (e.g. \"GEO\", \"NAMED\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Replication link name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"partnerDatabase":{"name":"partnerDatabase","type":"\u0007","is_mandatory":true,"title":"Partner database name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"partnerLocation":{"name":"partnerLocation","type":"\u0007","is_mandatory":true,"title":"Partner server location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"partnerRole":{"name":"partnerRole","type":"\u0007","is_mandatory":true,"title":"Partner replication role","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"partnerServer":{"name":"partnerServer","type":"\u0007","is_mandatory":true,"title":"Partner server name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"percentComplete":{"name":"percentComplete","type":"\u0005","is_mandatory":true,"title":"Seeding/catch-up percent complete (0-100)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicationMode":{"name":"replicationMode","type":"\u0007","is_mandatory":true,"title":"Replication mode (e.g. \"Async\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"replicationState":{"name":"replicationState","type":"\u0007","is_mandatory":true,"title":"Replication state (\"PENDING\", \"SEEDING\", \"CATCH_UP\", \"SUSPENDED\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Local replication role (\"Primary\", \"Secondary\", \"Source\", \"Copy\", or \"NonReadableSecondary\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"startTime":{"name":"startTime","type":"\t","is_mandatory":true,"title":"Replication start time","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database geo-replication link","private":true,"min_provider_version":"13.8.2","defaults":"name partnerServer replicationState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.server.securityAlertPolicyConfig":{"id":"azure.subscription.sqlService.server.securityAlertPolicyConfig","name":"azure.subscription.sqlService.server.securityAlertPolicyConfig","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"UTC creation time of the policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disabledAlerts":{"name":"disabledAlerts","type":"\u0019\u0007","is_mandatory":true,"title":"List of alert types disabled for this policy (e.g. \"Sql_Injection\", \"Access_Anomaly\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"emailAccountAdmins":{"name":"emailAccountAdmins","type":"\u0004","is_mandatory":true,"title":"Whether subscription administrators and database owners receive alert email","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"emailAddresses":{"name":"emailAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Email addresses that receive alert notifications","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionDays":{"name":"retentionDays","type":"\u0005","is_mandatory":true,"title":"Number of days to retain threat detection logs in storage (0 = unlimited)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Alert policy state (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageEndpoint":{"name":"storageEndpoint","type":"\u0007","is_mandatory":true,"title":"Storage account blob endpoint that receives audited events for threat detection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database server security alert (threat detection) policy","private":true,"min_provider_version":"13.8.2","defaults":"state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.server.vulnerabilityassessmentsettings":{"id":"azure.subscription.sqlService.server.vulnerabilityassessmentsettings","name":"azure.subscription.sqlService.server.vulnerabilityassessmentsettings","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the vulnerability assessment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"mailSubscriptionAdmins":{"name":"mailSubscriptionAdmins","type":"\u0004","is_mandatory":true,"title":"Whether the schedule scan notification is also sent to the subscription administrators","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the vulnerability assessment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"recurringScanEmails":{"name":"recurringScanEmails","type":"\u0019\u0007","is_mandatory":true,"title":"Array of email addresses to which the scan notification is sent","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"recurringScanEnabled":{"name":"recurringScanEnabled","type":"\u0004","is_mandatory":true,"title":"Whether recurring scan is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAccountAccessKey":{"name":"storageAccountAccessKey","type":"\u0007","is_mandatory":true,"title":"Identifier key of the storage account for vulnerability assessment scan results","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageContainerPath":{"name":"storageContainerPath","type":"\u0007","is_mandatory":true,"title":"Blob storage container path to hold the scan results","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageContainerSasKey":{"name":"storageContainerSasKey","type":"\u0007","is_mandatory":true,"title":"Shared access signature key that has write access to the blob container specified in 'storageContainerPath'","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type of the vulnerability assessment","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database server vulnerability assessment settings","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.virtualNetworkRule":{"id":"azure.subscription.sqlService.virtualNetworkRule","name":"azure.subscription.sqlService.virtualNetworkRule","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Virtual network rule ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Virtual network rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Virtual network rule properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Virtual network rule type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkSubnetId":{"name":"virtualNetworkSubnetId","type":"\u0007","is_mandatory":true,"title":"Virtual network rule Subnet ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL virtual network rule","private":true,"min_provider_version":"9.0.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.sqlService.vulnerabilityAssessmentScan":{"id":"azure.subscription.sqlService.vulnerabilityAssessmentScan","name":"azure.subscription.sqlService.vulnerabilityAssessmentScan","fields":{"endTime":{"name":"endTime","type":"\t","is_mandatory":true,"title":"Scan end time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"errors":{"name":"errors","type":"\u0019\n","is_mandatory":true,"title":"List of scan errors ({code, message})","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Scan record name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"numberOfFailedSecurityChecks":{"name":"numberOfFailedSecurityChecks","type":"\u0005","is_mandatory":true,"title":"Number of failed security checks in the scan","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scanId":{"name":"scanId","type":"\u0007","is_mandatory":true,"title":"Scan ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"startTime":{"name":"startTime","type":"\t","is_mandatory":true,"title":"Scan start time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Scan state (\"Passed\", \"Failed\", \"FailedToRun\", or \"InProgress\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageContainerPath":{"name":"storageContainerPath","type":"\u0007","is_mandatory":true,"title":"Storage container path holding the scan results","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"triggerType":{"name":"triggerType","type":"\u0007","is_mandatory":true,"title":"Trigger type (\"OnDemand\" or \"Recurring\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure SQL Database vulnerability assessment scan record (shared between server and database scope)","private":true,"min_provider_version":"13.8.2","defaults":"scanId state numberOfFailedSecurityChecks","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService":{"id":"azure.subscription.storageService","name":"azure.subscription.storageService","fields":{"account":{"name":"account","type":"\u001bazure.subscription.storageService.account","title":"Azure Storage account","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"accounts":{"name":"accounts","type":"\u0019\u001bazure.subscription.storageService.account","title":"List of storage accounts","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account":{"id":"azure.subscription.storageService.account","name":"azure.subscription.storageService.account","fields":{"accessTier":{"name":"accessTier","type":"\u0007","is_mandatory":true,"title":"Access tier of the storage account (Hot, Cool, Cold, Premium)","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"allowBlobPublicAccess":{"name":"allowBlobPublicAccess","type":"\u0004","is_mandatory":true,"title":"Whether blob containers in the account can be configured for public access","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"allowCrossTenantReplication":{"name":"allowCrossTenantReplication","type":"\u0004","is_mandatory":true,"title":"Whether cross-tenant replication is allowed","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"allowSharedKeyAccess":{"name":"allowSharedKeyAccess","type":"\u0004","is_mandatory":true,"title":"Whether shared key access is allowed for the storage account","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"allowedCopyScope":{"name":"allowedCopyScope","type":"\u0007","is_mandatory":true,"title":"Allowed copy scope for the storage account (\"PrivateLink\", \"AAD\", or empty for unrestricted)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"blobInventoryPolicy":{"name":"blobInventoryPolicy","type":"\u001bazure.subscription.storageService.account.blobInventoryPolicy","title":"Blob inventory policy configured on the storage account, if any","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"blobProperties":{"name":"blobProperties","type":"\u001bazure.subscription.storageService.account.service.blobProperties","title":"Storage account blob properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"container":{"name":"container","type":"\u001bazure.subscription.storageService.account.container","title":"Azure Storage container","desc":"Blob container within a storage account, keyed by ARM id. Fields cover the anonymous access level (`publicAccess`), immutability and legal-hold state, default encryption scope, lease state, and soft-delete status, making it the unit for auditing whether stored blobs can be reached anonymously or altered under a retention policy.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"containers":{"name":"containers","type":"\u0019\u001bazure.subscription.storageService.account.container","title":"Storage account containers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the storage account was created","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dataProtection":{"name":"dataProtection","type":"\u001bazure.subscription.storageService.account.dataProtection","title":"Storage account data protection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultToOAuthAuthentication":{"name":"defaultToOAuthAuthentication","type":"\u0004","is_mandatory":true,"title":"Whether the storage account defaults to OAuth authentication","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defenderForStorage":{"name":"defenderForStorage","type":"\u001bazure.subscription.storageService.account.defenderForStorageSetting","title":"Microsoft Defender for Storage configuration for this account","desc":"Includes the Microsoft Purview-backed Sensitive Data Discovery feature that classifies blob containers for sensitive data (credit cards, credentials, etc.) and surfaces findings as security alerts.","min_provider_version":"13.11.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defenderForStorageSetting":{"name":"defenderForStorageSetting","type":"\u001bazure.subscription.storageService.account.defenderForStorageSetting","title":"Microsoft Defender for Storage configuration for a single storage account","desc":"Per-account Defender for Storage settings. `isEnabled` reports whether Defender for Storage is on for this account, and `sensitiveDataDiscoveryEnabled` reflects whether the Microsoft Purview-backed sensitive data classification engine scans blob containers and surfaces findings as security alerts. `overrideSubscriptionLevelSettings` distinguishes account-level overrides from inherited subscription-level configuration.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"enableHttpsTrafficOnly":{"name":"enableHttpsTrafficOnly","type":"\u0004","is_mandatory":true,"title":"Whether only HTTPS traffic is allowed to storage service","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enableNfsV3":{"name":"enableNfsV3","type":"\u0004","is_mandatory":true,"title":"Whether NFS v3 protocol is enabled","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionIdentity":{"name":"encryptionIdentity","type":"\u001bazure.subscription.managedIdentity","title":"User-assigned managed identity used to access the customer-managed encryption key; null when account-level encryption identity is not configured","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionKey":{"name":"encryptionKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Key Vault key used for customer-managed encryption (null if platform-managed)","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionKeySource":{"name":"encryptionKeySource","type":"\u0007","title":"Encryption key source for the storage account (\"Microsoft.Storage\" or \"Microsoft.KeyVault\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryptionScope":{"name":"encryptionScope","type":"\u001bazure.subscription.storageService.account.encryptionScope","title":"Azure Storage encryption scope","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"encryptionScopes":{"name":"encryptionScopes","type":"\u0019\u001bazure.subscription.storageService.account.encryptionScope","title":"Storage account encryption scopes","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"fileProperties":{"name":"fileProperties","type":"\u001bazure.subscription.storageService.account.filePropertiesConfig","title":"Storage account file properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"filePropertiesConfig":{"name":"filePropertiesConfig","type":"\u001bazure.subscription.storageService.account.filePropertiesConfig","title":"Azure Storage account file properties","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"fileShare":{"name":"fileShare","type":"\u001bazure.subscription.storageService.account.fileShare","title":"Azure Storage file share","desc":"Single Azure Files share hosted on a storage account. Selectable by ARM id; fields cover the share protocol (SMB or NFS), access tier, provisioned quota, and the presence of stored access policies (signed identifiers).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"fileShares":{"name":"fileShares","type":"\u0019\u001bazure.subscription.storageService.account.fileShare","title":"File shares hosted on the account (Azure Files)","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Storage account ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Storage account identity","desc":"Deprecated in favor of principalId, tenantId, userAssignedIdentities, and encryptionIdentity, which expose the managed identity configuration as typed accessors.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"immutableStorageEnabled":{"name":"immutableStorageEnabled","type":"\u0004","is_mandatory":true,"title":"Whether account-level immutability with versioning is enabled","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immutableStoragePolicyAllowProtectedAppendWrites":{"name":"immutableStoragePolicyAllowProtectedAppendWrites","type":"\u0004","is_mandatory":true,"title":"Whether protected append-blob writes are permitted under the default account policy","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immutableStoragePolicyPeriodDays":{"name":"immutableStoragePolicyPeriodDays","type":"\u0005","is_mandatory":true,"title":"Default account-level immutability period (days). Zero when no default policy is set.","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immutableStoragePolicyState":{"name":"immutableStoragePolicyState","type":"\u0007","is_mandatory":true,"title":"Default account-level immutability policy state (\"Locked\" / \"Unlocked\"); empty when unset","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isHnsEnabled":{"name":"isHnsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether hierarchical namespace (Data Lake Storage) is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isLocalUserEnabled":{"name":"isLocalUserEnabled","type":"\u0004","is_mandatory":true,"title":"Whether local user accounts are enabled for SFTP/SSH","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isPublic":{"name":"isPublic","type":"\u0004","title":"Whether the storage account is exposed to anonymous public access","desc":"True when public network access is not disabled, the network rule set defaults to Allow (no deny-by-default firewall), AND blob containers may be configured for anonymous public access (`allowBlobPublicAccess`). All three gates must be open for anonymous internet reads to be possible.","min_provider_version":"13.20.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isSftpEnabled":{"name":"isSftpEnabled","type":"\u0004","is_mandatory":true,"title":"Whether SFTP is enabled on the storage account","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyExpirationPeriodInDays":{"name":"keyExpirationPeriodInDays","type":"\u0005","is_mandatory":true,"title":"Account access-key expiration period (days)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Storage account kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"largeFileSharesState":{"name":"largeFileSharesState","type":"\u0007","is_mandatory":true,"title":"Whether large file shares are enabled (Enabled, Disabled)","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastGeoFailoverTime":{"name":"lastGeoFailoverTime","type":"\t","is_mandatory":true,"title":"When the last geo-failover occurred","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"localUser":{"name":"localUser","type":"\u001bazure.subscription.storageService.account.localUser","title":"Local user configured on a storage account for SFTP/SSH access","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"localUsers":{"name":"localUsers","type":"\u0019\u001bazure.subscription.storageService.account.localUser","title":"Local users (SFTP/SSH) configured on the storage account","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Storage account location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managementPolicy":{"name":"managementPolicy","type":"\u001bazure.subscription.storageService.account.managementPolicy","title":"Storage account lifecycle management policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minimumTlsVersion":{"name":"minimumTlsVersion","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version enforced on the storage account","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Storage account name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkRuleBypass":{"name":"networkRuleBypass","type":"\u0007","is_mandatory":true,"title":"Services that bypass the network rules (e.g. AzureServices, Logging, Metrics)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkRuleDefaultAction":{"name":"networkRuleDefaultAction","type":"\u0007","is_mandatory":true,"title":"Default action for network rule set (Allow or Deny)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkRuleIpRanges":{"name":"networkRuleIpRanges","type":"\u0019\u0007","is_mandatory":true,"title":"IP address or CIDR ranges allowed by network rules","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkRuleVirtualNetworkSubnetIds":{"name":"networkRuleVirtualNetworkSubnetIds","type":"\u0019\u0007","is_mandatory":true,"title":"Virtual network subnet resource IDs allowed by network rules","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkSecurityPerimeterConfiguration":{"name":"networkSecurityPerimeterConfiguration","type":"\u001bazure.subscription.storageService.account.networkSecurityPerimeterConfiguration","title":"Network Security Perimeter configuration of an Azure Storage account","desc":"Association between a storage account and an Azure Network Security Perimeter, including the enforcement mode that decides whether perimeter access rules are logged only or actually blocked. Select a configuration by its `id`. The `associationAccessMode` field reports \"Learning\", \"Audit\", or \"Enforced\"; only \"Enforced\" blocks traffic that violates the perimeter rules. `accessRules` lists the inbound and outbound rules in effect, `enabledLogCategories` the categories shipped to diagnostics, and `provisioningIssues` any errors that prevented the configuration from propagating.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"networkSecurityPerimeterConfigurations":{"name":"networkSecurityPerimeterConfigurations","type":"\u0019\u001bazure.subscription.storageService.account.networkSecurityPerimeterConfiguration","title":"Network Security Perimeter configurations associated with the storage account","min_provider_version":"13.15.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"objectReplicationPolicies":{"name":"objectReplicationPolicies","type":"\u0019\u001bazure.subscription.storageService.account.objectReplicationPolicy","title":"Object replication policies configured on the storage account","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"objectReplicationPolicy":{"name":"objectReplicationPolicy","type":"\u001bazure.subscription.storageService.account.objectReplicationPolicy","title":"Azure Storage object replication policy","desc":"Object replication policy linking a source storage account to a destination account. Selectable by ARM id; fields expose the source/destination pair, when replication was enabled, and the container-to-container rules with optional prefix and creation-time filters.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"primaryLocation":{"name":"primaryLocation","type":"\u0007","is_mandatory":true,"title":"Primary location of the storage account","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the account's system-assigned managed identity; empty when no system-assigned identity is enabled","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnection":{"name":"privateEndpointConnection","type":"\u001bazure.subscription.storageService.account.privateEndpointConnection","title":"Azure Storage private endpoint connection","desc":"Private endpoint connection on a storage account. Selectable by ARM id; fields expose the consumer-side endpoint reference and the approval status governing traffic between consumer and storage.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.storageService.account.privateEndpointConnection","title":"Private endpoint connections to the storage account","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw storage account properties","desc":"Serialized Azure Resource Manager property bag for the account. Most individual settings are also exposed as fields on this resource (accessTier, minimumTlsVersion, allowBlobPublicAccess, the networkRule fields, the encryption fields, and so on); prefer those over reading raw keys here.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the storage account","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether public network access is allowed for the storage account","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publishInternetEndpoints":{"name":"publishInternetEndpoints","type":"\u0004","is_mandatory":true,"title":"Whether internet-routing storage endpoints are published","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publishMicrosoftEndpoints":{"name":"publishMicrosoftEndpoints","type":"\u0004","is_mandatory":true,"title":"Whether Microsoft-routing storage endpoints are published","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"queue":{"name":"queue","type":"\u001bazure.subscription.storageService.account.queue","title":"Azure Storage account queue","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"queueProperties":{"name":"queueProperties","type":"\u001bazure.subscription.storageService.account.service.properties","title":"Storage account queue properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"queues":{"name":"queues","type":"\u0019\u001bazure.subscription.storageService.account.queue","title":"Storage account queues","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requireInfrastructureEncryption":{"name":"requireInfrastructureEncryption","type":"\u0004","is_mandatory":true,"title":"Whether infrastructure (double) encryption is required at rest","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"routingChoice":{"name":"routingChoice","type":"\u0007","is_mandatory":true,"title":"Routing choice for outbound traffic (\"MicrosoftRouting\" or \"InternetRouting\")","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sasExpirationAction":{"name":"sasExpirationAction","type":"\u0007","is_mandatory":true,"title":"SAS expiration policy action (\"Log\" or \"Block\"); empty if no policy is set","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sasExpirationPeriod":{"name":"sasExpirationPeriod","type":"\u0007","is_mandatory":true,"title":"SAS expiration policy: max validity period (days.HH:MM:SS)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"secondaryLocation":{"name":"secondaryLocation","type":"\u0007","is_mandatory":true,"title":"Secondary location of the storage account (for geo-redundant accounts)","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"service":{"name":"service","type":"\u001bazure.subscription.storageService.account.service","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"serviceKeyTypes":{"name":"serviceKeyTypes","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Per-service encryption KeyType ({\"blob\",\"file\",\"queue\",\"table\"}; values \"Account\" or \"Service\")","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"Storage account SKU","desc":"Dict with keys `name` (e.g. \"Standard_LRS\", \"Standard_GRS\", \"Premium_LRS\") and `tier` (\"Standard\" or \"Premium\").","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"staticWebsiteConfig":{"name":"staticWebsiteConfig","type":"\u001bazure.subscription.storageService.account.staticWebsiteConfig","title":"Static website hosting configuration on a storage account","desc":"Static website hosting settings for the account's `$web` container: whether the site is served and which documents the account returns for the root, subdirectory index, and 404 responses. An enabled account exposes an HTTPS-reachable web endpoint with no access control on the served files, so the presence of static hosting is itself an audit signal.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"statusOfPrimary":{"name":"statusOfPrimary","type":"\u0007","is_mandatory":true,"title":"Status of the primary location (Available, Unavailable)","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"statusOfSecondary":{"name":"statusOfSecondary","type":"\u0007","is_mandatory":true,"title":"Status of the secondary location (Available, Unavailable)","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"table":{"name":"table","type":"\u001bazure.subscription.storageService.account.table","title":"Azure Storage account table","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"tableProperties":{"name":"tableProperties","type":"\u001bazure.subscription.storageService.account.service.properties","title":"Storage account table properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tables":{"name":"tables","type":"\u0019\u001bazure.subscription.storageService.account.table","title":"Storage account tables","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Storage account tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Tenant ID of the account's managed identity; empty when no managed identity is configured","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Storage account type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities attached to the storage account","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage account","private":true,"min_provider_version":"9.0.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.blobInventoryPolicy":{"id":"azure.subscription.storageService.account.blobInventoryPolicy","name":"azure.subscription.storageService.account.blobInventoryPolicy","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the inventory policy is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedTime":{"name":"lastModifiedTime","type":"\t","is_mandatory":true,"title":"Last modification time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name (always \"default\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Inventory rules. Each entry has {name, enabled, destination, definition: {format, schedule, objectType, schemaFields, filters}}.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage blob inventory policy","desc":"Blob inventory policy on a storage account (a single policy named \"default\"). Reports whether the account has cataloging enabled and what inventory rules are defined (destination container, schema, schedule, per-rule filters).","private":true,"min_provider_version":"13.10.2","defaults":"enabled lastModifiedTime","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.container":{"id":"azure.subscription.storageService.account.container","name":"azure.subscription.storageService.account.container","fields":{"defaultEncryptionScope":{"name":"defaultEncryptionScope","type":"\u0007","is_mandatory":true,"title":"Default encryption scope for the container","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deleted":{"name":"deleted","type":"\u0004","is_mandatory":true,"title":"Whether the container has been soft-deleted","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deletedTime":{"name":"deletedTime","type":"\t","is_mandatory":true,"title":"When the container was deleted","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"denyEncryptionScopeOverride":{"name":"denyEncryptionScopeOverride","type":"\u0004","is_mandatory":true,"title":"Whether encryption scope override is denied","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"Storage container etag","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hasImmutabilityPolicy":{"name":"hasImmutabilityPolicy","type":"\u0004","is_mandatory":true,"title":"Whether the container has an immutability policy","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hasLegalHold":{"name":"hasLegalHold","type":"\u0004","is_mandatory":true,"title":"Whether the container has a legal hold","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Storage container ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immutabilityPeriodInDays":{"name":"immutabilityPeriodInDays","type":"\u0005","is_mandatory":true,"title":"Time-based retention period (days) configured on the immutability policy","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immutabilityPolicyAllowProtectedAppendWrites":{"name":"immutabilityPolicyAllowProtectedAppendWrites","type":"\u0004","is_mandatory":true,"title":"Whether append-blob writes are permitted while immutability is enforced","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immutabilityPolicyAllowProtectedAppendWritesAll":{"name":"immutabilityPolicyAllowProtectedAppendWritesAll","type":"\u0004","is_mandatory":true,"title":"Whether append/block-blob writes are permitted while immutability is enforced","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"immutabilityPolicyState":{"name":"immutabilityPolicyState","type":"\u0007","is_mandatory":true,"title":"ImmutabilityPolicy state (\"Locked\" or \"Unlocked\"); empty if no policy","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedTime":{"name":"lastModifiedTime","type":"\t","is_mandatory":true,"title":"When the container was last modified","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"leaseState":{"name":"leaseState","type":"\u0007","is_mandatory":true,"title":"Lease state of the container (Available, Leased, Expired, Breaking, Broken)","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"leaseStatus":{"name":"leaseStatus","type":"\u0007","is_mandatory":true,"title":"Lease status of the container (Locked, Unlocked)","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"legalHoldTags":{"name":"legalHoldTags","type":"\u0019\n","is_mandatory":true,"title":"Legal-hold tags currently set on the container ({tag, objectIdentifier, tenantId, upn, timestamp})","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Container metadata","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Storage container name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"objectLevelImmutabilityEnabled":{"name":"objectLevelImmutabilityEnabled","type":"\u0004","is_mandatory":true,"title":"Whether object-level (per-blob) immutability with versioning is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw storage container properties","desc":"Serialized Azure Resource Manager property bag for the container. Most individual settings are also exposed as fields on this resource (publicAccess, hasImmutabilityPolicy, hasLegalHold, leaseState, metadata, and so on); prefer those over reading raw keys here.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicAccess":{"name":"publicAccess","type":"\u0007","is_mandatory":true,"title":"Public access level for the container (None, Blob, Container)","min_provider_version":"11.6.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"remainingRetentionDays":{"name":"remainingRetentionDays","type":"\u0005","is_mandatory":true,"title":"Number of remaining days in the soft delete retention period","min_provider_version":"11.6.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Storage container type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage container","desc":"Blob container within a storage account, keyed by ARM id. Fields cover the anonymous access level (`publicAccess`), immutability and legal-hold state, default encryption scope, lease state, and soft-delete status, making it the unit for auditing whether stored blobs can be reached anonymously or altered under a retention policy.","private":true,"min_provider_version":"9.0.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.dataProtection":{"id":"azure.subscription.storageService.account.dataProtection","name":"azure.subscription.storageService.account.dataProtection","fields":{"blobRetentionDays":{"name":"blobRetentionDays","type":"\u0005","is_mandatory":true,"title":"Retention period in days for deleted blobs","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"blobSoftDeletionEnabled":{"name":"blobSoftDeletionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether soft deletion of blobs is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"containerRetentionDays":{"name":"containerRetentionDays","type":"\u0005","is_mandatory":true,"title":"Retention period in days for deleted containers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"containerSoftDeletionEnabled":{"name":"containerSoftDeletionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether soft deletion of containers is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"storageAccountId":{"name":"storageAccountId","type":"\u0007","is_mandatory":true,"title":"ID of the storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage account data protection","private":true,"min_provider_version":"9.0.1","defaults":"blobSoftDeletionEnabled blobRetentionDays","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.defenderForStorageSetting":{"id":"azure.subscription.storageService.account.defenderForStorageSetting","name":"azure.subscription.storageService.account.defenderForStorageSetting","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the Defender for Storage setting (`.../storageAccounts/{name}/providers/Microsoft.Security/defenderForStorageSettings/current`)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Defender for Storage is enabled on this storage account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"malwareScanningCapGBPerMonth":{"name":"malwareScanningCapGBPerMonth","type":"\u0005","is_mandatory":true,"title":"Monthly per-storage-account cap on the GB scanned for on-upload malware scanning. Negative values mean no cap","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"malwareScanningOnUploadEnabled":{"name":"malwareScanningOnUploadEnabled","type":"\u0004","is_mandatory":true,"title":"Whether on-upload malware scanning is enabled — every new blob is scanned for malware before becoming readable","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"malwareScanningResultsEventGridTopicId":{"name":"malwareScanningResultsEventGridTopicId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the Event Grid Topic that receives malware scan results, empty when no topic is configured","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"malwareScanningStatus":{"name":"malwareScanningStatus","type":"\n","is_mandatory":true,"title":"Status of the most recent Malware Scanning enable/disable operation, with keys `code` and `message` (populated only on failure or partial success)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"overrideSubscriptionLevelSettings":{"name":"overrideSubscriptionLevelSettings","type":"\u0004","is_mandatory":true,"title":"Whether the per-account configuration overrides the subscription-level Defender for Storage settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sensitiveDataDiscoveryEnabled":{"name":"sensitiveDataDiscoveryEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the Microsoft Purview-backed Sensitive Data Discovery sub-feature is enabled","desc":"Scans blob containers for sensitive data (credit cards, credentials, etc.) and emits security alerts.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sensitiveDataDiscoveryStatus":{"name":"sensitiveDataDiscoveryStatus","type":"\n","is_mandatory":true,"title":"Status of the most recent Sensitive Data Discovery enable/disable operation","desc":"Dict with keys `code` and `message` (populated only on failure or partial success).","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Microsoft Defender for Storage configuration for a single storage account","desc":"Per-account Defender for Storage settings. `isEnabled` reports whether Defender for Storage is on for this account, and `sensitiveDataDiscoveryEnabled` reflects whether the Microsoft Purview-backed sensitive data classification engine scans blob containers and surfaces findings as security alerts. `overrideSubscriptionLevelSettings` distinguishes account-level overrides from inherited subscription-level configuration.","private":true,"min_provider_version":"13.11.2","defaults":"isEnabled sensitiveDataDiscoveryEnabled malwareScanningOnUploadEnabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.encryptionScope":{"id":"azure.subscription.storageService.account.encryptionScope","name":"azure.subscription.storageService.account.encryptionScope","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the encryption scope was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"currentVersionedKeyIdentifier":{"name":"currentVersionedKeyIdentifier","type":"\u0007","is_mandatory":true,"title":"Current versioned key identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Encryption scope ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultKeyUri":{"name":"keyVaultKeyUri","type":"\u0007","is_mandatory":true,"title":"Key Vault key URI (if source is Microsoft.KeyVault)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastKeyRotationTimestamp":{"name":"lastKeyRotationTimestamp","type":"\t","is_mandatory":true,"title":"When the key was last rotated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedTime":{"name":"lastModifiedTime","type":"\t","is_mandatory":true,"title":"When the encryption scope was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Encryption scope name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"requireInfrastructureEncryption":{"name":"requireInfrastructureEncryption","type":"\u0004","is_mandatory":true,"title":"Whether infrastructure encryption is required","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Encryption source (\"Microsoft.Storage\" or \"Microsoft.KeyVault\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"State of the encryption scope (Enabled or Disabled)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Encryption scope type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage encryption scope","private":true,"min_provider_version":"13.3.3","defaults":"name source state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.fileProperties":{"id":"azure.subscription.storageService.account.fileProperties","fields":{"protocolSettings":{"name":"protocolSettings","type":"\u001bazure.subscription.storageService.account.fileProperties.protocolSettings","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"protocolSettingsConfig":{"name":"protocolSettingsConfig","type":"\u001bazure.subscription.storageService.account.fileProperties.protocolSettingsConfig","title":"Azure Storage account file properties protocol settings","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"shareDeleteRetentionPolicyConfig":{"name":"shareDeleteRetentionPolicyConfig","type":"\u001bazure.subscription.storageService.account.fileProperties.shareDeleteRetentionPolicyConfig","title":"Azure Storage account file properties share delete retention policy","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true}},"is_extension":true,"min_provider_version":"11.4.24"},"azure.subscription.storageService.account.fileProperties.protocolSettings":{"id":"azure.subscription.storageService.account.fileProperties.protocolSettings","fields":{"smbConfig":{"name":"smbConfig","type":"\u001bazure.subscription.storageService.account.fileProperties.protocolSettings.smbConfig","title":"Azure Storage account file properties protocol settings SMB","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true}},"is_extension":true},"azure.subscription.storageService.account.fileProperties.protocolSettings.smbConfig":{"id":"azure.subscription.storageService.account.fileProperties.protocolSettings.smbConfig","name":"azure.subscription.storageService.account.fileProperties.protocolSettings.smbConfig","fields":{"authenticationMethods":{"name":"authenticationMethods","type":"\u0007","is_mandatory":true,"title":"Supported authentication methods (e.g., \"NTLMv2;Kerberos\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"channelEncryption":{"name":"channelEncryption","type":"\u0007","is_mandatory":true,"title":"Supported channel encryption methods (e.g., \"AES-128-CCM;AES-128-GCM;AES-256-GCM\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kerberosTicketEncryption":{"name":"kerberosTicketEncryption","type":"\u0007","is_mandatory":true,"title":"Supported Kerberos ticket encryption methods (e.g., \"RC4-HMAC;AES-256\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"versions":{"name":"versions","type":"\u0007","is_mandatory":true,"title":"Supported SMB versions (e.g., \"SMB3.0;SMB3.1.1\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage account file properties protocol settings SMB","private":true,"min_provider_version":"11.4.24","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.fileProperties.protocolSettingsConfig":{"id":"azure.subscription.storageService.account.fileProperties.protocolSettingsConfig","name":"azure.subscription.storageService.account.fileProperties.protocolSettingsConfig","fields":{"smb":{"name":"smb","type":"\u001bazure.subscription.storageService.account.fileProperties.protocolSettings.smbConfig","is_mandatory":true,"title":"SMB protocol settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage account file properties protocol settings","private":true,"min_provider_version":"11.4.24","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.fileProperties.shareDeleteRetentionPolicyConfig":{"id":"azure.subscription.storageService.account.fileProperties.shareDeleteRetentionPolicyConfig","name":"azure.subscription.storageService.account.fileProperties.shareDeleteRetentionPolicyConfig","fields":{"days":{"name":"days","type":"\u0005","is_mandatory":true,"title":"Retention period in days for deleted file shares","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether share delete retention is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage account file properties share delete retention policy","private":true,"min_provider_version":"11.4.24","defaults":"enabled days","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.filePropertiesConfig":{"id":"azure.subscription.storageService.account.filePropertiesConfig","name":"azure.subscription.storageService.account.filePropertiesConfig","fields":{"protocolSettings":{"name":"protocolSettings","type":"\u001bazure.subscription.storageService.account.fileProperties.protocolSettingsConfig","is_mandatory":true,"title":"Protocol settings for file service","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"shareDeleteRetentionPolicy":{"name":"shareDeleteRetentionPolicy","type":"\u001bazure.subscription.storageService.account.fileProperties.shareDeleteRetentionPolicyConfig","is_mandatory":true,"title":"File share delete retention policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage account file properties","private":true,"min_provider_version":"11.4.24","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.fileShare":{"id":"azure.subscription.storageService.account.fileShare","name":"azure.subscription.storageService.account.fileShare","fields":{"accessTier":{"name":"accessTier","type":"\u0007","is_mandatory":true,"title":"Access tier (\"TransactionOptimized\", \"Hot\", \"Cool\", \"Premium\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"accessTierChangeTime":{"name":"accessTierChangeTime","type":"\t","is_mandatory":true,"title":"Time the access tier was last changed","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"accessTierStatus":{"name":"accessTierStatus","type":"\u0007","is_mandatory":true,"title":"Status of any pending access-tier transition; empty when none","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deleted":{"name":"deleted","type":"\u0004","is_mandatory":true,"title":"Whether the share is in the soft-deleted state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deletedTime":{"name":"deletedTime","type":"\t","is_mandatory":true,"title":"When the share was soft-deleted, if applicable","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabledProtocols":{"name":"enabledProtocols","type":"\u0007","is_mandatory":true,"title":"Protocols enabled on the share (\"SMB\" or \"NFS\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedTime":{"name":"lastModifiedTime","type":"\t","is_mandatory":true,"title":"Last modification time","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"leaseDuration":{"name":"leaseDuration","type":"\u0007","is_mandatory":true,"title":"Lease duration (\"Infinite\", \"Fixed\"); empty when unleased","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"leaseState":{"name":"leaseState","type":"\u0007","is_mandatory":true,"title":"Lease state (\"available\", \"leased\", \"expired\", \"breaking\", \"broken\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"leaseStatus":{"name":"leaseStatus","type":"\u0007","is_mandatory":true,"title":"Lease status (\"locked\", \"unlocked\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"User-defined metadata","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Share name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisionedBandwidthMibps":{"name":"provisionedBandwidthMibps","type":"\u0005","is_mandatory":true,"title":"Provisioned bandwidth in MiB/s (Files Provisioned v2 only); zero otherwise","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisionedIops":{"name":"provisionedIops","type":"\u0005","is_mandatory":true,"title":"Provisioned IOPS (Files Provisioned v2 only); zero otherwise","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rootSquash":{"name":"rootSquash","type":"\u0007","is_mandatory":true,"title":"NFS root squash policy (\"NoRootSquash\", \"RootSquash\", \"AllSquash\"); empty for SMB","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"shareQuotaGiB":{"name":"shareQuotaGiB","type":"\u0005","is_mandatory":true,"title":"Provisioned share quota in GiB","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"signedIdentifierCount":{"name":"signedIdentifierCount","type":"\u0005","is_mandatory":true,"title":"Number of stored access policies (signed identifiers) on the share","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"snapshotTime":{"name":"snapshotTime","type":"\t","is_mandatory":true,"title":"Snapshot timestamp; empty when this is the live share","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage file share","desc":"Single Azure Files share hosted on a storage account. Selectable by ARM id; fields cover the share protocol (SMB or NFS), access tier, provisioned quota, and the presence of stored access policies (signed identifiers).","private":true,"min_provider_version":"13.10.2","defaults":"name enabledProtocols accessTier shareQuotaGiB","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.localUser":{"id":"azure.subscription.storageService.account.localUser","name":"azure.subscription.storageService.account.localUser","fields":{"allowAclAuthorization":{"name":"allowAclAuthorization","type":"\u0004","is_mandatory":true,"title":"Whether ACL authorization is allowed for this user","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"groupId":{"name":"groupId","type":"\u0005","is_mandatory":true,"title":"Numeric POSIX group ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hasSharedKey":{"name":"hasSharedKey","type":"\u0004","is_mandatory":true,"title":"Whether shared-key access exists","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hasSshKey":{"name":"hasSshKey","type":"\u0004","is_mandatory":true,"title":"Whether SSH key authentication exists","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hasSshPassword":{"name":"hasSshPassword","type":"\u0004","is_mandatory":true,"title":"Whether SSH password authentication exists","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"homeDirectory":{"name":"homeDirectory","type":"\u0007","is_mandatory":true,"title":"Optional home directory (constrains the file system path the user sees)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Local user resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isNFSv3Enabled":{"name":"isNFSv3Enabled","type":"\u0004","is_mandatory":true,"title":"Whether the user is enabled for NFSv3 access","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Local user name (used as SFTP username)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"permissionScopes":{"name":"permissionScopes","type":"\u0019\n","is_mandatory":true,"title":"Permission scopes (each: { permissions, service, resourceName })","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userId":{"name":"userId","type":"\u0005","is_mandatory":true,"title":"Numeric POSIX user ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Local user configured on a storage account for SFTP/SSH access","private":true,"min_provider_version":"13.5.1","defaults":"id name hasSshPassword hasSshKey hasSharedKey","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.managementPolicy":{"id":"azure.subscription.storageService.account.managementPolicy","name":"azure.subscription.storageService.account.managementPolicy","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Management policy ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedTime":{"name":"lastModifiedTime","type":"\t","is_mandatory":true,"title":"When the policy was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Management policy name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rule":{"name":"rule","type":"\u001bazure.subscription.storageService.account.managementPolicy.rule","title":"Azure Storage lifecycle management policy rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"rules":{"name":"rules","type":"\u0019\u001bazure.subscription.storageService.account.managementPolicy.rule","is_mandatory":true,"title":"Lifecycle management rules","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Management policy type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage lifecycle management policy","private":true,"min_provider_version":"13.3.3","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.managementPolicy.rule":{"id":"azure.subscription.storageService.account.managementPolicy.rule","name":"azure.subscription.storageService.account.managementPolicy.rule","fields":{"baseBlobActions":{"name":"baseBlobActions","type":"\n","is_mandatory":true,"title":"Lifecycle actions applied to current blob versions","desc":"Dict with optional keys `delete`, `tierToCool`, `tierToCold`, `tierToArchive`, `tierToHot`, and `enableAutoTierToHotFromCool`. Each tier or delete value is an object carrying the age threshold that triggers it: `daysAfterModificationGreaterThan` or `daysAfterLastAccessTimeGreaterThan`.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"filterBlobTypes":{"name":"filterBlobTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Blob types the rule applies to (blockBlob, appendBlob)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"filterPrefixMatch":{"name":"filterPrefixMatch","type":"\u0019\u0007","is_mandatory":true,"title":"Prefix patterns for matching","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique ID (policyId + rule name)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name (case-sensitive, unique within policy)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"snapshotActions":{"name":"snapshotActions","type":"\n","is_mandatory":true,"title":"Lifecycle actions applied to blob snapshots","desc":"Dict with optional keys `delete`, `tierToCool`, `tierToCold`, `tierToArchive`, and `tierToHot`. Each value is an object carrying the age threshold `daysAfterCreationGreaterThan` that triggers it.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Rule type (always \"Lifecycle\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"versionActions":{"name":"versionActions","type":"\n","is_mandatory":true,"title":"Lifecycle actions applied to previous blob versions","desc":"Dict with optional keys `delete`, `tierToCool`, `tierToCold`, `tierToArchive`, and `tierToHot`. Each value is an object carrying the age threshold `daysAfterCreationGreaterThan` that triggers it.","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage lifecycle management policy rule","private":true,"min_provider_version":"13.3.3","defaults":"name enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.networkSecurityPerimeterConfiguration":{"id":"azure.subscription.storageService.account.networkSecurityPerimeterConfiguration","name":"azure.subscription.storageService.account.networkSecurityPerimeterConfiguration","fields":{"accessRules":{"name":"accessRules","type":"\u0019\n","is_mandatory":true,"title":"Access rules attached to the profile","desc":"Each entry has keys: name; direction (\"Inbound\" or \"Outbound\"); addressPrefixes (inbound CIDRs); subscriptions (inbound, each with an ARM subscription id); fullyQualifiedDomainNames (outbound FQDNs); and networkSecurityPerimeters (inbound, each with id, location, perimeterGuid).","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"accessRulesVersion":{"name":"accessRulesVersion","type":"\u0005","is_mandatory":true,"title":"Current access rules version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"associationAccessMode":{"name":"associationAccessMode","type":"\u0007","is_mandatory":true,"title":"Resource association access mode","desc":"One of \"Learning\", \"Audit\", or \"Enforced\". \"Learning\" and \"Audit\" only log access that violates the perimeter rules; \"Enforced\" blocks it.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"associationName":{"name":"associationName","type":"\u0007","is_mandatory":true,"title":"Resource association name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettingsVersion":{"name":"diagnosticSettingsVersion","type":"\u0005","is_mandatory":true,"title":"Current diagnostic settings version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabledLogCategories":{"name":"enabledLogCategories","type":"\u0019\u0007","is_mandatory":true,"title":"Log categories enabled on the profile","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"NSP configuration resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"NSP configuration name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"perimeterGuid":{"name":"perimeterGuid","type":"\u0007","is_mandatory":true,"title":"Universal unique ID of the network security perimeter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"perimeterId":{"name":"perimeterId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the network security perimeter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"perimeterLocation":{"name":"perimeterLocation","type":"\u0007","is_mandatory":true,"title":"Location of the network security perimeter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"profileName":{"name":"profileName","type":"\u0007","is_mandatory":true,"title":"Profile name on the perimeter","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningIssues":{"name":"provisioningIssues","type":"\u0019\n","is_mandatory":true,"title":"Issues that prevented the configuration from propagating","desc":"Each entry has keys: name; issueType (\"ConfigurationPropagationFailure\" or \"Unknown\"); severity (\"Error\" or \"Warning\"); and description.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the NSP configuration (\"Accepted\", \"Canceled\", \"Deleting\", \"Failed\", or \"Succeeded\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Network Security Perimeter configuration of an Azure Storage account","desc":"Association between a storage account and an Azure Network Security Perimeter, including the enforcement mode that decides whether perimeter access rules are logged only or actually blocked. Select a configuration by its `id`. The `associationAccessMode` field reports \"Learning\", \"Audit\", or \"Enforced\"; only \"Enforced\" blocks traffic that violates the perimeter rules. `accessRules` lists the inbound and outbound rules in effect, `enabledLogCategories` the categories shipped to diagnostics, and `provisioningIssues` any errors that prevented the configuration from propagating.","private":true,"min_provider_version":"13.15.1","defaults":"name associationAccessMode provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.objectReplicationPolicy":{"id":"azure.subscription.storageService.account.objectReplicationPolicy","name":"azure.subscription.storageService.account.objectReplicationPolicy","fields":{"destinationAccount":{"name":"destinationAccount","type":"\u0007","is_mandatory":true,"title":"Destination account name or full resource id","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabledTime":{"name":"enabledTime","type":"\t","is_mandatory":true,"title":"When the policy was enabled on the source account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"policyId":{"name":"policyId","type":"\u0007","is_mandatory":true,"title":"Auto-generated unique policy id","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Replication rules. Each entry has {ruleId, sourceContainer, destinationContainer, prefixMatch, minCreationTime}.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sourceAccount":{"name":"sourceAccount","type":"\u0007","is_mandatory":true,"title":"Source account name or full resource id","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tagsReplicationEnabled":{"name":"tagsReplicationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether blob index tags are replicated alongside blob data; false when the policy omits tag replication","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage object replication policy","desc":"Object replication policy linking a source storage account to a destination account. Selectable by ARM id; fields expose the source/destination pair, when replication was enabled, and the container-to-container rules with optional prefix and creation-time filters.","private":true,"min_provider_version":"13.10.2","defaults":"name sourceAccount destinationAccount enabledTime","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.privateEndpointConnection":{"id":"azure.subscription.storageService.account.privateEndpointConnection","name":"azure.subscription.storageService.account.privateEndpointConnection","fields":{"actionsRequired":{"name":"actionsRequired","type":"\u0007","is_mandatory":true,"title":"Action required by the consumer to maintain the connection (\"None\" / a description string)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Reason for the current status","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ARM resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpoint":{"name":"privateEndpoint","type":"\u001bazure.subscription.networkService.privateEndpoint","title":"Consumer-side private endpoint, or null when the connection has none","desc":"Resolves the private endpoint connecting to this storage account so the subnet and virtual network it is reachable from can be traversed, giving the private-access path into the account.","min_provider_version":"13.26.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointId":{"name":"privateEndpointId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the consumer-side private endpoint, when present","desc":"Deprecated in favor of privateEndpoint.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the connection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Connection status (\"Approved\", \"Pending\", \"Rejected\", \"Disconnected\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage private endpoint connection","desc":"Private endpoint connection on a storage account. Selectable by ARM id; fields expose the consumer-side endpoint reference and the approval status governing traffic between consumer and storage.","private":true,"min_provider_version":"13.10.2","defaults":"name status provisioningState","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.queue":{"id":"azure.subscription.storageService.account.queue","name":"azure.subscription.storageService.account.queue","fields":{"approximateMessageCount":{"name":"approximateMessageCount","type":"\u0005","title":"Approximate number of messages in the queue","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Queue resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Application-defined name/value pairs stored on the queue","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Queue name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage account queue","private":true,"min_provider_version":"13.10.2","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.service":{"id":"azure.subscription.storageService.account.service","fields":{"blobProperties":{"name":"blobProperties","type":"\u001bazure.subscription.storageService.account.service.blobProperties","title":"Azure Storage account blob service properties","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"properties":{"name":"properties","type":"\u001bazure.subscription.storageService.account.service.properties","title":"Azure Storage account service properties","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true}},"is_extension":true},"azure.subscription.storageService.account.service.blobProperties":{"id":"azure.subscription.storageService.account.service.blobProperties","name":"azure.subscription.storageService.account.service.blobProperties","fields":{"hourMetrics":{"name":"hourMetrics","type":"\u001bazure.subscription.storageService.account.service.properties.metrics","is_mandatory":true,"title":"Hourly metrics collection settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the service","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isVersioningEnabled":{"name":"isVersioningEnabled","type":"\u0004","is_mandatory":true,"title":"Whether versioning is enabled for blobs","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"logging":{"name":"logging","type":"\u001bazure.subscription.storageService.account.service.properties.logging","is_mandatory":true,"title":"Storage analytics logging configuration (read, write, delete operations)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minuteMetrics":{"name":"minuteMetrics","type":"\u001bazure.subscription.storageService.account.service.properties.metrics","is_mandatory":true,"title":"Minute metrics collection settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"staticWebsite":{"name":"staticWebsite","type":"\u001bazure.subscription.storageService.account.staticWebsiteConfig","is_mandatory":true,"title":"Static website hosting configuration for the blob service","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage account blob service properties","private":true,"min_provider_version":"11.4.23","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.service.properties":{"id":"azure.subscription.storageService.account.service.properties","name":"azure.subscription.storageService.account.service.properties","fields":{"hourMetrics":{"name":"hourMetrics","type":"\u001bazure.subscription.storageService.account.service.properties.metrics","is_mandatory":true,"title":"Hourly metrics collection settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the service","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"logging":{"name":"logging","type":"\u001bazure.subscription.storageService.account.service.properties.logging","is_mandatory":true,"title":"Storage analytics logging configuration (read, write, delete operations)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metrics":{"name":"metrics","type":"\u001bazure.subscription.storageService.account.service.properties.metrics","title":"Azure Storage account service properties metrics","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"minuteMetrics":{"name":"minuteMetrics","type":"\u001bazure.subscription.storageService.account.service.properties.metrics","is_mandatory":true,"title":"Minute metrics collection settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionPolicy":{"name":"retentionPolicy","type":"\u001bazure.subscription.storageService.account.service.properties.retentionPolicy","title":"Azure Storage account service properties retention policy","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true}},"title":"Azure Storage account service properties","private":true,"min_provider_version":"9.0.1","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.service.properties.logging":{"id":"azure.subscription.storageService.account.service.properties.logging","name":"azure.subscription.storageService.account.service.properties.logging","fields":{"delete":{"name":"delete","type":"\u0004","is_mandatory":true,"title":"Whether delete requests are logged","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the logging configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"read":{"name":"read","type":"\u0004","is_mandatory":true,"title":"Whether read requests are logged","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionPolicy":{"name":"retentionPolicy","type":"\u001bazure.subscription.storageService.account.service.properties.retentionPolicy","is_mandatory":true,"title":"Retention policy for the logging metrics","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Logging version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"write":{"name":"write","type":"\u0004","is_mandatory":true,"title":"Whether write requests are logged","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage account service properties logging","private":true,"min_provider_version":"9.0.1","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.service.properties.metrics":{"id":"azure.subscription.storageService.account.service.properties.metrics","name":"azure.subscription.storageService.account.service.properties.metrics","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the metrics are enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the metrics","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"includeAPIs":{"name":"includeAPIs","type":"\u0004","is_mandatory":true,"title":"Whether metrics generate summary statistics for called API operations","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionPolicy":{"name":"retentionPolicy","type":"\u001bazure.subscription.storageService.account.service.properties.retentionPolicy","is_mandatory":true,"title":"Retention policy for the metrics","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Version of the metrics","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage account service properties metrics","private":true,"min_provider_version":"9.0.1","defaults":"id includeAPIs enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.service.properties.retentionPolicy":{"id":"azure.subscription.storageService.account.service.properties.retentionPolicy","name":"azure.subscription.storageService.account.service.properties.retentionPolicy","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether a retention policy is enabled for the Azure Storage","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the retention policy","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"retentionDays":{"name":"retentionDays","type":"\u0005","is_mandatory":true,"title":"Number of days that metrics or logging data is retained","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage account service properties retention policy","private":true,"min_provider_version":"9.0.1","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.staticWebsiteConfig":{"id":"azure.subscription.storageService.account.staticWebsiteConfig","name":"azure.subscription.storageService.account.staticWebsiteConfig","fields":{"defaultIndexDocumentPath":{"name":"defaultIndexDocumentPath","type":"\u0007","is_mandatory":true,"title":"Absolute path to the default index document served at any directory level; empty when unset","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether static website hosting is enabled on the account","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"errorDocument404Path":{"name":"errorDocument404Path","type":"\u0007","is_mandatory":true,"title":"Path served for HTTP 404 responses (relative to $web); empty when unset","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"indexDocument":{"name":"indexDocument","type":"\u0007","is_mandatory":true,"title":"Default index document served at the root (e.g., \"index.html\"); empty when unset","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Static website hosting configuration on a storage account","desc":"Static website hosting settings for the account's `$web` container: whether the site is served and which documents the account returns for the root, subdirectory index, and 404 responses. An enabled account exposes an HTTPS-reachable web endpoint with no access control on the served files, so the presence of static hosting is itself an audit signal.","private":true,"min_provider_version":"13.12.2","defaults":"enabled indexDocument errorDocument404Path","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.storageService.account.table":{"id":"azure.subscription.storageService.account.table","name":"azure.subscription.storageService.account.table","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Table resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Table name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"signedIdentifiers":{"name":"signedIdentifiers","type":"\u0019\n","is_mandatory":true,"title":"Stored access policies (SAS) on the table; each entry has id, permission, startTime, expiryTime","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Storage account table","private":true,"min_provider_version":"13.10.2","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.synapseService":{"id":"azure.subscription.synapseService","name":"azure.subscription.synapseService","fields":{"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"workspace":{"name":"workspace","type":"\u001bazure.subscription.synapseService.workspace","title":"Azure Synapse Analytics workspace","desc":"Analytics workspace unifying data warehousing, big-data processing, and data integration. The security-relevant surface includes the default Data Lake Storage account, the SQL administrator login, the managed virtual network configuration, the public network access setting, customer-managed-key encryption settings, identity assignments, the `azureADOnlyAuthentication` flag, and the configured trusted-service bypass list.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"workspaces":{"name":"workspaces","type":"\u0019\u001bazure.subscription.synapseService.workspace","title":"List of Synapse workspaces","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Synapse Analytics service","private":true,"min_provider_version":"13.3.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.synapseService.workspace":{"id":"azure.subscription.synapseService.workspace","name":"azure.subscription.synapseService.workspace","fields":{"azureADOnlyAuthentication":{"name":"azureADOnlyAuthentication","type":"\u0004","is_mandatory":true,"title":"Whether Azure AD-only authentication is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"cmkKey":{"name":"cmkKey","type":"\u001bazure.subscription.keyVaultService.key","title":"Customer-managed key in Key Vault used to encrypt the workspace (null for platform-managed encryption)","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultStorage":{"name":"defaultStorage","type":"\u001bazure.subscription.storageService.account","title":"Default Data Lake Storage account for the workspace (null when none is configured)","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultStorageFilesystem":{"name":"defaultStorageFilesystem","type":"\u0007","is_mandatory":true,"title":"Name of the filesystem in the default Data Lake Storage account","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"encryption":{"name":"encryption","type":"\n","is_mandatory":true,"title":"Encryption configuration","desc":"Encryption settings for the workspace. Keys include `cmk` (the customer-managed key details, with `key`, `kekIdentity`, and `status`) and `doubleEncryptionEnabled`. The customer-managed key itself is also resolved through cmkKey.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Full resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Managed identity configuration","desc":"Identity block for the workspace. Keys include `type` (None, SystemAssigned, or \"SystemAssigned,UserAssigned\"), `principalId` and `tenantId` of the system-assigned identity, and `userAssignedIdentities` keyed by identity resource ID. The user-assigned identities are also available through userAssignedIdentities.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Location of the workspace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedResourceGroupName":{"name":"managedResourceGroupName","type":"\u0007","is_mandatory":true,"title":"Name of the managed resource group","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"managedVirtualNetwork":{"name":"managedVirtualNetwork","type":"\u0007","is_mandatory":true,"title":"Managed virtual network setting, set to \"default\" when enabled and empty when disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the workspace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections to the workspace","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Complete workspace properties as returned by the Azure API","desc":"Raw property bag for the workspace. Frequently audited values are also exposed as dedicated fields, including managedVirtualNetwork, publicNetworkAccess, encryption, sqlAdministratorLogin, defaultStorageFilesystem, and provisioningState.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access setting (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sqlAdministratorLogin":{"name":"sqlAdministratorLogin","type":"\u0007","is_mandatory":true,"title":"SQL administrator login","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Tags for the workspace","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"trustedServiceBypassEnabled":{"name":"trustedServiceBypassEnabled","type":"\u0004","is_mandatory":true,"title":"Whether trusted service bypass is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities associated with the workspace","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Synapse Analytics workspace","desc":"Analytics workspace unifying data warehousing, big-data processing, and data integration. The security-relevant surface includes the default Data Lake Storage account, the SQL administrator login, the managed virtual network configuration, the public network access setting, customer-managed-key encryption settings, identity assignments, the `azureADOnlyAuthentication` flag, and the configured trusted-service bypass list.","min_provider_version":"13.3.0","defaults":"name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.systemData":{"id":"azure.subscription.systemData","name":"azure.subscription.systemData","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the resource was created","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"Identity that created the resource (object ID, user principal name, or application ID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"createdByType":{"name":"createdByType","type":"\u0007","is_mandatory":true,"title":"Type of identity that created the resource","desc":"One of User, Application, ManagedIdentity, or Key.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedAt":{"name":"lastModifiedAt","type":"\t","is_mandatory":true,"title":"When the resource was last modified","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedBy":{"name":"lastModifiedBy","type":"\u0007","is_mandatory":true,"title":"Identity that last modified the resource (object ID, user principal name, or application ID)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"lastModifiedByType":{"name":"lastModifiedByType","type":"\u0007","is_mandatory":true,"title":"Type of identity that last modified the resource","desc":"One of User, Application, ManagedIdentity, or Key.","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Resource Manager system metadata","desc":"Creation and last-modification provenance that Azure Resource Manager records for a resource: the identity that created it, the identity that last modified it, the type of each identity, and the corresponding timestamps. Answers \"who created this resource and when\" across the resources that report system metadata.","private":true,"min_provider_version":"13.19.2","defaults":"createdBy createdAt lastModifiedBy lastModifiedAt","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webPubSubService":{"id":"azure.subscription.webPubSubService","name":"azure.subscription.webPubSubService","fields":{"instances":{"name":"instances","type":"\u0019\u001bazure.subscription.webPubSubService.webPubSub","title":"Azure Web PubSub Service instances in the subscription","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"webPubSub":{"name":"webPubSub","type":"\u001bazure.subscription.webPubSubService.webPubSub","title":"Azure Web PubSub Service instance","desc":"Single Web PubSub Service instance providing real-time publish/subscribe messaging over WebSockets. The security-relevant fields confirm whether the instance is reachable from the public internet (publicNetworkAccess), which authentication methods are enabled (disableLocalAuth and disableAadAuth), whether mutual TLS client certificates are required (clientCertEnabled), and the default rule applied when no network ACL matches (networkAclsDefaultAction).","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true}},"title":"Azure Web PubSub Service","desc":"Web PubSub Service instances in the subscription, each providing real-time publish/subscribe messaging over WebSockets. Query the instances to audit public network exposure, the enabled authentication methods, and network access rules across the subscription.","private":true,"min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webPubSubService.webPubSub":{"id":"azure.subscription.webPubSubService.webPubSub","name":"azure.subscription.webPubSubService.webPubSub","fields":{"clientCertEnabled":{"name":"clientCertEnabled","type":"\u0004","is_mandatory":true,"title":"Whether mutual TLS client certificate authentication is required","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableAadAuth":{"name":"disableAadAuth","type":"\u0004","is_mandatory":true,"title":"Whether Microsoft Entra ID (AAD) authentication is disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"disableLocalAuth":{"name":"disableLocalAuth","type":"\u0004","is_mandatory":true,"title":"Whether access-key (local) authentication is disabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"externalIp":{"name":"externalIp","type":"\u0007","is_mandatory":true,"title":"External IP of the instance","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostName":{"name":"hostName","type":"\u0007","is_mandatory":true,"title":"Public hostname clients connect to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Web PubSub resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"Identity configuration (SystemAssigned, UserAssigned, principalId, tenantId)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Service kind (\"WebPubSub\" or \"SocketIO\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Web PubSub resource location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Web PubSub resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"networkAclsDefaultAction":{"name":"networkAclsDefaultAction","type":"\u0007","is_mandatory":true,"title":"Default action applied when no network ACL matches (\"Allow\" or \"Deny\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections to the instance","min_provider_version":"13.24.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether the instance is reachable from the public internet (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"SKU details (name, tier, capacity)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Web PubSub resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Service software version","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Web PubSub Service instance","desc":"Single Web PubSub Service instance providing real-time publish/subscribe messaging over WebSockets. The security-relevant fields confirm whether the instance is reachable from the public internet (publicNetworkAccess), which authentication methods are enabled (disableLocalAuth and disableAadAuth), whether mutual TLS client certificates are required (clientCertEnabled), and the default rule applied when no network ACL matches (networkAclsDefaultAction).","min_provider_version":"13.16.2","defaults":"id name location publicNetworkAccess","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService":{"id":"azure.subscription.webService","name":"azure.subscription.webService","fields":{"appRuntimeStack":{"name":"appRuntimeStack","type":"\u001bazure.subscription.webService.appRuntimeStack","title":"Azure Web App runtime stack","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"appServicePlan":{"name":"appServicePlan","type":"\u001bazure.subscription.webService.appServicePlan","title":"Azure App Service Plan","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"appServicePlans":{"name":"appServicePlans","type":"\u0019\u001bazure.subscription.webService.appServicePlan","title":"List of App Service plans","min_provider_version":"11.4.32","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"apps":{"name":"apps","type":"\u0019\u001bazure.subscription.webService.appsite","title":"List of web apps","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"appsite":{"name":"appsite","type":"\u001bazure.subscription.webService.appsite","title":"Azure App Service site","desc":"App Service, Function App, or Web App hosted in the subscription, with the security and network surface that governs how it is exposed and authenticated. The configuration covers the runtime stack, the App Service Plan binding, HTTPS-only enforcement, client-certificate requirements, minimum TLS version, FTPS and remote-debugging state, IP restrictions and CORS, public network access, managed-identity assignments, custom hostnames and SSL bindings, private endpoint connections, and regional VNet integration. Deployment slots, app settings, connection strings, and diagnostic settings are queryable for auditing configuration drift and credential exposure.","provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"appsiteauthsettings":{"name":"appsiteauthsettings","type":"\u001bazure.subscription.webService.appsiteauthsettings","title":"Azure AppSite authentication settings","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"appsiteconfig":{"name":"appsiteconfig","type":"\u001bazure.subscription.webService.appsiteconfig","title":"Azure AppSite config","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"appslot":{"name":"appslot","type":"\u001bazure.subscription.webService.appslot","title":"Azure Web app deployment slot","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"availableRuntimes":{"name":"availableRuntimes","type":"\u0019\u001bazure.subscription.webService.appRuntimeStack","title":"Available runtimes","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"certificate":{"name":"certificate","type":"\u001bazure.subscription.webService.certificate","title":"Azure App Service Certificate","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"certificates":{"name":"certificates","type":"\u0019\u001bazure.subscription.webService.certificate","title":"List of certificates","min_provider_version":"11.4.32","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"function":{"name":"function","type":"\u001bazure.subscription.webService.function","title":"Azure function","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"hostingEnvironment":{"name":"hostingEnvironment","type":"\u001bazure.subscription.webService.hostingEnvironment","title":"Azure App Service Hosting Environment","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"hostingEnvironments":{"name":"hostingEnvironments","type":"\u0019\u001bazure.subscription.webService.hostingEnvironment","title":"List of hosting environments","min_provider_version":"11.4.4","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"staticSite":{"name":"staticSite","type":"\u001bazure.subscription.webService.staticSite","title":"Azure Static Web App","desc":"Managed service that hosts static content (HTML/CSS/JS), serverless API routes, and globally distributed assets built from a source repository (typically GitHub or Azure DevOps). The SKU and tier (Free, Standard, Dedicated), default and custom hostnames, source repository URL and branch, publishing provider, public network access toggle, `allowConfigFileUpdates` flag, staging-environment policy (preview deployments per pull request), enterprise-grade CDN status, and Key Vault reference identity govern how the app is built, exposed, and authenticated. Counts for private endpoint connections, user-provided function apps, linked backends, and database connections summarize its integration surface.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"staticSites":{"name":"staticSites","type":"\u0019\u001bazure.subscription.webService.staticSite","title":"List of static web apps","min_provider_version":"13.10.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subscriptionId":{"name":"subscriptionId","type":"\u0007","is_mandatory":true,"title":"Subscription identifier","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Web","private":true,"min_provider_version":"9.0.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.appRuntimeStack":{"id":"azure.subscription.webService.appRuntimeStack","name":"azure.subscription.webService.appRuntimeStack","fields":{"autoUpdate":{"name":"autoUpdate","type":"\u0004","is_mandatory":true,"title":"Whether the stack version is auto-updated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the stack is deprecated","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endOfLifeDate":{"name":"endOfLifeDate","type":"\t","is_mandatory":true,"title":"End-of-life date for the minor version","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hidden":{"name":"hidden","type":"\u0004","is_mandatory":true,"title":"Whether the stack is hidden","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"majorVersion":{"name":"majorVersion","type":"\u0007","is_mandatory":true,"title":"Web App stack major version name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minorVersion":{"name":"minorVersion","type":"\u0007","is_mandatory":true,"title":"Web App stack minor version name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Web App stack name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"preferredOs":{"name":"preferredOs","type":"\u0007","is_mandatory":true,"title":"Web App stack preferred OS","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"runtimeVersion":{"name":"runtimeVersion","type":"\u0007","is_mandatory":true,"title":"Web App runtime version","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Web App runtime stack","private":true,"min_provider_version":"11.3.52","defaults":"preferredOs runtimeVersion","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.appServicePlan":{"id":"azure.subscription.webService.appServicePlan","name":"azure.subscription.webService.appServicePlan","fields":{"elasticScaleEnabled":{"name":"elasticScaleEnabled","type":"\u0004","is_mandatory":true,"title":"Whether elastic scale is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"geoRegion":{"name":"geoRegion","type":"\u0007","is_mandatory":true,"title":"Geographic region of the plan","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"App Service plan ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"App Service plan kind (e.g., \"linux\", \"app\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"App Service plan location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maximumNumberOfWorkers":{"name":"maximumNumberOfWorkers","type":"\u0005","is_mandatory":true,"title":"Maximum number of workers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"App Service plan name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"numberOfSites":{"name":"numberOfSites","type":"\u0005","is_mandatory":true,"title":"Number of web apps assigned to this plan","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"perSiteScaling":{"name":"perSiteScaling","type":"\u0004","is_mandatory":true,"title":"Whether per-site scaling is enabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"App Service plan properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"reserved":{"name":"reserved","type":"\u0004","is_mandatory":true,"title":"Whether the plan is for Linux apps","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sku":{"name":"sku","type":"\n","is_mandatory":true,"title":"SKU description (name, tier, size, family, capacity)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Current status of the plan. Possible values: \"Ready\", \"Pending\", \"Creating\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"App Service plan tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zoneRedundant":{"name":"zoneRedundant","type":"\u0004","is_mandatory":true,"title":"Whether the plan is zone-redundant","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure App Service Plan","private":true,"min_provider_version":"11.4.32","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.appsite":{"id":"azure.subscription.webService.appsite","name":"azure.subscription.webService.appsite","fields":{"applicationSettings":{"name":"applicationSettings","type":"\n","title":"App site application settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"authenticationSettings":{"name":"authenticationSettings","type":"\u001bazure.subscription.webService.appsiteauthsettings","title":"App site authentication settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"basicPublishingCredentialsPolicies":{"name":"basicPublishingCredentialsPolicies","type":"\u001bazure.subscription.webService.appsite.basicPublishingCredentialsPolicies","title":"Azure AppSite basic publishing credentials policies","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"clientCertEnabled":{"name":"clientCertEnabled","type":"\u0004","is_mandatory":true,"title":"Whether client certificate authentication is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"clientCertMode":{"name":"clientCertMode","type":"\u0007","is_mandatory":true,"title":"Client certificate mode (Required, Optional, OptionalInteractiveUser)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"configuration":{"name":"configuration","type":"\u001bazure.subscription.webService.appsiteconfig","title":"App site configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionSettings":{"name":"connectionSettings","type":"\n","title":"App site connection settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultHostName":{"name":"defaultHostName","type":"\u0007","is_mandatory":true,"title":"Default hostname assigned to the app (e.g., \"my-app.azurewebsites.net\")","min_provider_version":"13.4.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettings":{"name":"diagnosticSettings","type":"\u0019\u001bazure.subscription.monitorService.diagnosticsetting","title":"Diagnostic settings for the web app site","min_provider_version":"11.3.0","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettingsCategories":{"name":"diagnosticSettingsCategories","type":"\u0019\u001bazure.subscription.monitorService.diagnosticSettingsCategory","title":"Diagnostic settings categories the web app site can emit (available log and metric categories)","min_provider_version":"13.30.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the app is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enabledHostNames":{"name":"enabledHostNames","type":"\u0019\u0007","is_mandatory":true,"title":"All enabled hostnames for the app, including custom domains","min_provider_version":"13.4.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"endToEndEncryptionEnabled":{"name":"endToEndEncryptionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether end-to-end encryption is enabled between FrontEnd and Worker","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ftp":{"name":"ftp","type":"\u001bazure.subscription.webService.appsite.basicPublishingCredentialsPolicies","title":"FTP publishing method policies","min_provider_version":"11.3.31","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"functions":{"name":"functions","type":"\u0019\u001bazure.subscription.webService.function","title":"List of functions for the web app site","min_provider_version":"11.3.3","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostNameBinding":{"name":"hostNameBinding","type":"\u001bazure.subscription.webService.appsite.hostNameBinding","title":"Azure App Service Hostname Binding","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"hostNameBindings":{"name":"hostNameBindings","type":"\u0019\u001bazure.subscription.webService.appsite.hostNameBinding","title":"Hostname bindings for the web app site","min_provider_version":"11.4.32","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"httpsOnly":{"name":"httpsOnly","type":"\u0004","is_mandatory":true,"title":"Whether the app requires HTTPS only","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"App site ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"App site identity","desc":"Deprecated in favor of principalId, userAssignedIdentities, and identityType.","provider":"go.mondoo.com/cnquery/v9/providers/azure","maturity":"deprecated"},"identityType":{"name":"identityType","type":"\u0007","is_mandatory":true,"title":"Managed identity type (\"None\", \"SystemAssigned\", \"UserAssigned\", \"SystemAssigned,UserAssigned\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipMode":{"name":"ipMode","type":"\u0007","is_mandatory":true,"title":"IP address mode for the app (\"IPv4\", \"IPv4AndIPv6\", \"IPv6\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultReferenceIdentity":{"name":"keyVaultReferenceIdentity","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the user-assigned identity used to fetch Key Vault references in app settings (empty when system-assigned identity is used)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultReferenceIdentityRef":{"name":"keyVaultReferenceIdentityRef","type":"\u001bazure.subscription.managedIdentity","title":"User-assigned managed identity used to fetch Key Vault references in app settings; null when the system-assigned identity is used","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"App site kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"App site location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metadata":{"name":"metadata","type":"\n","title":"App site metadata","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"App site name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"outboundVnetRouting":{"name":"outboundVnetRouting","type":"\u001bazure.subscription.webService.appsite.outboundVnetRouting","is_mandatory":true,"title":"Outbound VNet routing configuration for the app","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Principal ID of the app's system-assigned managed identity; empty when no system-assigned identity is enabled","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnections":{"name":"privateEndpointConnections","type":"\u0019\u001bazure.subscription.privateEndpointConnection","title":"Private endpoint connections for the web app site","min_provider_version":"11.4.4","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"App site properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Whether public network access is enabled (\"Enabled\" or \"Disabled\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"redundancyMode":{"name":"redundancyMode","type":"\u0007","is_mandatory":true,"title":"Redundancy mode for the app (\"None\", \"Manual\", \"Failover\", \"ActiveActive\", \"GeoRedundant\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scm":{"name":"scm","type":"\u001bazure.subscription.webService.appsite.basicPublishingCredentialsPolicies","title":"SCM publishing method policies","min_provider_version":"11.3.31","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"slots":{"name":"slots","type":"\u0019\u001bazure.subscription.webService.appslot","title":"Deployment slots for the web app site","min_provider_version":"11.3.85","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sshEnabled":{"name":"sshEnabled","type":"\u0004","is_mandatory":true,"title":"Whether SSH access is enabled on the app","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"stack":{"name":"stack","type":"\n","title":"App site stack","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Current state of the app","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemAssignedIdentity":{"name":"systemAssignedIdentity","type":"\u001bazure.subscription.managedIdentity","title":"System-assigned managed identity of the app; null when no system-assigned identity is enabled","desc":"Resolves the system-assigned identity so its role assignments, and their role definitions and permissions, can be traversed, completing the resource-to-privilege leg of an attack path.","min_provider_version":"13.26.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.19.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"App site tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"App site type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userAssignedIdentities":{"name":"userAssignedIdentities","type":"\u0019\u001bazure.subscription.managedIdentity","title":"User-assigned managed identities attached to the app","min_provider_version":"13.23.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkConnection":{"name":"virtualNetworkConnection","type":"\u001bazure.subscription.webService.appsite.virtualNetworkConnection","title":"Azure App Service Virtual Network Connection","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"virtualNetworkConnections":{"name":"virtualNetworkConnections","type":"\u0019\u001bazure.subscription.webService.appsite.virtualNetworkConnection","title":"Virtual network connections for the web app site","min_provider_version":"11.4.32","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkSubnet":{"name":"virtualNetworkSubnet","type":"\u001bazure.subscription.networkService.subnet","title":"Subnet the app is regionally VNet-integrated with; null when no regional VNet integration is configured","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetworkSubnetId":{"name":"virtualNetworkSubnetId","type":"\u0007","is_mandatory":true,"title":"ARM resource ID of the subnet the app is regionally VNet-integrated with; empty when no regional VNet integration is configured","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure App Service site","desc":"App Service, Function App, or Web App hosted in the subscription, with the security and network surface that governs how it is exposed and authenticated. The configuration covers the runtime stack, the App Service Plan binding, HTTPS-only enforcement, client-certificate requirements, minimum TLS version, FTPS and remote-debugging state, IP restrictions and CORS, public network access, managed-identity assignments, custom hostnames and SSL bindings, private endpoint connections, and regional VNet integration. Deployment slots, app settings, connection strings, and diagnostic settings are queryable for auditing configuration drift and credential exposure.","min_provider_version":"9.0.1","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.appsite.basicPublishingCredentialsPolicies":{"id":"azure.subscription.webService.appsite.basicPublishingCredentialsPolicies","name":"azure.subscription.webService.appsite.basicPublishingCredentialsPolicies","fields":{"allow":{"name":"allow","type":"\u0004","is_mandatory":true,"title":"Whether to allow access to a publishing method","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure AppSite basic publishing credentials policies","private":true,"min_provider_version":"11.3.31","defaults":"id allow","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.appsite.hostNameBinding":{"id":"azure.subscription.webService.appsite.hostNameBinding","name":"azure.subscription.webService.appsite.hostNameBinding","fields":{"hostNameType":{"name":"hostNameType","type":"\u0007","is_mandatory":true,"title":"Hostname type. Possible values: \"Verified\", \"Managed\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Hostname binding ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Hostname binding name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"sslState":{"name":"sslState","type":"\u0007","is_mandatory":true,"title":"SSL state. Possible values: \"Disabled\", \"SniEnabled\", \"IpBasedEnabled\"","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"thumbprint":{"name":"thumbprint","type":"\u0007","is_mandatory":true,"title":"SSL certificate thumbprint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualIP":{"name":"virtualIP","type":"\u0007","is_mandatory":true,"title":"Virtual IP address assigned to the hostname","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure App Service Hostname Binding","private":true,"min_provider_version":"11.4.32","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.appsite.outboundVnetRouting":{"id":"azure.subscription.webService.appsite.outboundVnetRouting","name":"azure.subscription.webService.appsite.outboundVnetRouting","fields":{"allTrafficEnabled":{"name":"allTrafficEnabled","type":"\u0004","is_mandatory":true,"title":"Whether all outbound traffic is routed through VNet","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"applicationTrafficEnabled":{"name":"applicationTrafficEnabled","type":"\u0004","is_mandatory":true,"title":"Whether application traffic is routed through VNet","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"backupRestoreTrafficEnabled":{"name":"backupRestoreTrafficEnabled","type":"\u0004","is_mandatory":true,"title":"Whether backup/restore traffic is routed through VNet","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"contentShareTrafficEnabled":{"name":"contentShareTrafficEnabled","type":"\u0004","is_mandatory":true,"title":"Whether content share traffic is routed through VNet","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Outbound VNet routing ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"imagePullTrafficEnabled":{"name":"imagePullTrafficEnabled","type":"\u0004","is_mandatory":true,"title":"Whether container image pull traffic is routed through VNet","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Web app site outbound VNet routing configuration","private":true,"min_provider_version":"13.1.8","defaults":"allTrafficEnabled","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.appsite.virtualNetworkConnection":{"id":"azure.subscription.webService.appsite.virtualNetworkConnection","name":"azure.subscription.webService.appsite.virtualNetworkConnection","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"VNet connection ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"isSwift":{"name":"isSwift","type":"\u0004","is_mandatory":true,"title":"Whether this is a Swift connection","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"VNet connection name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"resyncRequired":{"name":"resyncRequired","type":"\u0004","is_mandatory":true,"title":"Whether a resync is required","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vnetResourceId":{"name":"vnetResourceId","type":"\u0007","is_mandatory":true,"title":"Resource ID of the connected VNet","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure App Service Virtual Network Connection","private":true,"min_provider_version":"11.4.32","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.appsiteauthsettings":{"id":"azure.subscription.webService.appsiteauthsettings","name":"azure.subscription.webService.appsiteauthsettings","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether App Service Authentication / Authorization (Easy Auth) is enabled","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Auth settings ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Auth settings kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Auth settings name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Auth settings properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Auth settings type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"unauthenticatedClientAction":{"name":"unauthenticatedClientAction","type":"\u0007","is_mandatory":true,"title":"Action taken when an unauthenticated client requests the app","desc":"Possible values: AllowAnonymous, RedirectToLoginPage. Anything other than AllowAnonymous means unauthenticated requests are blocked or redirected to a login provider.","min_provider_version":"13.16.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure AppSite authentication settings","private":true,"min_provider_version":"9.0.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.appsiteconfig":{"id":"azure.subscription.webService.appsiteconfig","name":"azure.subscription.webService.appsiteconfig","fields":{"alwaysOn":{"name":"alwaysOn","type":"\u0004","is_mandatory":true,"title":"Whether the app should always be loaded","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"autoHealEnabled":{"name":"autoHealEnabled","type":"\u0004","is_mandatory":true,"title":"Whether auto-heal is enabled (the app is automatically restarted on certain conditions)","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"corsAllowedOrigins":{"name":"corsAllowedOrigins","type":"\u0019\u0007","is_mandatory":true,"title":"CORS allowed origins configured for the site (empty when CORS is not configured; \"*\" allows any origin)","min_provider_version":"13.18.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"detailedErrorLoggingEnabled":{"name":"detailedErrorLoggingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether detailed error logging is enabled","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ftpsState":{"name":"ftpsState","type":"\u0007","is_mandatory":true,"title":"FTP state for the site (AllAllowed, FtpsOnly, Disabled)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"http20Enabled":{"name":"http20Enabled","type":"\u0004","is_mandatory":true,"title":"Whether HTTP 2.0 is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"httpLoggingEnabled":{"name":"httpLoggingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether HTTP logging is enabled for the app","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Appsite config ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipSecurityRestriction":{"name":"ipSecurityRestriction","type":"\u001bazure.subscription.webService.appsiteconfig.ipSecurityRestriction","title":"Azure AppSite config IP security restriction rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/azure","is_implicit_resource":true},"ipSecurityRestrictions":{"name":"ipSecurityRestrictions","type":"\u0019\u001bazure.subscription.webService.appsiteconfig.ipSecurityRestriction","title":"IP security restrictions for the main site","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipSecurityRestrictionsDefaultAction":{"name":"ipSecurityRestrictionsDefaultAction","type":"\u0007","title":"Default action for IP security restrictions when no rule matches (\"Allow\" or \"Deny\")","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Appsite config kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minTlsCipherSuite":{"name":"minTlsCipherSuite","type":"\u0007","is_mandatory":true,"title":"Minimum strength TLS cipher suite allowed for the application","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"minTlsVersion":{"name":"minTlsVersion","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version for the site (1.0, 1.1, 1.2, 1.3)","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Appsite config name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Appsite config properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"remoteDebuggingEnabled":{"name":"remoteDebuggingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether remote debugging is enabled","min_provider_version":"11.4.28","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scmIpSecurityRestrictions":{"name":"scmIpSecurityRestrictions","type":"\u0019\u001bazure.subscription.webService.appsiteconfig.ipSecurityRestriction","title":"IP security restrictions for the SCM/Kudu site","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scmMinTlsVersion":{"name":"scmMinTlsVersion","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version for the SCM/Kudu site (1.0, 1.1, 1.2, 1.3)","min_provider_version":"13.1.8","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Appsite config type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"webSocketsEnabled":{"name":"webSocketsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether WebSockets are enabled for the app","min_provider_version":"13.12.2","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure AppSite config","private":true,"min_provider_version":"9.0.1","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.appsiteconfig.ipSecurityRestriction":{"id":"azure.subscription.webService.appsiteconfig.ipSecurityRestriction","name":"azure.subscription.webService.appsiteconfig.ipSecurityRestriction","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action for the restriction rule (\"Allow\" or \"Deny\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Restriction rule description","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"headers":{"name":"headers","type":"\n","is_mandatory":true,"title":"HTTP header match conditions for the restriction","desc":"Keys are HTTP header names that further scope the rule (for example X-Forwarded-Host, X-Forwarded-For, X-Azure-FDID, X-FD-HealthProbe); each value is the list of header values the rule matches on.","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Restriction rule ID (config ID + index)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipAddress":{"name":"ipAddress","type":"\u0007","is_mandatory":true,"title":"IP address or CIDR range for the restriction","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Restriction rule name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Priority of the restriction rule (lower number = higher priority)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnetMask":{"name":"subnetMask","type":"\u0007","is_mandatory":true,"title":"Subnet mask for the IP address range the restriction applies to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tag":{"name":"tag","type":"\u0007","is_mandatory":true,"title":"Tag for the restriction rule (\"Default\", \"XffProxy\", \"ServiceTag\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"vnetSubnetResourceId":{"name":"vnetSubnetResourceId","type":"\u0007","is_mandatory":true,"title":"Virtual network subnet resource ID for VNet-based restrictions","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure AppSite config IP security restriction rule","private":true,"min_provider_version":"13.1.8","defaults":"name action ipAddress priority","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.appslot":{"id":"azure.subscription.webService.appslot","name":"azure.subscription.webService.appslot","fields":{"applicationSettings":{"name":"applicationSettings","type":"\n","title":"App slot application settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"authenticationSettings":{"name":"authenticationSettings","type":"\u001bazure.subscription.webService.appsiteauthsettings","title":"App slot authentication settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"configuration":{"name":"configuration","type":"\u001bazure.subscription.webService.appsiteconfig","title":"App slot configuration","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"connectionSettings":{"name":"connectionSettings","type":"\n","title":"App slot connection settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettings":{"name":"diagnosticSettings","type":"\u0019\u001bazure.subscription.monitorService.diagnosticsetting","title":"App slot diagnostic settings","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"diagnosticSettingsCategories":{"name":"diagnosticSettingsCategories","type":"\u0019\u001bazure.subscription.monitorService.diagnosticSettingsCategory","title":"Diagnostic settings categories the app slot can emit (available log and metric categories)","min_provider_version":"13.30.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ftp":{"name":"ftp","type":"\u001bazure.subscription.webService.appsite.basicPublishingCredentialsPolicies","title":"FTP publishing method policies for the slot","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"functions":{"name":"functions","type":"\u0019\u001bazure.subscription.webService.function","title":"List of functions for the app slot","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"App slot ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identity":{"name":"identity","type":"\n","is_mandatory":true,"title":"App slot identity","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"App slot kind","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"App slot location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"metadata":{"name":"metadata","type":"\n","title":"App slot metadata","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"App slot name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"parent":{"name":"parent","type":"\u001bazure.subscription.webService.appsite","title":"Parent web app site for this slot","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"App slot properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"scm":{"name":"scm","type":"\u001bazure.subscription.webService.appsite.basicPublishingCredentialsPolicies","title":"SCM publishing method policies for the slot","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"stack":{"name":"stack","type":"\n","title":"App slot stack","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"App slot tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"App slot type","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Web app deployment slot","private":true,"min_provider_version":"11.3.85","defaults":"id name location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.certificate":{"id":"azure.subscription.webService.certificate","name":"azure.subscription.webService.certificate","fields":{"expirationDate":{"name":"expirationDate","type":"\t","is_mandatory":true,"title":"Certificate expiration date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hostNames":{"name":"hostNames","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames the certificate applies to","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Certificate ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"issueDate":{"name":"issueDate","type":"\t","is_mandatory":true,"title":"Certificate issue date","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"Certificate issuer","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Certificate location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Certificate name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Certificate properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subjectName":{"name":"subjectName","type":"\u0007","is_mandatory":true,"title":"Certificate subject name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Certificate tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"thumbprint":{"name":"thumbprint","type":"\u0007","is_mandatory":true,"title":"Certificate thumbprint","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"valid":{"name":"valid","type":"\u0004","is_mandatory":true,"title":"Whether the certificate is valid","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure App Service Certificate","private":true,"min_provider_version":"11.4.32","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.function":{"id":"azure.subscription.webService.function","name":"azure.subscription.webService.function","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"ID of the function","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kind of function","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the function","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Properties for the function","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type of function","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure function","private":true,"min_provider_version":"11.3.3","defaults":"name type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.hostingEnvironment":{"id":"azure.subscription.webService.hostingEnvironment","name":"azure.subscription.webService.hostingEnvironment","fields":{"clusterSettings":{"name":"clusterSettings","type":"\u0019\n","is_mandatory":true,"title":"Custom settings for changing the behavior of the App Service Environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dedicatedHostCount":{"name":"dedicatedHostCount","type":"\u0005","is_mandatory":true,"title":"Dedicated Host Count","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"dnsSuffix":{"name":"dnsSuffix","type":"\u0007","is_mandatory":true,"title":"DNS suffix of the environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"frontEndScaleFactor":{"name":"frontEndScaleFactor","type":"\u0005","is_mandatory":true,"title":"Scale factor for front-ends","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"hasLinuxWorkers":{"name":"hasLinuxWorkers","type":"\u0004","is_mandatory":true,"title":"Whether the App Service Environment has Linux workers","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Environment ID","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"internalLoadBalancingMode":{"name":"internalLoadBalancingMode","type":"\u0007","is_mandatory":true,"title":"Specifies which endpoints to serve internally in the Virtual Network","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"ipsslAddressCount":{"name":"ipsslAddressCount","type":"\u0005","is_mandatory":true,"title":"Number of IP SSL addresses reserved for the App Service Environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kind of resource (e.g., \"app,linux,container\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Environment location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"maximumNumberOfMachines":{"name":"maximumNumberOfMachines","type":"\u0005","is_mandatory":true,"title":"Maximum number of VMs in the environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"multiRoleCount":{"name":"multiRoleCount","type":"\u0005","is_mandatory":true,"title":"Number of front-end instances","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"multiSize":{"name":"multiSize","type":"\u0007","is_mandatory":true,"title":"Front-end VM size (e.g., \"Standard_D2d_v4\", \"Medium\", \"Large\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Environment name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Environment properties","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the environment","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"suspended":{"name":"suspended","type":"\u0004","is_mandatory":true,"title":"Whether the environment is suspended","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.28.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Environment tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Environment type","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userWhitelistedIpRanges":{"name":"userWhitelistedIpRanges","type":"\u0019\u0007","is_mandatory":true,"title":"User added IP ranges to allow","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"virtualNetwork":{"name":"virtualNetwork","type":"\u001bazure.subscription.webService.hostingEnvironment.virtualNetwork","is_mandatory":true,"title":"Description of the Virtual Network","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"zoneRedundant":{"name":"zoneRedundant","type":"\u0004","is_mandatory":true,"title":"Whether the App Service Environment is zone-redundant","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure App Service Hosting Environment","private":true,"min_provider_version":"11.4.4","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.hostingEnvironment.virtualNetwork":{"id":"azure.subscription.webService.hostingEnvironment.virtualNetwork","name":"azure.subscription.webService.hostingEnvironment.virtualNetwork","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID of the Virtual Network","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the Virtual Network","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"subnet":{"name":"subnet","type":"\u0007","is_mandatory":true,"title":"Subnet within the Virtual Network","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type of the Virtual Network","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Virtual network configuration for an App Service Environment","private":true,"min_provider_version":"11.4.4","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"azure.subscription.webService.staticSite":{"id":"azure.subscription.webService.staticSite","name":"azure.subscription.webService.staticSite","fields":{"allowConfigFileUpdates":{"name":"allowConfigFileUpdates","type":"\u0004","is_mandatory":true,"title":"Whether the staticwebapp.config.json file in the repo can update the runtime config","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"branch":{"name":"branch","type":"\u0007","is_mandatory":true,"title":"Target branch in the repository","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"contentDistributionEndpoint":{"name":"contentDistributionEndpoint","type":"\u0007","is_mandatory":true,"title":"Content distribution endpoint for the static site","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"customDomains":{"name":"customDomains","type":"\u0019\u0007","is_mandatory":true,"title":"Custom domains bound to the static site","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"databaseConnectionCount":{"name":"databaseConnectionCount","type":"\u0005","is_mandatory":true,"title":"Number of database connections bound to the static site","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"defaultHostname":{"name":"defaultHostname","type":"\u0007","is_mandatory":true,"title":"Default autogenerated hostname for the static site (e.g. \"happy-flower-12345.azurestaticapps.net\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"enterpriseGradeCdnStatus":{"name":"enterpriseGradeCdnStatus","type":"\u0007","is_mandatory":true,"title":"Enterprise-grade CDN status (\"Disabled\", \"Enabling\", \"Enabled\", \"Disabling\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource ID of the static web app","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"identityType":{"name":"identityType","type":"\u0007","is_mandatory":true,"title":"Identity type (\"None\", \"SystemAssigned\", \"UserAssigned\", or \"SystemAssigned, UserAssigned\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"keyVaultReferenceIdentity":{"name":"keyVaultReferenceIdentity","type":"\u0007","is_mandatory":true,"title":"User-assigned managed identity used for Key Vault reference authentication (empty when not configured)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Resource kind (e.g. \"app\", \"functionapp\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"linkedBackendCount":{"name":"linkedBackendCount","type":"\u0005","is_mandatory":true,"title":"Number of linked backends bound to the static site","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Resource location","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Static web app name","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"privateEndpointConnectionCount":{"name":"privateEndpointConnectionCount","type":"\u0005","is_mandatory":true,"title":"Number of private endpoint connections to the static site","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"provider":{"name":"provider","type":"\u0007","is_mandatory":true,"title":"Provider that submitted the last deployment (\"GitHub\", \"DevOps\", \"VisualStudio\", \"Custom\", \"None\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"publicNetworkAccess":{"name":"publicNetworkAccess","type":"\u0007","is_mandatory":true,"title":"Public network access setting (\"Enabled\", \"Disabled\", or empty)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"repositoryUrl":{"name":"repositoryUrl","type":"\u0007","is_mandatory":true,"title":"Source repository URL (GitHub or Azure DevOps)","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuName":{"name":"skuName","type":"\u0007","is_mandatory":true,"title":"SKU name (e.g. \"Free\", \"Standard\", \"Dedicated\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"skuTier":{"name":"skuTier","type":"\u0007","is_mandatory":true,"title":"SKU tier","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"stagingEnvironmentPolicy":{"name":"stagingEnvironmentPolicy","type":"\u0007","is_mandatory":true,"title":"Staging environment policy for preview deployments (\"Enabled\" or \"Disabled\")","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"systemMetadata":{"name":"systemMetadata","type":"\u001bazure.subscription.systemData","title":"Creation and last-modification provenance recorded by Azure Resource Manager","min_provider_version":"13.22.1","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","provider":"go.mondoo.com/cnquery/v9/providers/azure"},"userProvidedFunctionAppCount":{"name":"userProvidedFunctionAppCount","type":"\u0005","is_mandatory":true,"title":"Number of user-provided function apps registered with the static site (BYO Functions)","provider":"go.mondoo.com/cnquery/v9/providers/azure"}},"title":"Azure Static Web App","desc":"Managed service that hosts static content (HTML/CSS/JS), serverless API routes, and globally distributed assets built from a source repository (typically GitHub or Azure DevOps). The SKU and tier (Free, Standard, Dedicated), default and custom hostnames, source repository URL and branch, publishing provider, public network access toggle, `allowConfigFileUpdates` flag, staging-environment policy (preview deployments per pull request), enterprise-grade CDN status, and Key Vault reference identity govern how the app is built, exposed, and authenticated. Counts for private endpoint connections, user-provided function apps, linked backends, and database connections summarize its integration surface.","private":true,"min_provider_version":"13.10.2","defaults":"name defaultHostname","provider":"go.mondoo.com/cnquery/v9/providers/azure"}}}