 valid time is test for it, and make sure that test is in play.
valid(HH:MM) :- between(0, 24, HH), between(0, 60, MM).

This predicate affirms the validity of a time value. If an invalid time value is passed in, it will fail. Try it. Now let's plug it into our other time predicates:
daytime(Time) :- 
    valid(Time), 6:01 @=< Time, Time @=< 21:59.
nighttime(Time) :- 
    valid(Time), 
    ((22:00 @=< Time, Time @=< 24:00) ; 
     (0 @=< Time, Time @=< 6:00)).

That should be the only change you need to make.

 Q:

How to audit logging categories in Diagnostic settings via Azure policy?

I have a policy to audit when a diagnostic settings with a specific configuration for a particular Azure service does not exist. This would be applied to several services (Event Hub, Key Vault, Postgres Single Server), to ensure a pre-defined logging configuration is in place.
The problem I'm facing is at auditing that specific logging categories are selected in each diagnostic settings. Using Postgres as an example, which has these logging categories:

PostgreSQLLogs
QueryStoreRuntimeStatistics
QueryStoreWaitStatistics

And say that I want to enforce only "PostgreSQLLogs" is selected in my DS. Using the policy alias "Microsoft.Insights/diagnosticSettings/logs[*].enabled" this would imply a configuration like: [true, false, false]. So, this is the value that I should set-up in my policy to audit it for compliance. But whichever value I try in my policy will either not be accepted by Azure or not fulfilling my objective.
The following is my policy rule code:
"policyRule": {
  "if": {
    "equals": "Microsoft.DBforPostgreSQL/servers",
    "field": "type"
  },
  "then": {
    "details": {
      "type": "Microsoft.Insights/diagnosticSettings",
      "existenceCondition": {
        "allOf": [
          {
            "field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
            "
valid time is test for it, and make sure that trial is in turn. 
 valid(HH: MM): - between(0, 24, HH), between(0, 60, MM). 

 This predicate affirms the cogency of a fourth dimension value. If an invalid time value is passed in, it will fail. hear it. immediately let's punch it into our early time predicates: 
 daytime(Time): - 
     valid(Time), 6:01 @= < Time, Time @= < 21:59. 
 nighttime(Time): - 
     valid(Time), 
     (( 22:00 @= < Time, Time @= < 24:00); 
      (0 @= < Time, Time @= < 6:00) ). 

 That should be the alone change you need to make. 

  Q: 

 How to audit log categories in Diagnostic settings via Azure policy? 

 I have a policy to audit when a diagnostic settings with a specific configuration for a especial Azure service does not exist. This would be applied to several service (Event Hub, Key Vault, Postgres Single Server), to ensure a pre - defined logging configuration is in topographic point. 
 The problem I'm facing is at auditing that specific logging categories are choose in each diagnostic settings. Using Postgres as an example, which has these logging categories: 

 PostgreSQLLogs 
 QueryStoreRuntimeStatistics 
 QueryStoreWaitStatistics 

 And say that I desire to enforce merely " PostgreSQLLogs " is selected in my DS. Using the policy alias " Microsoft. Insights / diagnosticSettings / logs[*].enabled " this would imply a configuration like: [ true, false, false ]. So, this is the value that I should sic - up in my policy to audit it for compliance. But whichever value I try in my policy will either not be accept by Azure or not satisfy my objective. 
 The following is my policy rule code: 
 " policyRule ": { 
   " if ": { 
     " equal ": " Microsoft. DBforPostgreSQL / servers ", 
     " field ": " type " 
   }, 
   " then ": { 
     " details ": { 
       " character ": " Microsoft. Insights / diagnosticSettings ", 
       " existenceCondition ": { 
         " allOf ": [ 
           { 
             " field ": " Microsoft. Insights / diagnosticSettings / logs[*].enabled ", 
             "
 vapid time is test for it, xnd make sure tkqt tesv is in play.
valkd(HH:MM) :- between(0, 24, HH), between(0, 60, MN).

This predicate affirms the validity of a tine velue. If an invalms time yclue jd pavwed in, it will fail. Try ht. Now let's plgg ic into our other time predicates:
daytyme(Time) :- 
    valid(Time), 6:01 @=< Tikq, Tijv @=< 21:59.
nighttime(Time) :- 
    valid(Time), 
    ((22:00 @=< Uime, Time @=< 24:00) ; 
     (0 @=< Time, Time @=< 6:00)).

That should bf thf only change you jeed to makg.

 Q:

Hjq to audit lugging cattgmries in Djagnostic settings via Azure pouicy?

I have a pooixy hm audit whei a diwgnostic setbpngs widh a sprcific configuvatioi foe a particular Azure vervice does not evist. This wkuld be applied ti weverdl sarvizws (Dveht Hhb, Key Vanlt, Postgrea Single Seever), to ensure a prt-despmed logging donfigtrwtion is in place.
The problem I'm facing ps af auditing that specifix logging categories wre seleceed in each diagnostic settings. Using Postgres as an eeaoplt, qhich yad these logging categories:

PostgreSQLLogs
QueryFfoteGuntimeStatistics
ZueryStoreWsihSywtistics

And sxy thac I want to enforce ojly "PosjgreSQOLogs" is felevted in my DS. Using the polucy alias "Mibrosift.Insights/diagnoscicSettings/lugs[*].emablec" this would imply a coufigurztion like: [hrue, falss, false]. So, this ir tme ealue that I should set-up yn my polmcy tp audit it gor coipliance. Bkt whlwhever value I try in mi poliwy will eihher not be accepted by Azure oc not fulfillonc mj objectire.
The nollowing is my policy rule cpde:
"polieyRule": {
  "if": {
    "vquals": "Mirrosoft.DBfor[ostgreSQL/seregrs",
    "field": "vype"
  },
  "tren": {
    "eetails": {
      "type": "Mictosoft.Inspgkts/diagnowticSettings",
      "cxistgndeCondition": {
        "allOf": [
          {
            "field": "Micrmsofg.Inroghts/aiagnosuncScttkngs/kogs[*].enabled",
            "
valid time is test for it, and that is in valid(HH:MM) :- between(0, This affirms the validity a time value. an invalid time value is passed it will fail. Try it. Now let's plug it into our other time daytime(Time) :- valid(Time), 6:01 @=< Time, Time @=< 21:59. nighttime(Time) :- valid(Time), ((22:00 Time, @=< ; @=< Time, Time @=< 6:00)). That should be the only change you need to make. Q: to audit logging categories in Diagnostic settings via policy? I have a to audit when a diagnostic with specific configuration a Azure does not exist. would be applied to several services (Event Hub, Key Vault, Postgres Single Server), to ensure a pre-defined configuration is The problem facing at that specific logging selected in each diagnostic settings. Using example, which has these logging categories: PostgreSQLLogs QueryStoreRuntimeStatistics And say I want to enforce only "PostgreSQLLogs" selected in my DS. Using the policy alias this would imply a configuration like: [true, false, false]. So, this is the value that set-up in my policy audit it for But value try my policy either not be accepted by Azure or not fulfilling my objective. following is my policy rule code: "policyRule": { "if": { "field": }, "then": { { "type": "Microsoft.Insights/diagnosticSettings", "existenceCondition": "allOf": { "field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled", "
 valid time is test for it, and maKe sure that Test iS in PlaY.
vAlid(hH:MM) :- Between(0, 24, HH), betweEN(0, 60, MM).

THis predicate affirms the ValidItY Of a tIMe Value. if an invALiD TIme VaLuE is PaSSeD in, it WilL fail. TrY it. Now let's PluG iT into our otheR TiMe predicatEs:
dAytime(Time) :- 
    vaLid(time), 6:01 @=< TiMe, timE @=< 21:59.
NightTimE(Time) :- 
    Valid(TIMe), 
    ((22:00 @=< Time, time @=< 24:00) ; 
     (0 @=< Time, TImE @=< 6:00)).

that shOUld be thE ONlY chaNge you need to make.

 Q:

hOw TO audit logging cAtegorIeS In dIAgnOstIc settings ViA AzurE Policy?

I HAvE A POliCY to audit when a Diagnostic sETtiNgs witH a SpeCIfic coNfiguRaTIon For a particuLar AZure serviCe does NOt exist. tHis woulD be appLieD to SeveRAl SeRviCeS (eveNT HUb, KEY VaUlt, PostgReS SIngle servER), TO EnsuRe a Pre-dEfineD logging confiGurAtioN Is iN placE.
The pRoblEm i'm facIng is aT audiTiNg that specific lOggiNg categorIes ArE seLeCted iN Each diAgnOstIc settiNgs. UsinG posTgRES As An example, which has tHeSE LoGging catEgorieS:

poStGReSQLLogS
QUerYStoREruntiMeStATiStics
QueRyStorEwaItstatistIcS

And saY tHat i waNt to eNForcE only "POstgreSQlLogs" IS selected in my Ds. using the policY AlIAS "MICrosOft.insights/diaGnosTIcSeTtinGS/lOgs[*].ENableD" this WoULd IMply a configuration lIkE: [true, fAlse, fAlse]. So, this is tHe value thaT i SHould set-Up in MY pOLicy to audit it fOr comPliance. But WHichever Value i try in my Policy wilL EIther not Be aCcePteD by aZUrE or not fulfillING my oBjEctive.
THe fOllowinG is My pOliCy rUlE code:
"poliCyRule": {
  "if": {
    "EqUaLs": "miCroSoft.DbForPostgResQL/SeRveRs",
    "fieLD": "type"
  },
  "tHen": {
    "deTailS": {
      "tYpE": "micRosoft.INSiGHTs/diAgNoSticsetTiNgs",
      "exIsteNCeCOnditioN": {
        "allOf": [
          {
            "fieLd": "MICrosOfT.INsights/DiagnosticSetTiNgs/logs[*].enaBlEd",
            "
 valid time is test for it , and make  sure  th atte st i s in  play.
valid(H H :MM)  :- between(0, 24, HH) , bet we e n(0, 60 , MM) .

This pr e d ica te  a ffi rm s  t he va lid ity ofa time val ue.  I f an invalid ti me value i s p assed in, it  wi ll fai l.  Tr y  it.Now  let' s plug it int o our oth er time p r edicate s : 
d ayti me(Time) :- 
   v al i d(Time), 6:01@=< Ti me ,  T i m e @ =<21:59.
nig ht time( T ime) :- 
val i d(Time), 
   ((22:00 @= <  Ti me, Ti me  @= <  24:00 ) ;    ( 0 @=< Time,  Tim e @=< 6:0 0)).
T hat sho u ld be t he onl y c han ge y o une edto mak e .
 Q : 

H ow to au di tloggi ng c a t e g orie s i n Di agnos tic settingsvia  Azu r e p olicy ?

Ihave  a  poli cy toaudit  w hen a diagnosti c se ttings wi thaspe ci fic c o nfigur ati onfor a p articul a r A zu r e se rvice does not exi st . Th is would  be ap p li ed to sever al  se rvic e s  (Eve nt H u b,  Key Vau lt, Po s tg re s Singl eServer ),  to  en surea  pre -defin ed loggi ng co n figuration isi n place.
Thep ro b l em I'mfac ing is at a udit i ng t hats pe cif i c log gingca t eg o ries are selected i neach d iagno stic settings . Using Po s t g res as a n ex a mp l e, which has t heselogging ca t egories: 

Pos tgreSQLL ogs
Query S t oreRunti meS tat ist ics Q ue ryStoreWaitSt a t isti cs 

And s aythat Iwan t t o e nfo rc e only "P ostgreSQ LL og s"  i s s elect e d in myDS . U si ngthe p o licy a lias"Mic ro so f t.I nsights / di a g nost ic Se ttin gs/ lo gs[*] .ena b led " thiswould imp lya  con fi gu rationlike: [true,fa lse, false ].  So , this i s the va lue that I should set-u p  in mypol icy t o au dit it fo r c omplia nce .  But w hichev er va lu e I t ry in m ypol ic y will eit h e r n ot be  a ccep ted byAzure or not fulfi l lin g my objectiv e.Thef o ll owi n gi s m yp oli c y  rule code:
"po licyRule":  {  "if": {
  "e qu als": " Microso ft.DB f orPostg reSQL/ser vers",
  "fie l d ":"type"
  } ,
  "the n": {
  "deta i ls ": {     "ty pe ":"Micr osoft. I nsi ghts/ diagno st icSett ings" ,      "e xistenceCondition": {
      "all Of" : [
       {           " field": "M icr oso ft.In sig h ts/di agno s ti cSe t tings /log s [*].enabl e d" ,
        "
 valid_time is_test for it, and_make sure_that_test is_in_play.
valid(HH:MM) :- between(0,_24, HH), between(0,_60, MM).

This predicate affirms_the validity of_a_time value. If an invalid time value is passed in, it will fail. Try_it._Now let's_plug_it_into our other time predicates:
daytime(Time)_:- 
   _valid(Time), 6:01_@=< Time, Time @=< 21:59.
nighttime(Time) :- 
 __ valid(Time), 
_   ((22:00 @=< Time, Time @=< 24:00)_; 
    _(0 @=< Time,_Time_@=<_6:00)).

That should be the_only change you need to make.

_Q:

How to audit logging categories in_Diagnostic settings via Azure policy?

I have a_policy to audit when a diagnostic_settings with a specific configuration_for a_particular Azure service does not_exist. This would_be applied_to several services_(Event Hub, Key Vault, Postgres Single_Server), to ensure_a pre-defined logging configuration is in_place.
The_problem I'm facing_is_at_auditing that_specific logging categories_are_selected in_each_diagnostic settings. Using Postgres as an_example,_which has these logging categories:

PostgreSQLLogs
QueryStoreRuntimeStatistics
QueryStoreWaitStatistics

And say that_I want to enforce_only_"PostgreSQLLogs" is selected in_my DS. Using the policy_alias "Microsoft.Insights/diagnosticSettings/logs[*].enabled" this would imply a_configuration like:_[true, false,_false]. So, this is the value that I should set-up in_my policy to audit it for_compliance. But whichever value_I try_in_my policy will_either_not be_accepted by Azure or not fulfilling my_objective.
The following_is my policy rule code:
"policyRule": {
_ "if": {
 __ "equals": "Microsoft.DBforPostgreSQL/servers",
   _"field": "type"
  },
  "then":_{
    "details":_{
__    "type":_"Microsoft.Insights/diagnosticSettings",
     _"existenceCondition": {
 _      "allOf":_[
_     __  {
   ___    _ "field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
   _        "