Addition of new orphans (#1)

Queries/orphan-resources-queries.md

@@ -9,7 +9,7 @@ Resources
 | where type has "microsoft.compute/disks"
 | extend diskState = tostring(properties.diskState)
 | where managedBy == ""
-| where not(name endswith "-ASRReplica" or name startswith "ms-asr-")
+| where not(name endswith "-ASRReplica" or name startswith "ms-asr-" or name startswith "asrseeddisk")
 | extend Details = pack_all()
 | project id, resourceGroup, diskState, sku.name, properties.diskSizeGB, location, tags, subscriptionId, Details
 ```
@@ -118,6 +118,15 @@ resources
 | project Resource=id, resourceGroup, location, subscriptionId, Sku=sku.name, tags, Details
 ```
 
+#### Application Gateway WAF Policy        
+```        
+resources
+| where type == "microsoft.network/applicationgatewaywebapplicationfirewallpolicies"
+| where properties.applicationGateways == ""
+| extend Details = pack_all()
+| project Resource=id, resourceGroup, location, subscriptionId,tags, Details
+```
+
 #### Traffic Manager Profiles
 ```
 resources
@@ -126,3 +135,101 @@ resources
 | extend Details = pack_all()
 | project Resource=id, resourceGroup, location, subscriptionId, tags, Details
 ```
+
+#### Snapshots
+```
+resources
+| where type == 'microsoft.compute/snapshots'
+| extend TimeCreated = properties.timeCreated
+| where TimeCreated < ago(30d)
+| extend Details = pack_all()
+| project Resource=id, resourceGroup, location, TimeCreated ,subscriptionId, tags, Details
+```
+
+#### VM
+```
+resources
+| where type == 'microsoft.compute/virtualmachines'
+| extend vmstatus = properties.extended.instanceView.powerState.displayStatus
+| where vmstatus != 'VM running'
+| summarize count(type)
+```
+
+#### Alerts
+```
+resources
+| where type contains 'microsoft.insights/scheduledqueryrules' or type contains 'microsoft.insights/activitylogalerts' or type contains 'microsoft.insights/metricalerts'
+| extend alertstatus = properties.enabled
+| where alertstatus == 'false'
+| summarize count(name)
+```
+
+#### LB
+```
+resources
+| where type == "microsoft.network/loadbalancers"
+| where properties.loadBalancingRules == "[]"
+| extend Details = pack_all()
+| project Resource=id, resourceGroup, location, subscriptionId, tags, Details
+```
+
+#### Certificate Expiration(Defined 30 days as an example)
+```
+resources
+| where type == 'microsoft.web/certificates'
+| extend expiry = todatetime(properties.expirationDate)
+| where expiry between (now().. ago(-30d))
+| project CertName=properties.subjectName, expiry
+```
+
+#### Virtual Networks without Subnet
+```
+resources
+| where type == "microsoft.network/virtualnetworks"
+| where properties.subnets == "[]"
+| extend Details = pack_all()
+| project Resource=id, resourceGroup, location, subscriptionId, tags, Details
+```
+
+#### Unassigned policies
+thanks to **[Wilfried Woivré](https://woivre.com/blog/2022/11/azure-policy-find-unused-policies)**
+````
+policyresources
+| where type == "microsoft.authorization/policydefinitions"
+| extend policyType = tostring(properties.policyType)
+| where policyType == "Custom"
+| join kind=leftouter (
+    policyresources
+    | where type == "microsoft.authorization/policysetdefinitions"
+    | extend policyType = tostring(properties.policyType)
+    | extend  policyDefinitions = properties.policyDefinitions
+    | where policyType == "Custom"
+    | mv-expand policyDefinitions
+    | extend policyDefinitionId = tostring(policyDefinitions.policyDefinitionId)
+    | project associedIdToInitiative=policyDefinitionId 
+    | distinct associedIdToInitiative) on $left.id == $right.associedIdToInitiative
+| where associedIdToInitiative == ""
+| join kind=leftouter(
+    policyresources
+    | where type == "microsoft.authorization/policyassignments"
+    | extend policyDefinitionId = tostring(properties.policyDefinitionId)
+    | project associatedDefinitionId=policyDefinitionId 
+    | distinct associatedDefinitionId
+) on $left.id == $right.associatedDefinitionId
+| where associatedDefinitionId == ""
+| extend displayName = tostring(properties.displayName)
+| extend Details = pack_all()
+| project Policy=id,name, displayName, Details
+````
+
+#### Subnets without NSG
+```
+resources
+| where type == "microsoft.network/virtualnetworks"
+| extend subnet = properties.subnets
+| mv-expand subnet
+| where subnet.name !in ("GatewaySubnet","AzureBastionSubnet","AzureFirewallSubnet","gatewaysubnet")
+| where subnet.properties.networkSecurityGroup == ""
+| extend Details = pack_all()
+| project Resource=id, resourceGroup,subnet.name , subnet.properties.addressPrefix,location, subscriptionId,tags, Details
+```

README.md

@@ -26,6 +26,13 @@ Type of resources covered:
 * App Service Plans
 * Front Door WAF Policy
 * Traffic Manager Profiles
+* Snapshots
+* VMs
+* Alerts
+* Load Balancers
+* Certificates
+* VNets vithout subnets
+* NSGs with no associations
 
 ## How to use it?
 Importing this Workbook to your Azure environment is quite simple.