Get Azure alert details using KQL

Question

Hi All,

Can we get the alert details (alert name, Fired time, resolved time etc.) using KQL? If yes, what configuration is required and which table to query?

Answer 1

You can Azure Resource Graph service to query the alerts triggered within your subscription. Below sample query gets all Azure Monitor alerts that were fired in the last 12 hours and extracts commonly used properties for your reference. You can modify it based on your requirement.

alertsmanagementresources
| where properties.essentials.startDateTime > ago(12h)
| project
  alertId = id,
  name,
  monitorCondition = tostring(properties.essentials.monitorCondition),
  severity = tostring(properties.essentials.severity),
  monitorService = tostring(properties.essentials.monitorService),
  alertState = tostring(properties.essentials.alertState),
  targetResourceType = tostring(properties.essentials.targetResourceType),
  targetResource = tostring(properties.essentials.targetResource),
  subscriptionId,
  startDateTime = todatetime(properties.essentials.startDateTime),
  lastModifiedDateTime = todatetime(properties.essentials.lastModifiedDateTime),
  dimensions = properties.context.context.condition.allOf[0].dimensions, properties

Answer 2

Yes, it can be.

Different services store alert data in different tables. You need to determine which table holds the relevant data for the alerts you're interested in.

For example, you can use below for Security Events:

SecurityAlert

| project AlertName, AlertStartTime, AlertEndTime, ResolutionTime

| where TimeGenerated >= datetime(2023-07-01) and TimeGenerated <= datetime(2023-08-01)

Please confirm if it works for you.