Built-in query pack

114 queries ship embedded in the binary from queries/. List the live set (including your custom queries) with azdocs query list, print KQL with azdocs query show <name>, run one ad-hoc with azdocs query run <name>. Override or extend via queries.d/ — see usage/queries.md.

pie title Query pack by category
    "ai" : 2
    "analytics" : 3
    "arc" : 2
    "avd" : 5
    "compliance" : 3
    "compute" : 10
    "cost" : 10
    "databases" : 4
    "governance" : 8
    "identity" : 6
    "integration" : 1
    "inventory" : 5
    "monitoring" : 5
    "networking" : 14
    "operations" : 6
    "resilience" : 8
    "security" : 20
    "storage" : 2

Inventory queries

Security findings

Cost, policy, resilience and Defender evidence

The checks below are curated adaptations of Microsoft sources, reviewed on 2026-09-13. They use ARG only; collection stores the evidence in SQLite and every export remains offline. No billing connector, FinOps Hub deployment or remediation permission is required.

Sources and adaptations

• FinOps Resource Graph recommendation files: Advisor cost and the configuration-based waste checks. The unrelated src/queries catalog queries FinOps Hub cost datasets and is not imported.
• Azure Policy samples: evaluations, non-compliant findings and exemptions. We retain raw states rather than adopting sample logic that fills missing evaluations as compliant.
• APRL VM guidance, storage guidance, and PostgreSQL guidance: selected resilience observations. The VM backup join uses normalized full ARM IDs, not VM names, and requires an observed active AzureIaasVM protected item.
• Defender regulatory compliance samples: standard, control and assessment evidence, with skipped and unsupported states retained.

Every new query preserves id and ends with | order by id asc. Policy finding rows retain the policy evidence ID for paging and use resource_id_field to associate the finding with the actual resource. Exemption findings are scope observations, so they do not invent a resource-inventory association. Expiry findings include already-expired exemptions and those due in the next 90 days at collection time. Reports use the snapshot timestamp, never the export date.

Application gateway pools are expanded up to ARG’s 2,000-element maximum; Azure’s documented per-gateway pool limit is lower. Unlike the upstream inner join, the check also retains gateways with zero pools. Empty SQL pools use a case-normalized ARM ID join; a same-named database or pool elsewhere cannot satisfy it. Stopped VM checks exclude deallocated VMs, and empty App Service plan checks exclude the Free tier. Missing PostgreSQL settings are not treated as explicitly disabled settings.

Interpretation and collection coverage

The cost and compliance chapter is shared by PDF, DOCX, Markdown, HTML/site and XLSX exports. It summarises saved service evidence. Full stored records remain in SQLite and the relevant data exports; the print technical reference selects operational settings and summarises repeated findings. Desktop Inventory discovers the new categories from the query pack, and Findings displays the new finding checks.

• Advisor amounts are estimates, not billed costs. Currency and reported period remain separate; an absent period is unknown, not implicitly monthly. Annual savings are separate, and overlapping recommendations must not be summed as guaranteed savings. Missing amounts or counts make their aggregate unknown.
• Policy counts are evaluations per assignment and initiative, not unique resources or a tenant-wide compliance percentage. Exemptions and unknown, conflict, error and not-applicable states are not reclassified as passes.
• Defender counts describe the observed standards and assessments. Resource occurrences can repeat across controls and standards. Unsupported and skipped controls do not establish compliance or certification.
• No observed active Azure Backup item does not prove no backups exist. Check vault permissions, third-party protection, indexing freshness and restore evidence. Local storage redundancy, same-zone HA and disabled geo-backup may be deliberate workload choices; these are low-severity review observations.
• Empty, failed, uncollected and inconsistent datasets have distinct collection states. Reader access and ARG visibility constrain all datasets; service configuration or inaccessible scopes can produce no rows. A successful empty query never proves that the estate passed. ARG results truncated without a continuation token fail collection instead of silently losing evidence.

Use the existing category/query selection to limit collection when needed. User queries.d/ overrides still work; changed output columns must retain the semantics expected by summaries. Query changes are reviewed locally, not pulled from upstream during collection or reporting.

Rust-side audits (not KQL)

Run as post-passes during collect because they need configuration or cross-resource context a single query can’t see:

Relationship edges are likewise derived in Rust (collect/extractors.rs) rather than queried: the network/compute chain (subnets, peerings, NSG associations, NIC/VM/disk attachment, private endpoints, DNS links, load balancers, application gateways, Bastion, VMSS), platform ties (App Service → plan, SQL VM registration, AKS node pools), monitoring (data collection rules, solutions and App Insights → workspace, alert-rule scopes, Event Grid system topics), plus two generic passes — child resources → their ARM parent, and identity.userAssignedIdentities → the managed identity — see development/architecture.md.

Display metadata

Resource types render with friendly names (e.g. microsoft.desktopvirtualization/hostpools → “AVD Host Pool”) from data/display_names.toml, embedded in the binary (the built-in file; user overrides are separate — see below). Add or override names without recompiling by creating <config dir>/azdocs/display_names.toml with the same "<lowercase arm type>" = "Name" shape — entries merge over the built-ins, the same way queries.d/ overrides queries.

Programmatic locations and resource-specific kinds follow the same data-driven pattern in data/azure_locations.toml and data/azure_kinds.toml. Raw values remain in SQLite; only presentation uses the friendly names. The location file can be refreshed from Microsoft’s public region table with cargo run --example update_azure_locations. Kind mappings are scoped by ARM type because Azure defines them independently for each resource provider. See Azure display metadata for sources, fallbacks, and user override paths.

Operational and access evidence

The pack contains 78 inventory queries and 36 finding queries. The following queries cover operational and access evidence exposed by Microsoft collections. See operational evidence for retention, scope, freshness and source-provenance semantics.

recovery_vaults also retains observed immutability, soft-delete, MUA and network settings. Missing ARG fields remain unknown; the complete returned security settings object is retained for interpretation.