Alerts - Get All

List all existing alerts, where the results can be filtered on the basis of multiple parameters (e.g. time range). The results can then be sorted on the basis specific fields, with the default being lastModifiedDateTime.

GET https://management.azure.com/{scope}/providers/Microsoft.AlertsManagement/alerts?api-version=2023-07-12-preview
GET https://management.azure.com/{scope}/providers/Microsoft.AlertsManagement/alerts?targetResource={targetResource}&targetResourceType={targetResourceType}&targetResourceGroup={targetResourceGroup}&monitorService={monitorService}&monitorCondition={monitorCondition}&severity={severity}&alertState={alertState}&alertRule={alertRule}&smartGroupId={smartGroupId}&includeContext={includeContext}&includeEgressConfig={includeEgressConfig}&pageCount={pageCount}&sortBy={sortBy}&sortOrder={sortOrder}&select={select}&timeRange={timeRange}&customTimeRange={customTimeRange}&api-version=2023-07-12-preview

URI Parameters

Name In Required Type Description
scope
path True

string

scope here is resourceId for which alert is created.

api-version
query True

string

The API version to use for this operation.

alertRule
query

string

Filter by specific alert rule. Default value is to select all.

alertState
query

AlertState

Filter by state of the alert instance. Default value is to select all.

customTimeRange
query

string

Filter by custom time range in the format / where time is in (ISO-8601 format)'. Permissible values is within 30 days from query time. Either timeRange or customTimeRange could be used but not both. Default is none.

includeContext
query

boolean

Include context which has contextual data specific to the monitor service. Default value is false'

includeEgressConfig
query

boolean

Include egress config which would be used for displaying the content in portal. Default value is 'false'.

monitorCondition
query

MonitorCondition

Filter by monitor condition which is either 'Fired' or 'Resolved'. Default value is to select all.

monitorService
query

MonitorService

Filter by monitor service which generates the alert instance. Default value is select all.

pageCount
query

integer

int64

Determines number of alerts returned per page in response. Permissible value is between 1 to 250. When the "includeContent" filter is selected, maximum value allowed is 25. Default value is 25.

select
query

string

This filter allows to selection of the fields(comma separated) which would be part of the essential section. This would allow to project only the required fields rather than getting entire content. Default is to fetch all the fields in the essentials section.

severity
query

Severity

Filter by severity. Default value is select all.

smartGroupId
query

string

Filter the alerts list by the Smart Group Id. Default value is none.

sortBy
query

AlertsSortByFields

Sort the query results by input field, Default value is 'lastModifiedDateTime'.

sortOrder
query

SortOrder

Sort the query results order in either ascending or descending. Default value is 'desc' for time fields and 'asc' for others.

targetResource
query

string

Filter by target resource( which is full ARM ID) Default value is select all.

targetResourceGroup
query

string

Filter by target resource group name. Default value is select all.

targetResourceType
query

string

Filter by target resource type. Default value is select all.

timeRange
query

TimeRange

Filter by time range by below listed values. Default value is 1 day.

Responses

Name Type Description
200 OK

alertsList

OK. Successfully listed alert objects.

Other Status Codes

errorResponse

Error response describing why the operation failed.

Examples

ListAlerts

Sample request

GET https://management.azure.com/subscriptions/1e3ff1c0-771a-4119-a03b-be82a51e232d/providers/Microsoft.AlertsManagement/alerts?api-version=2023-07-12-preview

Sample response

{
  "nextLink": "https://management.azure.com:443/subscriptions/1e3ff1c0-771a-4119-a03b-be82a51e232d/providers/Microsoft.AlertsManagement/alerts?api-version=2018-05-05-preview&timeRange=1d&ctoken=%2bRID%3aPlwOAPHEGwB9UwEAAAAgCw%3d%3d%23RT%3a2%23TRC%3a500%23RTD%3aqtQyMDE4LTA2LTEyVDE1OjEyOjE1",
  "value": [
    {
      "properties": {
        "essentials": {
          "severity": "Sev3",
          "signalType": "Log",
          "alertState": "Acknowledged",
          "monitorCondition": "Fired",
          "monitorService": "Application Insights",
          "targetResource": "/subscriptions/3b540246-808d-4331-99aa-917b808a9166/resourcegroups/servicedeskresourcegroup/providers/microsoft.insights/components/servicedeskappinsight",
          "targetResourceName": "servicedeskappinsight",
          "targetResourceGroup": "servicedeskresourcegroup",
          "targetResourceType": "components",
          "sourceCreatedId": "6cd6b2ce-8c54-468f-aff0-9d12aebb7e49",
          "smartGroupId": "23d6b2ce-8c54-468f-aff0-sd32aebb7e56",
          "smartGroupingReason": "Occurred frequently with other alerts",
          "alertRule": "https://servisdffsdf.portal.mms.microsoft.com/#Workspace/overview/settings/details/Edit Alert Rule/details/index?savedSearchId=&scheduleId=",
          "startDateTime": "2018-09-13T15:51:02Z",
          "lastModifiedDateTime": "2018-09-13T15:51:02Z",
          "lastModifiedUserName": "System",
          "monitorConditionResolvedDateTime": "2018-09-13T15:51:02Z",
          "actionStatus": {
            "isSuppressed": false
          },
          "description": "description of the alert"
        },
        "egressConfig": {},
        "context": {}
      },
      "id": "/subscriptions/9e261de7-c804-4b9d-9ebf-6f50fe350a9a/providers/Microsoft.AlertsManagement/alerts/66114d64-d9d9-478b-95c9-b789d6502100",
      "type": "Microsoft.AlertsManagement/alerts",
      "name": "cpu alert"
    },
    {
      "properties": {
        "essentials": {
          "severity": "Sev3",
          "signalType": "Log",
          "alertState": "New",
          "monitorCondition": "Fired",
          "monitorService": "Application Insights",
          "targetResource": "/subscriptions/3b540246-808d-4331-99aa-917b808a9166/resourcegroups/cind/providers/microsoft.operationalinsights/workspaces/servicedeskwcus",
          "targetResourceName": "servicedeskwcus",
          "targetResourceGroup": "servicedeskresourcegroup",
          "targetResourceType": "components",
          "sourceCreatedId": "6cd6b2ce-8c54-468f-aff0-9d12aebb7e49",
          "smartGroupId": "d1c49c89-ea95-4697-a299-c0f5ebac62f1",
          "smartGroupingReason": "Alerts that frequently occur together have been grouped.",
          "alertRule": "https://servicsdfsdf.portal.mms.microsoft.com/#Workspace/overview/settings/details/Edit Alert Rule/details/index?savedSearchId=&scheduleId=",
          "startDateTime": "2018-09-13T15:51:02Z",
          "lastModifiedDateTime": "2018-09-13T15:51:02Z",
          "lastModifiedUserName": "System",
          "monitorConditionResolvedDateTime": "2018-09-13T15:51:02Z",
          "actionStatus": {
            "isSuppressed": false
          },
          "description": "description of the alert"
        },
        "egressConfig": {},
        "context": {}
      },
      "id": "/subscriptions/9e261de7-c804-4b9d-9ebf-6f50fe350a9a/providers/Microsoft.AlertsManagement/alerts/66114d64-d9d9-478b-95c9-b789d6502100",
      "type": "Microsoft.AlertsManagement/alerts",
      "name": "cpu alert"
    }
  ]
}

Definitions

Name Description
actionStatus

Action status

alert

An alert created in alert management service.

alertProperties

Alert property bag

alertsList

List the alerts.

AlertsSortByFields

Sort the query results by input field, Default value is 'lastModifiedDateTime'.

AlertState

Alert object state, which can be modified by the user.

errorResponse

An error response from the service.

errorResponseBody

Details of error response.

essentials

This object contains consistent fields across different monitor services.

MonitorCondition

Condition of the rule at the monitor service. It represents whether the underlying conditions have crossed the defined alert rule thresholds.

MonitorService

Monitor service on which the rule(monitor) is set.

Severity

Severity of alert Sev0 being highest and Sev4 being lowest.

SignalType

The type of signal the alert is based on, which could be metrics, logs or activity logs.

SortOrder

Sort the query results order in either ascending or descending. Default value is 'desc' for time fields and 'asc' for others.

TimeRange

Filter by time range by below listed values. Default value is 1 day.

actionStatus

Action status

Name Type Description
isSuppressed

boolean

Value indicating whether alert is suppressed.

alert

An alert created in alert management service.

Name Type Description
id

string

Azure resource Id

name

string

Azure resource name

properties

alertProperties

Alert property bag

type

string

Azure resource type

alertProperties

Alert property bag

Name Type Description
context

object

Information specific to the monitor service that gives more contextual details about the alert.

egressConfig

object

Config which would be used for displaying the data in portal.

essentials

essentials

This object contains consistent fields across different monitor services.

alertsList

List the alerts.

Name Type Description
nextLink

string

URL to fetch the next set of alerts.

value

alert[]

List of alerts

AlertsSortByFields

Sort the query results by input field, Default value is 'lastModifiedDateTime'.

Name Type Description
alertState

string

lastModifiedDateTime

string

monitorCondition

string

name

string

severity

string

startDateTime

string

targetResource

string

targetResourceGroup

string

targetResourceName

string

targetResourceType

string

AlertState

Alert object state, which can be modified by the user.

Name Type Description
Acknowledged

string

Closed

string

New

string

errorResponse

An error response from the service.

Name Type Description
error

errorResponseBody

Details of error response.

errorResponseBody

Details of error response.

Name Type Description
code

string

Error code, intended to be consumed programmatically.

details

errorResponseBody[]

A list of additional details about the error.

message

string

Description of the error, intended for display in user interface.

target

string

Target of the particular error, for example name of the property.

essentials

This object contains consistent fields across different monitor services.

Name Type Description
actionStatus

actionStatus

Action status

alertRule

string

Rule(monitor) which fired alert instance. Depending on the monitor service, this would be ARM id or name of the rule.

alertState

AlertState

Alert object state, which can be modified by the user.

description

string

Alert description.

lastModifiedDateTime

string

Last modification time(ISO-8601 format) of alert instance.

lastModifiedUserName

string

User who last modified the alert, in case of monitor service updates user would be 'system', otherwise name of the user.

monitorCondition

MonitorCondition

Condition of the rule at the monitor service. It represents whether the underlying conditions have crossed the defined alert rule thresholds.

monitorConditionResolvedDateTime

string

Resolved time(ISO-8601 format) of alert instance. This will be updated when monitor service resolves the alert instance because the rule condition is no longer met.

monitorService

MonitorService

Monitor service on which the rule(monitor) is set.

severity

Severity

Severity of alert Sev0 being highest and Sev4 being lowest.

signalType

SignalType

The type of signal the alert is based on, which could be metrics, logs or activity logs.

smartGroupId

string

Unique Id of the smart group

smartGroupingReason

string

Verbose reason describing the reason why this alert instance is added to a smart group

sourceCreatedId

string

Unique Id created by monitor service for each alert instance. This could be used to track the issue at the monitor service, in case of Nagios, Zabbix, SCOM etc.

startDateTime

string

Creation time(ISO-8601 format) of alert instance.

targetResource

string

Target ARM resource, on which alert got created.

targetResourceGroup

string

Resource group of target ARM resource, on which alert got created.

targetResourceName

string

Name of the target ARM resource name, on which alert got created.

targetResourceType

string

Resource type of target ARM resource, on which alert got created.

MonitorCondition

Condition of the rule at the monitor service. It represents whether the underlying conditions have crossed the defined alert rule thresholds.

Name Type Description
Fired

string

Resolved

string

MonitorService

Monitor service on which the rule(monitor) is set.

Name Type Description
ActivityLog Administrative

string

ActivityLog Autoscale

string

ActivityLog Policy

string

ActivityLog Recommendation

string

ActivityLog Security

string

Application Insights

string

Log Analytics

string

Nagios

string

Platform

string

Resource Health

string

SCOM

string

ServiceHealth

string

SmartDetector

string

VM Insights

string

Zabbix

string

Severity

Severity of alert Sev0 being highest and Sev4 being lowest.

Name Type Description
Sev0

string

Sev1

string

Sev2

string

Sev3

string

Sev4

string

SignalType

The type of signal the alert is based on, which could be metrics, logs or activity logs.

Name Type Description
Log

string

Metric

string

Unknown

string

SortOrder

Sort the query results order in either ascending or descending. Default value is 'desc' for time fields and 'asc' for others.

Name Type Description
asc

string

desc

string

TimeRange

Filter by time range by below listed values. Default value is 1 day.

Name Type Description
1d

string

1h

string

30d

string

7d

string