无法为容器信息查询添加Tags字段的技术问询

要在现有查询结果中添加容器注册表的Tags列，核心思路是关联resources表获取注册表资源的标签信息——因为securityresources表本身不包含资源标签，需要通过注册表的资源ID去匹配resources表中的对应记录。

以下是修改后的完整查询：

securityresources
 | where type == 'microsoft.security/assessments/subassessments'
 | where id matches regex  '(.+?)/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648/'
 | parse id with  registryResourceId '/providers/Microsoft.Security/assessments/' *
 | parse registryResourceId with  * "/providers/Microsoft.ContainerRegistry/registries/" registryName
 | extend imageDigest = tostring(properties.additionalData.imageDigest)
 | extend repository = tostring(properties.additionalData.repositoryName)
 | extend scanFindingSeverity = tostring(properties.status.severity), scanStatus = tostring(properties.status.code)
 | summarize scanFindingSeverityCount = count() by scanFindingSeverity, scanStatus, registryResourceId, registryName, repository, imageDigest
 | summarize severitySummary = make_bag(pack(scanFindingSeverity, scanFindingSeverityCount)) by registryResourceId, registryName, repository, imageDigest, scanStatus
 // 关联resources表获取标签
 | join kind=leftouter (
     resources
     | where type == 'microsoft.containerregistry/registries'
     | project registryResourceId = id, Tags = tags
 ) on registryResourceId
 | sort by scanStatus desc

关键逻辑说明： #

• 用join kind=leftouter关联resources表，确保即使没有标签的注册表记录也能保留原有查询结果
• 关联子查询中筛选容器注册表类型的资源，提取资源ID和对应的tags字段
• 关联完成后，Tags字段会被加入最终输出结果集

如果需要将标签从JSON对象展开为单独列（比如提取Environment或Owner这类特定标签），可以在关联后追加以下语句：

// 示例：展开指定标签为独立列
 | extend Environment = tostring(Tags.Environment), Owner = tostring(Tags.Owner)

内容的提问来源于stack exchange，提问作者Edwin Orina