Common alert schema definitions for Test Action Group (preview)

This article describes the common alert schema definitions for Azure Monitor. It includes schema definitions for webhooks, Azure Logic Apps, Azure Functions, and Azure Automation runbooks.

Any alert instance describes the resource that was affected and the cause of the alert. These instances are described in the common schema in the following sections:

  • Essentials: A set of standardized fields common across all alert types that describes what resource the alert is on, along with more common alert metadata like severity or description.
  • Alert context: A set of fields that describes the cause of the alert, with fields that vary based on the alert type. For example, a metric alert includes fields like the metric name and metric value in the alert context. An activity log alert has information about the event that generated the alert.

Sample alert payload

{
  "schemaId": "azureMonitorCommonAlertSchema",
  "data": {
    "essentials": {
      "alertId": "/subscriptions/<subscription ID>/providers/Microsoft.AlertsManagement/alerts/b9569717-bc32-442f-add5-83a997729330",
      "alertRule": "WCUS-R2-Gen2",
      "severity": "Sev3",
      "signalType": "Metric",
      "monitorCondition": "Resolved",
      "monitoringService": "Platform",
      "alertTargetIDs": [
        "/subscriptions/<subscription ID>/resourcegroups/pipelinealertrg/providers/microsoft.compute/virtualmachines/wcus-r2-gen2"
      ],
      "configurationItems": [
        "wcus-r2-gen2"
      ],
      "originAlertId": "3f2d4487-b0fc-4125-8bd5-7ad17384221e_PipeLineAlertRG_microsoft.insights_metricAlerts_WCUS-R2-Gen2_-117781227",
      "firedDateTime": "2019-03-22T13:58:24.3713213Z",
      "resolvedDateTime": "2019-03-22T14:03:16.2246313Z",
      "description": "",
      "essentialsVersion": "1.0",
      "alertContextVersion": "1.0"
    },
    "alertContext": {
      "properties": null,
      "conditionType": "SingleResourceMultipleMetricCriteria",
      "condition": {
        "windowSize": "PT5M",
        "allOf": [
          {
            "metricName": "Percentage CPU",
            "metricNamespace": "Microsoft.Compute/virtualMachines",
            "operator": "GreaterThan",
            "threshold": "25",
            "timeAggregation": "Average",
            "dimensions": [
              {
                "name": "ResourceId",
                "value": "3efad9dc-3d50-4eac-9c87-8b3fd6f97e4e"
              }
            ],
            "metricValue": 7.727
          }
        ]
      }
    }
  }
}

Essentials

Field Description
alertId The unique resource ID that identifies the alert instance.
alertRule The name of the alert rule that generated the alert instance.
Severity The severity of the alert. Possible values: Sev0, Sev1, Sev2, Sev3, or Sev4.
signalType Identifies the signal on which the alert rule was defined. Possible values: Metric, Log, or Activity Log.
monitorCondition When an alert fires, the alert's monitor condition is set to Fired. When the underlying condition that caused the alert to fire clears, the monitor condition is set to Resolved.
monitoringService The monitoring service or solution that generated the alert. The fields for the alert context are dictated by the monitoring service.
alertTargetIds The list of the Azure Resource Manager IDs that are affected targets of an alert. For a log alert defined on a Log Analytics workspace or Application Insights instance, it's the respective workspace or application.
configurationItems The list of affected resources of an alert. The configuration items can be different from the alert targets in some cases, for example, in metric-for-log or log alerts defined on a Log Analytics workspace. The configuration items are the actual resources that send the telemetry and not the workspace. This field is used by IT service management systems to correlate alerts to resources in a configuration management database.
originAlertId The ID of the alert instance, as generated by the monitoring service generating it.
firedDateTime The date and time when the alert instance was fired in Coordinated Universal Time (UTC).
resolvedDateTime The date and time when the monitor condition for the alert instance is set to Resolved in UTC. Currently, only applicable for metric alerts.
description The description, as defined in the alert rule.
essentialsVersion The version number for the essentials section.
alertContextVersion The version number for the alertContext section.

Sample values

{
  "essentials": {
    "alertId": "/subscriptions/<subscription ID>/providers/Microsoft.AlertsManagement/alerts/b9569717-bc32-442f-add5-83a997729330",
    "alertRule": "Contoso IT Metric Alert",
    "severity": "Sev3",
    "signalType": "Metric",
    "monitorCondition": "Fired",
    "monitoringService": "Platform",
    "alertTargetIDs": [
      "/subscriptions/<subscription ID>/resourceGroups/aimon-rg/providers/Microsoft.Insights/components/ai-orion-int-fe"
    ],
    "originAlertId": "74ff8faa0c79db6084969cf7c72b0710e51aec70b4f332c719ab5307227a984f",
    "firedDateTime": "2019-03-26T05:25:50.4994863Z",
    "description": "Test Metric alert",
    "essentialsVersion": "1.0",
    "alertContextVersion": "1.0"
  }
}

Alert context

Metric alerts - Static threshold

monitoringService = Platform

Sample values

{
   "schemaId":"azureMonitorCommonAlertSchema",
   "data":{
      "essentials":{
         "alertId":"/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.AlertsManagement/alerts/12345678-1234-1234-1234-1234567890ab",
         "alertRule":"test-metricAlertRule",
         "severity":"Sev3",
         "signalType":"Metric",
         "monitorCondition":"Fired",
         "monitoringService":"Platform",
         "alertTargetIDs":[
            "/subscriptions/11111111-1111-1111-1111-111111111111/resourcegroups/test-RG/providers/Microsoft.Storage/storageAccounts/test-storageAccount"
         ],
         "configurationItems":[
            "test-storageAccount"
         ],
         "originAlertId":"11111111-1111-1111-1111-111111111111_test-RG_microsoft.insights_metricAlerts_test-metricAlertRule_1234567890",
         "firedDateTime":"2021-11-15T09:35:24.3468506Z",
         "description":"Alert rule description",
         "essentialsVersion":"1.0",
         "alertContextVersion":"1.0"
      },
      "alertContext":{
         "properties":{
            "customKey1":"value1",
            "customKey2":"value2"
         },
         "conditionType":"DynamicThresholdCriteria",
         "condition":{
            "windowSize":"PT15M",
            "allOf":[
               {
                  "alertSensitivity":"Low",
                  "failingPeriods":{
                     "numberOfEvaluationPeriods":3,
                     "minFailingPeriodsToAlert":3
                  },
                  "ignoreDataBefore":null,
                  "metricName":"Transactions",
                  "metricNamespace":"Microsoft.Storage/storageAccounts",
                  "operator":"GreaterThan",
                  "threshold":"0.3",
                  "timeAggregation":"Average",
                  "dimensions":[
                     
                  ],
                  "metricValue":78.09,
                  "webTestName":null
               }
            ],
            "windowStartTime":"2021-12-15T01:04:11.719Z",
            "windowEndTime":"2021-12-15T01:19:11.719Z"
         }
      },
      "customProperties":{
         "customKey1":"value1",
         "customKey2":"value2"
      }
   }
}

Metric alerts - Dynamic threshold

monitoringService = Platform

Sample values

{
   "schemaId":"azureMonitorCommonAlertSchema",
   "data":{
      "essentials":{
         "alertId":"/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.AlertsManagement/alerts/12345678-1234-1234-1234-1234567890ab",
         "alertRule":"test-metricAlertRule",
         "severity":"Sev3",
         "signalType":"Metric",
         "monitorCondition":"Fired",
         "monitoringService":"Platform",
         "alertTargetIDs":[
            "/subscriptions/11111111-1111-1111-1111-111111111111/resourcegroups/test-RG/providers/Microsoft.Storage/storageAccounts/test-storageAccount"
         ],
         "configurationItems":[
            "test-storageAccount"
         ],
         "originAlertId":"11111111-1111-1111-1111-111111111111_test-RG_microsoft.insights_metricAlerts_test-metricAlertRule_1234567890",
         "firedDateTime":"2021-11-15T09:35:24.3468506Z",
         "description":"Alert rule description",
         "essentialsVersion":"1.0",
         "alertContextVersion":"1.0"
      },
      "alertContext":{
         "properties":{
            "customKey1":"value1",
            "customKey2":"value2"
         },
         "conditionType":"DynamicThresholdCriteria",
         "condition":{
            "windowSize":"PT15M",
            "allOf":[
               {
                  "alertSensitivity":"Low",
                  "failingPeriods":{
                     "numberOfEvaluationPeriods":3,
                     "minFailingPeriodsToAlert":3
                  },
                  "ignoreDataBefore":null,
                  "metricName":"Transactions",
                  "metricNamespace":"Microsoft.Storage/storageAccounts",
                  "operator":"GreaterThan",
                  "threshold":"0.3",
                  "timeAggregation":"Average",
                  "dimensions":[
                     
                  ],
                  "metricValue":78.09,
                  "webTestName":null
               }
            ],
            "windowStartTime":"2021-12-15T01:04:11.719Z",
            "windowEndTime":"2021-12-15T01:19:11.719Z"
         }
      },
      "customProperties":{
         "customKey1":"value1",
         "customKey2":"value2"
      }
   }
}

Log alerts

Note

For log alerts that have a custom email subject and/or JSON payload defined, enabling the common schema reverts email subject and/or payload schema to the one described as follows. This means that if you want to have a custom JSON payload defined, the webhook can't use the common alert schema.

Alerts with the common schema enabled have an upper size limit of 256 KB per alert. Search results aren't embedded in the log alerts payload if they cause the alert size to cross this threshold. To determine size, check the flag IncludedSearchResults. When the search results aren't included, use LinkToFilteredSearchResultsAPI or LinkToSearchResultsAPI to access query results with the Log Analytics API.

monitoringService = Log Alerts V1 – Metric

Sample values

{
   "schemaId":"azureMonitorCommonAlertSchema",
   "data":{
      "essentials":{
         "alertId":"/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.AlertsManagement/alerts/12345678-1234-1234-1234-1234567890ab",
         "alertRule":"test-logAlertRule-v1-metricMeasurement",
         "severity":"Sev3",
         "signalType":"Log",
         "monitorCondition":"Fired",
         "monitoringService":"Log Analytics",
         "alertTargetIDs":[
            "/subscriptions/11111111-1111-1111-1111-111111111111/resourcegroups/test-RG/providers/microsoft.operationalinsights/workspaces/test-logAnalyticsWorkspace"
         ],
         "configurationItems":[
            
         ],
         "originAlertId":"12345678-4444-4444-4444-1234567890ab",
         "firedDateTime":"2021-11-16T15:17:21.9232467Z",
         "description":"Alert rule description",
         "essentialsVersion":"1.0",
         "alertContextVersion":"1.1"
      },
      "alertContext":{
         "SearchQuery":"Heartbeat | summarize AggregatedValue=count() by bin(TimeGenerated, 5m)",
         "SearchIntervalStartTimeUtc":"2021-11-15T15:16:49Z",
         "SearchIntervalEndtimeUtc":"2021-11-16T15:16:49Z",
         "ResultCount":2,
         "LinkToSearchResults":"https://portal.azure.com#@aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa/blade/Microsoft_Azure_Monitoring_Logs/LogsBlade/source/Alerts.EmailLinks/scope/%7B%22resources%22%3A%5B%7B%22resourceId%22%3A%22%2Fsubscriptions%2F11111111-1111-1111-1111-111111111111%2FresourceGroups%2Ftest-RG%2Fproviders%2FMicrosoft.OperationalInsights%2Fworkspaces%2Ftest-logAnalyticsWorkspace%22%7D%5D%7D/q/aBcDeFgHi%2BWqUSguzc1NLMqsSlVwTE8vSk1PLElNCUvMKU21Tc4vzSvRaBcDeFgHiaBcDeFgHiaBcDeFgHiaBcDeFgHi/prettify/1/timespan/2021-11-15T15%3a16%3a49.0000000Z%2f2021-11-16T15%3a16%3a49.0000000Z",
         "LinkToFilteredSearchResultsUI":"https://portal.azure.com#@aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa/blade/Microsoft_Azure_Monitoring_Logs/LogsBlade/source/Alerts.EmailLinks/scope/%7B%22resources%22%3A%5B%7B%22resourceId%22%3A%22%2Fsubscriptions%2F11111111-1111-1111-1111-111111111111%2FresourceGroups%2Ftest-RG%2Fproviders%2FMicrosoft.OperationalInsights%2Fworkspaces%2Ftest-logAnalyticsWorkspace%22%7D%5D%7D/q/aBcDeFgHiaBcDeFgHiaBcDeFgHiaBcDeFgHiaBcDeFgHidp%2BOPOhDKsHR%2FFeJXsTgzGJRmVui3KF3RpLyEJCX9A2iMl6jgxMn6jRevng3JmIHLdYtKP4DRI9mhc%3D/prettify/1/timespan/2021-11-15T15%3a16%3a49.0000000Z%2f2021-11-16T15%3a16%3a49.0000000Z",
         "LinkToSearchResultsAPI":"https://api.loganalytics.io/v1/workspaces/bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb/query?query=Heartbeat%20%0A%7C%20summarize%20AggregatedValue%3Dcount%28%29%20by%20bin%28TimeGenerated%2C%205m%29&timespan=2021-11-15T15%3a16%3a49.0000000Z%2f2021-11-16T15%3a16%3a49.0000000Z",
         "LinkToFilteredSearchResultsAPI":"https://api.loganalytics.io/v1/workspaces/bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb/query?query=Heartbeat%20%0A%7C%20summarize%20AggregatedValue%3Dcount%28%29%20by%20bin%28TimeGenerated%2C%205m%29%7C%20where%20todouble%28AggregatedValue%29%20%3E%200&timespan=2021-11-15T15%3a16%3a49.0000000Z%2f2021-11-16T15%3a16%3a49.0000000Z",
         "SeverityDescription":"Informational",
         "WorkspaceId":"bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
         "SearchIntervalDurationMin":"1440",
         "AffectedConfigurationItems":[
            
         ],
         "AlertType":"Metric measurement",
         "IncludeSearchResults":true,
         "Dimensions":[
            
         ],
         "SearchIntervalInMinutes":"1440",
         "SearchResults":{
            "tables":[
               {
                  "name":"PrimaryResult",
                  "columns":[
                     {
                        "name":"TimeGenerated",
                        "type":"datetime"
                     },
                     {
                        "name":"AggregatedValue",
                        "type":"long"
                     }
                  ],
                  "rows":[
                     [
                        "2021-11-16T10:56:49Z",
                        11
                     ],
                     [
                        "2021-11-16T11:56:49Z",
                        11
                     ]
                  ]
               }
            ],
            "dataSources":[
               {
                  "resourceId":"/subscriptions/11111111-1111-1111-1111-111111111111/resourcegroups/test-RG/providers/microsoft.operationalinsights/workspaces/test-logAnalyticsWorkspace",
                  "region":"eastus",
                  "tables":[
                     "Heartbeat"
                  ]
               }
            ]
         },
         "Threshold":0,
         "Operator":"Greater Than",
         "IncludedSearchResults":"True"
      }
   }
}

monitoringService = Log Alerts V1 - Numresults

Sample values

{
   "schemaId":"azureMonitorCommonAlertSchema",
   "data":{
      "essentials":{
         "alertId":"/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.AlertsManagement/alerts/12345678-1234-1234-1234-1234567890ab",
         "alertRule":"test-logAlertRule-v1-numResults",
         "severity":"Sev3",
         "signalType":"Log",
         "monitorCondition":"Fired",
         "monitoringService":"Log Analytics",
         "alertTargetIDs":[
            "/subscriptions/11111111-1111-1111-1111-111111111111/resourcegroups/test-RG/providers/microsoft.operationalinsights/workspaces/test-logAnalyticsWorkspace"
         ],
         "configurationItems":[
            "test-computer"
         ],
         "originAlertId":"22222222-2222-2222-2222-222222222222",
         "firedDateTime":"2021-11-16T15:15:58.3302205Z",
         "description":"Alert rule description",
         "essentialsVersion":"1.0",
         "alertContextVersion":"1.1"
      },
      "alertContext":{
         "SearchQuery":"Heartbeat",
         "SearchIntervalStartTimeUtc":"2021-11-15T15:15:24Z",
         "SearchIntervalEndtimeUtc":"2021-11-16T15:15:24Z",
         "ResultCount":1,
         "LinkToSearchResults":"https://portal.azure.com#@aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa/blade/Microsoft_Azure_Monitoring_Logs/LogsBlade/source/Alerts.EmailLinks/scope/%7B%22resources%22%3A%5B%7B%22resourceId%22%3A%22%2Fsubscriptions%2F11111111-1111-1111-1111-111111111111%2FresourceGroups%2Ftest-RG%2Fproviders%2FMicrosoft.OperationalInsights%2Fworkspaces%2Ftest-logAnalyticsWorkspace%22%7D%5D%7D/q/aBcDeFgHi%2ABCDE%3D%3D/prettify/1/timespan/2021-11-15T15%3a15%3a24.0000000Z%2f2021-11-16T15%3a15%3a24.0000000Z",
         "LinkToFilteredSearchResultsUI":"https://portal.azure.com#@aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa/blade/Microsoft_Azure_Monitoring_Logs/LogsBlade/source/Alerts.EmailLinks/scope/%7B%22resources%22%3A%5B%7B%22resourceId%22%3A%22%2Fsubscriptions%2F11111111-1111-1111-1111-111111111111%2FresourceGroups%2Ftest-RG%2Fproviders%2FMicrosoft.OperationalInsights%2Fworkspaces%2Ftest-logAnalyticsWorkspace%22%7D%5D%7D/q/aBcDeFgHi%2ABCDE%3D%3D/prettify/1/timespan/2021-11-15T15%3a15%3a24.0000000Z%2f2021-11-16T15%3a15%3a24.0000000Z",
         "LinkToSearchResultsAPI":"https://api.loganalytics.io/v1/workspaces/bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb/query?query=Heartbeat%0A&timespan=2021-11-15T15%3a15%3a24.0000000Z%2f2021-11-16T15%3a15%3a24.0000000Z",
         "LinkToFilteredSearchResultsAPI":"https://api.loganalytics.io/v1/workspaces/bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb/query?query=Heartbeat%0A&timespan=2021-11-15T15%3a15%3a24.0000000Z%2f2021-11-16T15%3a15%3a24.0000000Z",
         "SeverityDescription":"Informational",
         "WorkspaceId":"bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
         "SearchIntervalDurationMin":"1440",
         "AffectedConfigurationItems":[
            "test-computer"
         ],
         "AlertType":"Number of results",
         "IncludeSearchResults":true,
         "SearchIntervalInMinutes":"1440",
         "SearchResults":{
            "tables":[
               {
                  "name":"PrimaryResult",
                  "columns":[
                     {
                        "name":"TenantId",
                        "type":"string"
                     },
                     {
                        "name":"Computer",
                        "type":"string"
                     },
                     {
                        "name":"TimeGenerated",
                        "type":"datetime"
                     }
                  ],
                  "rows":[
                     [
                        "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
                        "test-computer",
                        "2021-11-16T12:00:00Z"
                     ]
                  ]
               }
            ],
            "dataSources":[
               {
                  "resourceId":"/subscriptions/11111111-1111-1111-1111-111111111111/resourcegroups/test-RG/providers/microsoft.operationalinsights/workspaces/test-logAnalyticsWorkspace",
                  "region":"eastus",
                  "tables":[
                     "Heartbeat"
                  ]
               }
            ]
         },
         "Threshold":0,
         "Operator":"Greater Than",
         "IncludedSearchResults":"True"
      }
   }
}

monitoringService = Log Alerts V2

Note

Log alerts rules from API version 2020-05-01 use this payload type, which only supports common schema. Search results aren't embedded in the log alerts payload when you use this version. Use dimensions to provide context to fired alerts.

You can also use LinkToFilteredSearchResultsAPI or LinkToSearchResultsAPI to access query results with the Log Analytics API. If you must embed the results, use a logic app with the provided links to generate a custom payload.

Sample values

{
   "schemaId":"azureMonitorCommonAlertSchema",
   "data":{
      "essentials":{
         "alertId":"/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.AlertsManagement/alerts/12345678-1234-1234-1234-1234567890ab",
         "alertRule":"test-logAlertRule-v2",
         "severity":"Sev3",
         "signalType":"Log",
         "monitorCondition":"Fired",
         "monitoringService":"Log Alerts V2",
         "alertTargetIDs":[
            "/subscriptions/11111111-1111-1111-1111-111111111111/resourcegroups/test-RG/providers/microsoft.operationalinsights/workspaces/test-logAnalyticsWorkspace"
         ],
         "configurationItems":[
            "test-computer"
         ],
         "originAlertId":"22222222-2222-2222-2222-222222222222",
         "firedDateTime":"2021-11-16T11:47:41.4728231Z",
         "description":"Alert rule description",
         "essentialsVersion":"1.0",
         "alertContextVersion":"1.0"
      },
      "alertContext":{
         "properties":{
            "customKey1":"value1",
            "customKey2":"value2"
         },
         "conditionType":"LogQueryCriteria",
         "condition":{
            "windowSize":"PT1H",
            "allOf":[
               {
                  "searchQuery":"Heartbeat",
                  "metricMeasureColumn":null,
                  "targetResourceTypes":"['Microsoft.OperationalInsights/workspaces']",
                  "operator":"GreaterThan",
                  "threshold":"0",
                  "timeAggregation":"Count",
                  "dimensions":[
                     {
                        "name":"Computer",
                        "value":"test-computer"
                     }
                  ],
                  "metricValue":3.0,
                  "failingPeriods":{
                     "numberOfEvaluationPeriods":1,
                     "minFailingPeriodsToAlert":1
                  },
                  "linkToSearchResultsUI":"https://portal.azure.com#@aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa/blade/Microsoft_Azure_Monitoring_Logs/LogsBlade/source/Alerts.EmailLinks/scope/%7B%22resources%22%3A%5B%7B%22resourceId%22%3A%22%2Fsubscriptions%2F11111111-1111-1111-1111-111111111111%2FresourceGroups%2Ftest-RG%2Fproviders%2FMicrosoft.OperationalInsights%2Fworkspaces%2Ftest-logAnalyticsWorkspace%22%7D%5D%7D/q/aBcDeFgHiJkLmNaBcDeFgHiJkLmNaBcDeFgHiJkLmNaBcDeFgHiJkLmN1234567890ZAZBZiaGBlaG5lbKlnAAFRmnp6WNUZoqvTBAA%3D/prettify/1/timespan/2021-11-16T10%3a17%3a39.0000000Z%2f2021-11-16T11%3a17%3a39.0000000Z",
                  "linkToFilteredSearchResultsUI":"https://portal.azure.com#@aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa/blade/Microsoft_Azure_Monitoring_Logs/LogsBlade/source/Alerts.EmailLinks/scope/%7B%22resources%22%3A%5B%7B%22resourceId%22%3A%22%2Fsubscriptions%2F11111111-1111-1111-1111-111111111111%2FresourceGroups%2Ftest-RG%2Fproviders%2FMicrosoft.OperationalInsights%2Fworkspaces%2Ftest-logAnalyticsWorkspace%22%7D%5D%7D/q/aBcDeFgHiJkLmN%2Fl35oOTZoKioEOouaBcDeFgHiJkLmN%2BaBcDeFgHiJkLmN%2BaBcDeFgHiJkLmN7HHgOCZTR0Ak%2FaBcDeFgHiJkLmN1234567890Ltcw%2FOqZS%2FuX0L5d%2Bx3iMHNzQiu3Y%2BzsjpFSWlOzgA87vAxeHW2MoAtQxe6OUvVrZR3XYZPXrd%2FIE/prettify/1/timespan/2021-11-16T10%3a17%3a39.0000000Z%2f2021-11-16T11%3a17%3a39.0000000Z",
                  "linkToSearchResultsAPI":"https://api.loganalytics.io/v1/workspaces/bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb/query?query=Heartbeat%7C%20where%20TimeGenerated%20between%28datetime%282021-11-16T10%3A17%3A39.0000000Z%29..datetime%282021-11-16T11%3A17%3A39.0000000Z%29%29&timespan=2021-11-16T10%3a17%3a39.0000000Z%2f2021-11-16T11%3a17%3a39.0000000Z",
                  "linkToFilteredSearchResultsAPI":"https://api.loganalytics.io/v1/workspaces/bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb/query?query=Heartbeat%7C%20where%20TimeGenerated%20between%28datetime%282021-11-16T10%3A17%3A39.0000000Z%29..datetime%282021-11-16T11%3A17%3A39.0000000Z%29%29%7C%20where%20tostring%28Computer%29%20%3D%3D%20%27test-computer%27&timespan=2021-11-16T10%3a17%3a39.0000000Z%2f2021-11-16T11%3a17%3a39.0000000Z"
               }
            ],
            "windowStartTime":"2021-11-16T10:17:39Z",
            "windowEndTime":"2021-11-16T11:17:39Z"
         }
      }
   }
}

Activity log alerts

monitoringService = Activity Log - Administrative

Sample values

{
   "schemaId":"azureMonitorCommonAlertSchema",
   "data":{
      "essentials":{
         "alertId":"/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.AlertsManagement/alerts/12345678-1234-1234-1234-1234567890ab",
         "alertRule":"test-activityLogAlertRule",
         "severity":"Sev4",
         "signalType":"Activity Log",
         "monitorCondition":"Fired",
         "monitoringService":"Activity Log - Administrative",
         "alertTargetIDs":[
            "/subscriptions/11111111-1111-1111-1111-111111111111/resourcegroups/test-RG/providers/microsoft.compute/virtualmachines/test-VM"
         ],
         "configurationItems":[
            "test-VM"
         ],
         "originAlertId":"bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb_123456789012345678901234567890ab",
         "firedDateTime":"2021-11-16T08:29:01.2932462Z",
         "description":"Alert rule description",
         "essentialsVersion":"1.0",
         "alertContextVersion":"1.0"
      },
      "alertContext":{
         "authorization":{
            "action":"Microsoft.Compute/virtualMachines/restart/action",
            "scope":"/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/test-RG/providers/Microsoft.Compute/virtualMachines/test-VM"
         },
         "channels":"Operation",
         "claims":"{}",
         "caller":"user-email@domain.com",
         "correlationId":"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
         "eventSource":"Administrative",
         "eventTimestamp":"2021-11-16T08:27:36.1836909+00:00",
         "eventDataId":"bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
         "level":"Informational",
         "operationName":"Microsoft.Compute/virtualMachines/restart/action",
         "operationId":"cccccccc-cccc-cccc-cccc-cccccccccccc",
         "properties":{
            "eventCategory":"Administrative",
            "entity":"/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/test-RG/providers/Microsoft.Compute/virtualMachines/test-VM",
            "message":"Microsoft.Compute/virtualMachines/restart/action",
            "hierarchy":"22222222-2222-2222-2222-222222222222/CnAIOrchestrationServicePublicCorpprod/33333333-3333-3333-3333-3333333333333/44444444-4444-4444-4444-444444444444/55555555-5555-5555-5555-555555555555/11111111-1111-1111-1111-111111111111"
         },
         "status":"Succeeded",
         "subStatus":"",
         "submissionTimestamp":"2021-11-16T08:29:00.141807+00:00",
         "Activity Log Event Description":""
      }
   }
}

monitoringService = ServiceHealth

Sample values

{
   "schemaId":"azureMonitorCommonAlertSchema",
   "data":{
      "essentials":{
         "alertId":"/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.AlertsManagement/alerts/1234abcd5678efgh1234abcd5678efgh1234abcd5678efgh1234abcd5678efgh",
         "alertRule":"test-ServiceHealthAlertRule",
         "severity":"Sev4",
         "signalType":"Activity Log",
         "monitorCondition":"Fired",
         "monitoringService":"ServiceHealth",
         "alertTargetIDs":[
            "/subscriptions/11111111-1111-1111-1111-111111111111"
         ],
         "originAlertId":"12345678-1234-1234-1234-1234567890ab",
         "firedDateTime":"2021-11-17T05:34:48.0623172",
         "description":"Alert rule description",
         "essentialsVersion":"1.0",
         "alertContextVersion":"1.0"
      },
      "alertContext":{
         "authorization":null,
         "channels":1,
         "claims":null,
         "caller":null,
         "correlationId":"12345678-abcd-efgh-ijkl-abcd12345678",
         "eventSource":2,
         "eventTimestamp":"2021-11-17T05:34:44.5778226+00:00",
         "httpRequest":null,
         "eventDataId":"12345678-1234-1234-1234-1234567890ab",
         "level":3,
         "operationName":"Microsoft.ServiceHealth/incident/action",
         "operationId":"12345678-abcd-efgh-ijkl-abcd12345678",
         "properties":{
            "title":"Test Action Group - Test Service Health Alert",
            "service":"Azure Service Name",
            "region":"Global",
            "communication":"<p><strong>Summary of impact</strong>:&nbsp;This is the impact summary.</p>\n<p><br></p>\n<p><strong>Preliminary Root Cause</strong>: This is the preliminary root cause.</p>\n<p><br></p>\n<p><strong>Mitigation</strong>:&nbsp;Mitigation description.</p>\n<p><br></p>\n<p><strong>Next steps</strong>: These are the next steps.&nbsp;</p>\n<p><br></p>\n<p>Stay informed about Azure service issues by creating custom service health alerts: <a href=\"https://aka.ms/ash-videos\" rel=\"noopener noreferrer\" target=\"_blank\">https://aka.ms/ash-videos</a> for video tutorials and <a href=\"https://aka.ms/ash-alerts%20for%20how-to%20documentation\" rel=\"noopener noreferrer\" target=\"_blank\">https://aka.ms/ash-alerts for how-to documentation</a>.</p>\n<p><br></p>",
            "incidentType":"Incident",
            "trackingId":"ABC1-DEF",
            "impactStartTime":"2021-11-16T20:00:00Z",
            "impactMitigationTime":"2021-11-17T01:00:00Z",
            "impactedServices":"[{\"ImpactedRegions\":[{\"RegionName\":\"Global\"}],\"ServiceName\":\"Azure Service Name\"}]",
            "impactedServicesTableRows":"<tr>\r\n<td align='center' style='padding: 5px 10px; border-right:1px solid black; border-bottom:1px solid black'>Azure Service Name</td>\r\n<td align='center' style='padding: 5px 10px; border-bottom:1px solid black'>Global<br></td>\r\n</tr>\r\n",
            "defaultLanguageTitle":"Test Action Group - Test Service Health Alert",
            "defaultLanguageContent":"<p><strong>Summary of impact</strong>:&nbsp;This is the impact summary.</p>\n<p><br></p>\n<p><strong>Preliminary Root Cause</strong>: This is the preliminary root cause.</p>\n<p><br></p>\n<p><strong>Mitigation</strong>:&nbsp;Mitigation description.</p>\n<p><br></p>\n<p><strong>Next steps</strong>: These are the next steps.&nbsp;</p>\n<p><br></p>\n<p>Stay informed about Azure service issues by creating custom service health alerts: <a href=\"https://aka.ms/ash-videos\" rel=\"noopener noreferrer\" target=\"_blank\">https://aka.ms/ash-videos</a> for video tutorials and <a href=\"https://aka.ms/ash-alerts%20for%20how-to%20documentation\" rel=\"noopener noreferrer\" target=\"_blank\">https://aka.ms/ash-alerts for how-to documentation</a>.</p>\n<p><br></p>",
            "stage":"Resolved",
            "communicationId":"11223344556677",
            "isHIR":"false",
            "IsSynthetic":"True",
            "impactType":"SubscriptionList",
            "version":"0.1.1"
         },
         "status":"Resolved",
         "subStatus":null,
         "submissionTimestamp":"2021-11-17T01:23:45.0623172+00:00",
         "ResourceType":null
      }
   }
}

monitoringService = Resource Health

Sample values

{
   "schemaId":"azureMonitorCommonAlertSchema",
   "data":{
      "essentials":{
         "alertId":"/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.AlertsManagement/alerts/12345678-1234-1234-1234-1234567890ab",
         "alertRule":"test-ResourceHealthAlertRule",
         "severity":"Sev4",
         "signalType":"Activity Log",
         "monitorCondition":"Fired",
         "monitoringService":"Resource Health",
         "alertTargetIDs":[
            "/subscriptions/11111111-1111-1111-1111-111111111111/resourcegroups/test-RG/providers/microsoft.compute/virtualmachines/test-VM"
         ],
         "configurationItems":[
            "test-VM"
         ],
         "originAlertId":"bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb_123456789012345678901234567890ab",
         "firedDateTime":"2021-11-16T09:54:08.9938123Z",
         "description":"Alert rule description",
         "essentialsVersion":"1.0",
         "alertContextVersion":"1.0"
      },
      "alertContext":{
         "channels":"Admin, Operation",
         "correlationId":"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
         "eventSource":"ResourceHealth",
         "eventTimestamp":"2021-11-16T09:50:20.406+00:00",
         "eventDataId":"bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
         "level":"Informational",
         "operationName":"Microsoft.Resourcehealth/healthevent/Activated/action",
         "operationId":"bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
         "properties":{
            "title":"Rebooted by user",
            "details":null,
            "currentHealthStatus":"Unavailable",
            "previousHealthStatus":"Available",
            "type":"Downtime",
            "cause":"UserInitiated"
         },
         "status":"Active",
         "submissionTimestamp":"2021-11-16T09:54:08.5303319+00:00",
         "Activity Log Event Description":null
      }
   }
}

monitoringService = CostAlerts

Actual cost budget

Sample values

{
   "schemaId": "azureMonitorCommonAlertSchema",
   "data": {
      "essentials": {
         "monitoringService": "CostAlerts",
         "firedDateTime": "2022-12-07T21:13:20.645Z",
         "description": "Your spend for budget Test_actual_cost_budget is now $11,111.00 exceeding your specified threshold $25.00.",
         "essentialsVersion": "1.0",
         "alertContextVersion": "1.0",
         "alertId": "/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.CostManagement/alerts/Test_Alert",
         "alertRule": null,
         "severity": null,
         "signalType": null,
         "monitorCondition": null,
         "alertTargetIDs": null,
         "configurationItems": [
            "budgets"
         ],
         "originAlertId": null
      },
      "alertContext": {
         "AlertCategory": "budgets",
         "AlertData": {
            "Scope": "/subscriptions/11111111-1111-1111-1111-111111111111/",
            "ThresholdType": "Actual",
            "BudgetType": "Cost",
            "BudgetThreshold": "$50.00",
            "NotificationThresholdAmount": "$25.00",
            "BudgetName": "Test_actual_cost_budget",
            "BudgetId": "/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.Consumption/budgets/Test_actual_cost_budget",
            "BudgetStartDate": "2022-11-01",
            "BudgetCreator": "test@sample.test",
            "Unit": "USD",
            "SpentAmount": "$11,111.00"
         }
      }
   }
}

monitoringService = CostAlerts

Forecasted cost budget

Sample values

{
   "schemaId": "azureMonitorCommonAlertSchema",
   "data": {
      "essentials": {
         "monitoringService": "CostAlerts",
         "firedDateTime": "2022-12-07T21:13:29.576Z",
         "description": "The total spend for your budget, Test_forcasted_budget, is forecasted to reach $1111.11 before the end of the period. This amount exceeds your specified budget threshold of $50.00.",
         "essentialsVersion": "1.0",
         "alertContextVersion": "1.0",
         "alertId": "/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.CostManagement/alerts/Test_Alert",
         "alertRule": null,
         "severity": null,
         "signalType": null,
         "monitorCondition": null,
         "alertTargetIDs": null,
         "configurationItems": [
            "budgets"
         ],
         "originAlertId": null
      },
      "alertContext": {
         "AlertCategory": "budgets",
         "AlertData": {
            "Scope": "/subscriptions/11111111-1111-1111-1111-111111111111/",
            "ThresholdType": "Forecasted",
            "BudgetType": "Cost",
            "BudgetThreshold": "$50.00",
            "NotificationThresholdAmount": "$50.00",
            "BudgetName": "Test_forcasted_budget",
            "BudgetId": "/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.Consumption/budgets/Test_forcasted_budget",
            "BudgetStartDate": "2022-11-01",
            "BudgetCreator": "test@sample.test",
            "Unit": "USD",
            "SpentAmount": "$999.99",
            "ForecastedTotalForPeriod": "$1111.11"
         }
      }
   }
}

monitoringService = Smart Alert

Sample values

{
   "schemaId":"azureMonitorCommonAlertSchema",
   "data":{
      "essentials":{
         "alertId":"/subscriptions/11111111-1111-1111-1111-111111111111/providers/Microsoft.AlertsManagement/alerts/12345678-1234-1234-1234-1234567890ab",
         "alertRule":"Dependency Latency Degradation - test-applicationInsights",
         "severity":"Sev3",
         "signalType":"Log",
         "monitorCondition":"Fired",
         "monitoringService":"SmartDetector",
         "alertTargetIDs":[
            "/subscriptions/11111111-1111-1111-1111-111111111111/resourcegroups/test-RG/providers/microsoft.insights/components/test-applicationInsights"
         ],
         "configurationItems":[
            "test-applicationInsights"
         ],
         "originAlertId":"1234abcd5678efgh1234abcd5678efgh1234abcd5678efgh1234abcd5678efgh",
         "firedDateTime":"2021-10-28T19:09:09.1115084Z",
         "description":"Dependency Latency Degradation notifies you of an unusual increase in response by a dependency your app is calling (e.g. REST API or database)",
         "essentialsVersion":"1.0",
         "alertContextVersion":"1.0"
      },
      "alertContext":{
         "DetectionSummary":"A degradation in the dependency duration over the last 24 hours",
         "FormattedOccurrenceTime":"2021-10-27T23:59:59Z",
         "DetectedValue":"0.45 sec",
         "NormalValue":"0.27 sec (over the last 7 days)",
         "PresentationInsightEventRequest":"/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/test-RG/providers/microsoft.insights/components/test-applicationInsights/query?query=systemEvents%0d%0a++++++++++++++++%7c+where+timestamp+%3e%3d+datetime(%272021-10-27T23%3a29%3a59.0000000Z%27)+%0d%0a++++++++++++++++%7c+where+itemType+%3d%3d+%27systemEvent%27+and+name+%3d%3d+%27ProactiveDetectionInsight%27+%0d%0a++++++++++++++++%7c+where+dimensions.InsightType+%3d%3d+3+%0d%0a++++++++++++++++%7c+where+dimensions.InsightVersion+%3d%3d+%27SmartAlert%27%0d%0a++++++++++++++++%7c+where+dimensions.InsightDocumentId+%3d%3d+%2712345678-abcd-1234-5678-abcd12345678%27+%0d%0a++++++++++++++++%7c+project+dimensions.InsightPropertiesTable%2cdimensions.InsightDegradationChart%2cdimensions.InsightCountChart%2cdimensions.InsightLinksTable%0d%0a++++++++++++++++&api-version=2018-04-20",
         "SmartDetectorId":"DependencyPerformanceDegradationDetector",
         "SmartDetectorName":"Dependency Performance Degradation Detector",
         "AnalysisTimestamp":"2021-10-28T19:09:09.1115084Z"
      }
   }
}