We had created a alert rule in monitor, Can someone please guide how we can attach our alert rule with solution package? We have created an alert as shown in below image.

Hello, The above is an Azure Monitor Alert rule. Microsoft Sentinel has its own alert system these are called Sentinel Analytic Rules , are normally part of the Sentinel Solution package. Did you mean Sentinel Solution or something else? https://github.com/Azure/Azure-Sentinel/tree/c6dce9c3aa4d4b4d02423ac4eb5a6b677a39e432/Solutions#readme You can see Analytic Rules listed below in the instructions. There are options for Azure Monitor deployments here: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-manage-alert-rules

How to deploy a monitor | Alerts Rule with our solution package?

Accepted answer

Clive Watson 5,716 Reputation points MVP

2023-03-09T14:28:11.2133333+00:00

Hello,

The above is an Azure Monitor Alert rule.
Microsoft Sentinel has its own alert system these are called Sentinel Analytic Rules, are normally part of the Sentinel Solution package. Did you mean Sentinel Solution or something else? https://github.com/Azure/Azure-Sentinel/tree/c6dce9c3aa4d4b4d02423ac4eb5a6b677a39e432/Solutions#readme

You can see Analytic Rules listed below in the instructions.

There are options for Azure Monitor deployments here: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-manage-alert-rules
Please sign in to rate this answer.
JamesTran-MSFT 36,376 Reputation points Microsoft Employee

2023-03-10T21:26:23.46+00:00

@Bharvi Bhut

I just wanted to check in and see if you had any other questions or if you were able to resolve this issue? Thank you for your time and patience throughout this.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Bharvi Bhut 181 Reputation points

2023-03-13T06:14:55.9166667+00:00

@Clive Watson

Yes we are considering Sentinel Solution as you mentioned.

I have another questions regarding this as below:

Did you mean that we can add Azure Monitor Alert rule into Analytic Rules folder of https://github.com/Azure/Azure-Sentinel/tree/c6dce9c3aa4d4b4d02423ac4eb5a6b677a39e432/Solutions#step-1--create-your-content or not.

If we can not add Azure Monitor Alert rule into Analytic Rules folder of https://github.com/Azure/Azure-Sentinel/tree/c6dce9c3aa4d4b4d02423ac4eb5a6b677a39e432/Solutions#step-1--create-your-content Then can we add that Azure Monitor Alert Rule in any of the folders from https://github.com/Azure/Azure-Sentinel/tree/c6dce9c3aa4d4b4d02423ac4eb5a6b677a39e432 .

Clive Watson 5,716 Reputation points MVP

2023-03-13T09:30:55.7433333+00:00

Sentinel will only deploy Sentinel Rules. So for #1 that wont work as its NOT a Sentinel technology.

For #2 you dont add your files to the Microsoft repo, you can take a clone of the repo, and then you are free to add files into any folder you like. However an Alert Rule wont install, so you are just storing it in the repo and you have to install it to Azure Monitor.

I hope this helps, please "accept" the answer if it does.

Bharvi Bhut 181 Reputation points

2023-03-13T09:53:08.02+00:00

Hello @Clive Watson
I got that we have to clone the repository of Azure Sentinel and create a Pull Request after adding the files. But I have a question that in which folder we have to add the Azure Monitor Alert Rule.

Clive Watson 5,716 Reputation points MVP

2023-03-13T10:31:51.34+00:00

As they wont be deployed by Sentinel - I suggest that you create a new folder, maybe called: AzureMonitorRules?
Sign in to comment

How to deploy a monitor | Alerts Rule with our solution package?

0 additional answers