Azure Alert Rule for Missing Security or Critical Update - Error
Hi all,
I'm creating Azure Alert Rule for "Missing Critical and Security Updates" for one of the subscriptions. I select the subscription in Hierarchy, I see a notice below that says: " Metric and Log signals might not be available if the scope includes multiple resources." I refine the scope to Virtual Machines and location.
In Condition, the following query is deployed automatically, however, getting error in results.
// To create an alert for this query, click '+ New alert rule'
Update
| where Classification in ("Security Updates", "Critical Updates")
| where UpdateState == 'Needed' and Optional == false and Approved == true
| summarize count() by Classification, Computer, _ResourceId
// This query requires the Security or Update solutions
RESULTS
'where' operator: Failed to resolve table or column expression named 'Update'
Request id: 8bd144fb-2cfe-478f-8887-3f0381ed74fb
In the "Create an alert rule" window, I see a note saying:
BadArgumentError- 'where' operator: Failed to resolve table or column expression named 'Update'
This query doesn't return an Azure resource ID column, so the alert will fire on the entire rule scope Learn more
I have created similar alerts for other subscriptions without any issue. Not sure what is wrong here.
Any help will be appreciated.