dt-obs-azure

What this skill does

# Azure Cloud Infrastructure

Monitor and analyze Azure resources using Dynatrace Smartscape and DQL. Query Azure services, audit security, manage organizational hierarchy, and plan capacity across your Azure infrastructure.

## When to Use This Skill

Use this skill when the user needs to work with Azure resources in Dynatrace. Load the reference file for the task type:

| Task | File to load |
|---|---|
| Inventory and topology queries | (no additional file — use core patterns below) |
| Query Azure metric timeseries (CPU, latency, throughput) | Load `references/metrics-performance.md` |
| VNet topology, subnets, NSGs, public IPs, VPN, peering | Load `references/vnet-networking-security.md` |
| Azure SQL, Cosmos DB, PostgreSQL, Redis investigation | Load `references/database-monitoring.md` |
| Functions, App Service, AKS infrastructure, Container Apps | Load `references/serverless-containers.md` |
| Azure LB, Application Gateway, Front Door, API Management | Load `references/load-balancing-api.md` |
| WAF rule analysis, false-positive investigation | Load `references/load-balancing-api.md` |
| Event Hubs, Service Bus, Event Grid | Load `references/messaging-integration.md` |
| Storage Accounts, Blob, File, Queue, Table | Load `references/storage-monitoring.md` |
| Unattached resources, tag compliance, lifecycle | Load `references/resource-management.md` |
| Cost savings, unused resources, SKU analysis | Load `references/cost-optimization.md` |
| Capacity headroom, VMSS scaling, quotas | Load `references/capacity-planning.md` |
| Security audit, encryption, public access, Key Vault | Load `references/security-compliance.md` |
| NSG rule analysis (0.0.0.0/0, open ports) | Load `references/security-compliance.md` |
| Storage account encryption/public access audit | Load `references/security-compliance.md` |
| Cost allocation, chargeback, ownership | Load `references/resource-ownership.md` |
| Determine orchestration context (AKS, VMSS, standalone) | Load `references/workload-detection.md` |

---

## Core Concepts

### Entity Types

Azure resources use the `AZURE_*` prefix and can be queried using the `smartscapeNodes` function. All Azure entities are automatically discovered and modeled in Dynatrace Smartscape. Entity type names are derived from the ARM resource provider path: `/Microsoft.Compute/virtualMachines` becomes `AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINES`. Sub-resources append with underscores: `/Microsoft.Sql/servers/databases` becomes `AZURE_MICROSOFT_SQL_SERVERS_DATABASES`.

**Compute:** `AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINES`, `AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS`, `AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS_VIRTUALMACHINES`, `AZURE_MICROSOFT_COMPUTE_DISKS`, `AZURE_MICROSOFT_COMPUTE_SSHPUBLICKEYS`, `AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINES_EXTENSIONS`
**Networking:** `AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS`, `AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS_SUBNETS`, `AZURE_MICROSOFT_NETWORK_NETWORKSECURITYGROUPS`, `AZURE_MICROSOFT_NETWORK_PUBLICIPADDRESSES`, `AZURE_MICROSOFT_NETWORK_NETWORKINTERFACES`, `AZURE_MICROSOFT_NETWORK_LOADBALANCERS`, `AZURE_MICROSOFT_NETWORK_APPLICATIONGATEWAYS`, `AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKGATEWAYS`, `AZURE_MICROSOFT_NETWORK_CONNECTIONS`, `AZURE_MICROSOFT_NETWORK_EXPRESSROUTECIRCUITS`
**Database:** `AZURE_MICROSOFT_SQL_SERVERS`, `AZURE_MICROSOFT_SQL_SERVERS_DATABASES`, `AZURE_MICROSOFT_CACHE_REDIS`, `AZURE_MICROSOFT_CACHE_REDISENTERPRISE`, `AZURE_MICROSOFT_DOCUMENTDB_DATABASEACCOUNTS`
**Storage:** `AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS`, `AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_BLOBSERVICES_CONTAINERS`, `AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_FILESERVICES_SHARES`, `AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_QUEUESERVICES_QUEUES`, `AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_TABLESERVICES_TABLES`
**Kubernetes/Containers:** `AZURE_MICROSOFT_CONTAINERSERVICE_MANAGEDCLUSTERS`, `AZURE_MICROSOFT_CONTAINERSERVICE_MANAGEDCLUSTERS_AGENTPOOLS`, `AZURE_MICROSOFT_CONTAINERREGISTRY_REGISTRIES`, `AZURE_MICROSOFT_APP_CONTAINERAPPS`, `AZURE_MICROSOFT_APP_MANAGEDENVIRONMENTS`, `AZURE_MICROSOFT_APP_JOBS`
**App Service:** `AZURE_MICROSOFT_WEB_SITES`, `AZURE_MICROSOFT_WEB_SERVERFARMS`, `AZURE_MICROSOFT_WEB_SITES_FUNCTIONS`
**Messaging:** `AZURE_MICROSOFT_EVENTHUB_NAMESPACES`, `AZURE_MICROSOFT_EVENTHUB_NAMESPACES_EVENTHUBS`, `AZURE_MICROSOFT_SERVICEBUS_NAMESPACES`, `AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_QUEUES`, `AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_TOPICS`, `AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_TOPICS_SUBSCRIPTIONS`
**Security/Identity:** `AZURE_MICROSOFT_KEYVAULT_VAULTS`, `AZURE_MICROSOFT_MANAGEDIDENTITY_USERASSIGNEDIDENTITIES`
**Monitoring:** `AZURE_MICROSOFT_OPERATIONALINSIGHTS_WORKSPACES`, `AZURE_MICROSOFT_INSIGHTS_COMPONENTS`
**API Management:** `AZURE_MICROSOFT_APIMANAGEMENT_SERVICE`

### Azure Organizational Hierarchy

Azure organizes resources in a three-level hierarchy: **Tenant > Subscription > Resource Group**. Every resource belongs to exactly one resource group within one subscription. Use these fields to scope queries:

```dql-snippet
filter azure.subscription == "08b9810e-..."
```

```dql-snippet
filter azure.resource.group == "my-rg"
```

```dql-snippet
filter azure.location == "eastus"
```

Combine these filters for precise scoping:

```dql-template
smartscapeNodes "AZURE_*"
| filter azure.subscription == "<SUBSCRIPTION_ID>"
    and azure.resource.group == "<RESOURCE_GROUP>"
    and azure.location == "<REGION>"
| summarize count = count(), by: {type}
| sort count desc
```

To see the organizational breakdown across your environment:

```dql
smartscapeNodes "AZURE_*"
| summarize resource_count = count(), by: {azure.subscription, azure.resource.group}
| sort resource_count desc
```

### Common Azure Fields

All Azure entities include:
- `azure.subscription` — Azure subscription GUID
- `azure.resource.group` — Resource group name
- `azure.location` — Azure region (e.g., `eastus`, `polandcentral`)
- `azure.resourceType` — ARM resource type (e.g., `microsoft.compute/virtualmachines`)
- `azure.provisioning_state` — Provisioning state (e.g., `Succeeded`)
- `azure.object` — Full ARM resource JSON (see [Configuration Parsing](#configuration-parsing-with-azureobject))
- `cloud.provider` — Always `azure`
- `tags` — Resource tags (use `` tags[`key`] ``)

Some entity types also have:
- `azure.resourceId` — Full ARM resource ID (VMs and some others)
- `azure.resourceName` — Resource name (VMs and some others)
- `azure.availabilityZones` — Availability zone list (VMs)

### Relationship Types

Azure entity relationships can be traversed using `traverse`. The `dt.traverse.relationship` field is **not populated** for Azure entities, so you must use `"*"` as the relationship name in all traversal commands.

Key traversal pairs:
- **VM → Disks:** `traverse "*", "AZURE_MICROSOFT_COMPUTE_DISKS"`
- **VM → NICs:** `traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKINTERFACES"`
- **VM → VMSS:** `traverse "*", "AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS"`
- **VM → Availability Zones:** `traverse "*", "AZURE_MICROSOFT_RESOURCES_LOCATIONS_AVAILABILITYZONES"`
- **VM ← Extensions:** `traverse "*", "AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINES_EXTENSIONS", direction:backward`
- **VMSS → AKS Clusters:** `traverse "*", "AZURE_MICROSOFT_CONTAINERSERVICE_MANAGEDCLUSTERS"`
- **VMSS → Subnets:** `traverse "*", "AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS_SUBNETS"`
- **VMSS → NSGs:** `traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKSECURITYGROUPS"`
- **VMSS → LB Backend Pools:** `traverse "*", "AZURE_MICROSOFT_NETWORK_LOADBALANCERS_BACKENDADDRESSPOOLS"`
- **Subnet → VNet:** `traverse "*", "AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS"`
- **Subnet → NSG:** `traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKSECURITYGROUPS"`
- **Subnet ← VMSS:** `traverse "*", "AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS", direction:backward`
- **NSG ← NICs:** `traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKINTERFACES", direction:backward`
- **NSG ← Subnets:** `trave