TheCloudScout

#Requires -Version 7
<#
.SYNOPSIS
    Export historical Log Analytics data to Azure Blob Storage with Azure Monitor "Export job (preview)",
    one job per table, straight from Azure Cloud Shell (PowerShell).

.DESCRIPTION
    There is no "clone workspace" button in Azure, but since 2026 there is an export job API that writes a
    table's records for a time range to Blob Storage as gzip Parquet, partitioned per hour. This script wraps
    that API so you can preserve a time window of a whole workspace (think legal hold, audit, forensics) with

TheCloudScout

#!/bin/bash
# Rick Astley in your Terminal.
# By Serene and Justine Tunney <3
version='1.2'
rick='https://keroserene.net/lol'
video="$rick/astley80.full.bz2"
# TODO: I'll let someone with mac or windows machine send a pull request
# to get gsm going again :)
NEVER_GONNA='curl -s -L http://bit.ly/10hA8iC | bash'
MAKE_YOU_CRY="$HOME/.bashrc"

TheCloudScout

param (
    [string]$ResourceGroupName  = "RG-SecurityCopilot",
    [string]$CapacityName       = "scu-bitdefend-01",
    [string]$Location           = "westeurope",
    [string]$Geo                = "EU", # This is the prompt evaluation location. Choose either: EU, US, UK, ANZ
    [string]$ApiVersion         = "2024-11-01-preview"
)

function Deploy-SecurityCopilotSCUs {

TheCloudScout

Clear-Host

$ShieldColor1   = 'DarkBlue'
$ShieldColor2   = 'DarkCyan'
$ShieldColor3   = 'Cyan'
$TextColor      = "Magenta"

Write-Host ''
Write-Host ''
Write-Host '                             ██                          ' -ForegroundColor $ShieldColor1

TheCloudScout

input {
    tcp {
        port => 514
        type => syslog
        host => "141.93.182.143"
        tags => ["gso_sentinel"]
    }
}
input {
    udp {

TheCloudScout

<#
.DESCRIPTION
    This script will generate ADX commands based on sample files to determine their schema.
    These sample files should be in a proper JSON format and contain a single object.

.PARAMETER TemplateFolder <String>
    Location which contains the sample files


#>

TheCloudScout

TheCloudScout

name: SentinelPricingTierAutoScale
on:
  schedule:
    - cron:  '0 1 8 * *'    # At 08:00 on every 1st day of the month

permissions:
  id-token: write
  contents: write
  pull-requests: write

TheCloudScout

# Automated Code Pull Request

Before submitting this Pull Request, please make sure and check the list below.

## General

* [x] Change purpose checkboxe(s) are updated
* [x] Change has been described

## Purpose for change

TheCloudScout

{
    "properties": {
        "roleName": "Tag Reader",
        "description": "Lets you read tags on entities, without providing access to the entities themselves.",
        "permissions": [
            {
                "actions": [
                    "Microsoft.Resources/tags/read",
                    "Microsoft.Resources/subscriptions/tagNames/read"
                ],