How to set up an alert when a subnet is created in Azure?

Question

I am looking to set up an alert in my Azure Subscription when a new subnet is created in a Virtual Network in Azure

Answer 1

Hi,

Subnet is not a resource type. It is a sub-resource of Virtual Network. Subnet update operation is a VNET PUT operation.

if you enable an alert for any PUT on VNET, then you might get alert not only for the subnet update, but also for the VNET updates like DNS, VNET peering, etc.

If you want only subnet operation, then you can select the custom log search and optimize the query.

Regards,

Karthik Srinivas

Answer 2

Azure portal > Monitor services > Alerts > + New alert > resource type: Subnet > signal type: Creation > Next > Configure alert condition > Next > Configure alert action > Create alert rule > DONE 🎉

Answer 3

I'll just add to that:
Enable logging of Azure Activity logs to Azure Monitor
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-platform-logs

NOW you can create alerts based on any changes shown in the Azure activity logs.

additional references:

https://medium.com/@pradeepgupta_9558/azure-nsg-change-alerts-using-azure-monitor-service-e37e4760d6ca

Answer 4

Hi @32373548 ,

In addition to David Broggy's response, below are the steps to set up an alert when a subnet is created in a Virtual Nework in Azure.

1. Go to Azure Monitor > Alerts > Create > Alert rule
2. Under Scope section, select your subscription
3. Under Condition section, click on 'See all signals' link and in the search by signal name pane, search with the action word "Microsoft.Network/virtualNetworks/subnets/write" because as per this document, "Microsoft.Network/virtualNetworks/subnets/write" is the action that gets generated while creating a virtual network subnet or updating an existing virtual network subnet. Select the activity log signal "
   Create or Update Virtual Network Subnet (Virtual Network Subnet)" and click 'Apply'.
4. Next under Actions section, select the action group.
5. Next under Details and Tags sections, update details as appropriate.
6. Next under Review + create section, click 'Create'.

Or if you have configured to send activity logs to Log Analytics Workspace then create custom log alert based alert rule with the kusto query something like shown below which will basically query the AzureActivity kusto table.