PixelRobots

## Azure_SP_creat .ps1
$sp = New-AzADServicePrincipal -DisplayName RabbitMQScale
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($sp.Secret)
$UnsecureSecret = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)
$AppID = (Get-AzADServicePrincipal -DisplayName RabbitMQScale).ApplicationID

New-AzRoleAssignment -ApplicationId $AppID -RoleDefinitionName "Contributor"

Write-host "Client ID =" $AppID
Write-host "Client Secret =" $UnsecureSecret
Write-host " Tenant =" (Get-AzContext).Tenant.Id

## RabbitMQScale.JSON
{
    "properties": {
        "arguments": {
            "properties": {
                "x-dead-letter-exchange": {
                    "type": [
                        "string",
                        "object",
                        "number",
                        "integer",

## Table of Servers with disk space is under nnGB.kusto
// Table of Servers with disk space is under nnGB
let setGBValue = 20;
// enter a GB value to check
let startDate = ago(30m);
// enter how many minutes to look back on
Perf
| where InstanceName != "D:" and InstanceName contains ":"
| where TimeGenerated > startDate
| where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes"
| extend FreeSpaceGB = CounterValue/1024

## Chart disk if its under nnGB over the past nn days.kusto
// Chart disk if its under nnGB over the past nn days
let setGBValue = 20;
// enter a GB value to check
let startDate = ago(2d);
// enter how many days to look back on
Perf
| where InstanceName != "D:" and InstanceName contains ":"
| where TimeGenerated > startDate
| where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes"
| extend FreeSpaceGB = CounterValue/1024

## CloudShell Wwindows Terminal
        {
        "acrylicOpacity" : 0.6,
            "closeOnExit" : false,
            "colorScheme" : "Vintage",
            "commandline" : "Azure",
            "connectionType" : "{d9fcfdfa-a479-412c-83b7-c5640e61cd62}",
            "cursorColor" : "#FFFFFF",
            "cursorShape" : "bar",
            "fontFace" : "Consolas",
            "fontSize" : 10,

## audit if a process is or has been running on a VM.kql
Perf
| where ObjectName == "Process" and CounterName == "% Processor Time"
| where InstanceName contains "dropbox"
| summarize Running_Instances = dcount(InstanceName) by Computer

let StartDate = datetime("2019-06-30 22:46:42");
let EndDate = datetime("2019-07-01 00:57:27");
Perf
| where TimeGenerated between(StartDate .. EndDate)
| where ObjectName == "Process" and CounterName == "% Processor Time"

## AD_Audit_log_analytics
SecurityEvent
| where EventID in (4625, 4624) and AccountType == 'User'
| summarize Attempts = count(), Failed = countif(EventID == 4625), Succeeded = countif(EventID == 4654) by Account

SecurityEvent
| where EventID == 4625
| extend Reason = case(
SubStatus == '0xc0000064', 'User name does not exist',
SubStatus == '0xc000005e', 'No logon servers available to service the logon request',
SubStatus == '0xc0000062', 'Account name is not properly formatted',

## ava_mem_log_analytics
// Chart memory if its under nnMB over the past nn days/hours
let setMBValue = 1024;
// enter a MB value to check
let startDate = ago(5h);
// enter how many days/hours to look back on
Perf
| where TimeGenerated > startDate
| where ObjectName == "Memory" and CounterName == "Available Mbytes" and Computer in ((Heartbeat
| where OSType == "Windows"
| distinct Computer))

## encryptvmss.ps1
$KVRGname = 'PixelRobots-KV-UKS';
$VMSSRGname = 'PixelRobots-VMSS-UKS';
$VmssName = 'pixelrobotsvmss';
$KeyVaultName = 'PixelRobots-VMSS-KV-UKS';
## Do not edit below this line.
$KeyVault = Get-AzKeyVault -VaultName $KeyVaultName -ResourceGroupName $KVRGname;
$DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri;
$KeyVaultResourceId = $KeyVault.ResourceId;
Set-AzVmssDiskEncryptionExtension -ResourceGroupName $VMSSRGname -VMScaleSetName $VmssName -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId;

## AzureSubscriptionRBACAudit.ps1
#requires -Version 3.0 -Modules Az.Resources
param(
    [switch]
    $email
)

$ErrorActionPreference = 'Stop'


## Email Style