Azure Alert Rule for Missing Security or Critical Update - Error

Question

Hi all,

I'm creating Azure Alert Rule for "Missing Critical and Security Updates" for one of the subscriptions. I select the subscription in Hierarchy, I see a notice below that says: " Metric and Log signals might not be available if the scope includes multiple resources." I refine the scope to Virtual Machines and location.

In Condition, the following query is deployed automatically, however, getting error in results.

// To create an alert for this query, click '+ New alert rule'

Update

| where Classification in ("Security Updates", "Critical Updates")

| where UpdateState == 'Needed' and Optional == false and Approved == true

| summarize count() by Classification, Computer, _ResourceId

// This query requires the Security or Update solutions

RESULTS

'where' operator: Failed to resolve table or column expression named 'Update'

Request id: 8bd144fb-2cfe-478f-8887-3f0381ed74fb

In the "Create an alert rule" window, I see a note saying:

BadArgumentError- 'where' operator: Failed to resolve table or column expression named 'Update'

This query doesn't return an Azure resource ID column, so the alert will fire on the entire rule scope Learn more

I have created similar alerts for other subscriptions without any issue. Not sure what is wrong here.

Any help will be appreciated.