alerts

Creates, updates, deletes, gets or lists an alerts resource.

Overview

Name	alerts
Type	Resource
Id	azure.alerts_management.alerts

Fields

The following fields are returned by SELECT queries:

get_by_id

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
context	object	Information specific to the monitor service that gives more contextual details about the alert.
customProperties	object	Custom properties that can hold any user defined key-value pairs.
egressConfig	object	Config which would be used for displaying the data in portal.
essentials	object	This object contains consistent fields across different monitor services.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

get_summary

Name	Datatype	Description
id	string	Azure resource Id.
name	string	Azure resource name.
groupedby	string	Name of the field aggregated.
smartGroupsCount	integer	Total count of the smart groups.
total	integer	Total count of the result set.
type	string	Azure resource type.
values	array	List of the items.

get_by_id_tenant

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
context	object	Information specific to the monitor service that gives more contextual details about the alert.
customProperties	object	Custom properties that can hold any user defined key-value pairs.
egressConfig	object	Config which would be used for displaying the data in portal.
essentials	object	This object contains consistent fields across different monitor services.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

get_all

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
context	object	Information specific to the monitor service that gives more contextual details about the alert.
customProperties	object	Custom properties that can hold any user defined key-value pairs.
egressConfig	object	Config which would be used for displaying the data in portal.
essentials	object	This object contains consistent fields across different monitor services.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

get_all_tenant

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
context	object	Information specific to the monitor service that gives more contextual details about the alert.
customProperties	object	Custom properties that can hold any user defined key-value pairs.
egressConfig	object	Config which would be used for displaying the data in portal.
essentials	object	This object contains consistent fields across different monitor services.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_by_id	select	scope, alert_id		Get a specific alert. Get information related to a specific alert. If scope is a deleted resource then please use scope as parent resource of the delete resource. For example if my alert id is '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/virtualMachines/vm1/providers/Microsoft.AlertsManagement/alerts/{alertId}' and 'vm1' is deleted then if you want to get alert by id then use parent resource of scope. So in this example get alert by id call will look like this: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AlertsManagement/alerts/{alertId}'.
get_summary	select	scope, groupby	includeSmartGroupsCount, targetResource, targetResourceType, targetResourceGroup, monitorService, monitorCondition, severity, alertState, alertRule, timeRange, customTimeRange	Get a summarized count of your alerts grouped by various parameters (e.g. grouping by 'Severity' returns the count of alerts for each severity).
get_by_id_tenant	select	alert_id		Get a specific alert. Get information related to a specific alert.
get_all	select	scope	targetResource, targetResourceType, targetResourceGroup, monitorService, monitorCondition, severity, alertState, alertRule, smartGroupId, includeContext, includeEgressConfig, pageCount, sortBy, sortOrder, select, timeRange, customTimeRange	List all existing alerts, where the results can be filtered on the basis of multiple parameters (e.g. time range). The results can then be sorted on the basis specific fields, with the default being lastModifiedDateTime.
get_all_tenant	select		targetResource, targetResourceType, targetResourceGroup, monitorService, monitorCondition, severity, alertState, alertRule, smartGroupId, includeContext, includeEgressConfig, pageCount, sortBy, sortOrder, select, timeRange, customTimeRange	List all existing alerts, where the results can be filtered on the basis of multiple parameters (e.g. time range). The results can then be sorted on the basis specific fields, with the default being lastModifiedDateTime.
get_history_tenant	exec	alert_id		Get the history of an alert, which captures any monitor condition changes (Fired/Resolved), alert state changes (New/Acknowledged/Closed) and applied action rules for that particular alert.
get_history	exec	scope, alert_id		Get the history of an alert, which captures any monitor condition changes (Fired/Resolved), alert state changes (New/Acknowledged/Closed) and applied action rules for that particular alert. If scope is a deleted resource then please use scope as parent resource of the delete resource. For example if my alert id is '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/virtualMachines/vm1/providers/Microsoft.AlertsManagement/alerts/{alertId}' and 'vm1' is deleted then if you want to get history of this particular alert then use parent resource of scope. So in this example get history call will look like this: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AlertsManagement/alerts/{alertId}/history'.
get_enrichments	exec	scope, alert_id		Get the enrichments of an alert. It returns a collection of one object named default.
change_state_tenant	exec	alert_id, newState		Change the state of an alert.
change_state	exec	scope, alert_id, newState		Change the state of an alert. If scope is a deleted resource then please use scope as parent resource of the delete resource. For example if my alert id is '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/virtualMachines/vm1/providers/Microsoft.AlertsManagement/alerts/{alertId}' and 'vm1' is deleted then if you want to change state of this particular alert then use parent resource of scope. So in this example change state call will look like this: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AlertsManagement/alerts/{alertId}'.
meta_data	exec	identifier		List alerts meta data information based on value of identifier parameter.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
alert_id	string	Unique ID of an alert instance. Required.
groupby	string	This parameter allows the result set to be grouped by input fields. For example, groupby=severity,alertstate. Known values are: "severity", "alertState", "monitorCondition", "monitorService", "signalType", and "alertRule". Required.
identifier	string	Identification of the information to be retrieved by API call. "MonitorServiceList" Required.
newState	string	New state of the alert. Known values are: "New", "Acknowledged", and "Closed". Required.
scope	string	undefined. Required.
alertRule	string	Filter by specific alert rule. Default value is to select all. Default value is None.
alertState	string	Filter by state of the alert instance. Default value is to select all. Known values are: "New", "Acknowledged", and "Closed". Default value is None.
customTimeRange	string	Filter by custom time range in the format / where time is in (ISO-8601 format)'. Permissible values is within 30 days from query time. Either timeRange or customTimeRange could be used but not both. Default is none. Default value is None.
includeContext	boolean	Include context which has contextual data specific to the monitor service. Default value is false'. Default value is None.
includeEgressConfig	boolean	Include egress config which would be used for displaying the content in portal. Default value is 'false'. Default value is None.
includeSmartGroupsCount	boolean	Include count of the SmartGroups as part of the summary. Default value is 'false'. Default value is None.
monitorCondition	string	Filter by monitor condition which is either 'Fired' or 'Resolved'. Default value is to select all. Known values are: "Fired" and "Resolved". Default value is None.
monitorService	string	Filter by monitor service which generates the alert instance. Default value is select all. Known values are: "Application Insights", "ActivityLog Administrative", "ActivityLog Security", "ActivityLog Recommendation", "ActivityLog Policy", "ActivityLog Autoscale", "Log Analytics", "Nagios", "Platform", "SCOM", "ServiceHealth", "SmartDetector", "VM Insights", "Zabbix", and "Resource Health". Default value is None.
pageCount	integer	Determines number of alerts returned per page in response. Permissible value is between 1 to 250. When the "includeContent" filter is selected, maximum value allowed is 25. Default value is 25. Default value is None.
select	string	This filter allows to selection of the fields(comma separated) which would be part of the essential section. This would allow to project only the required fields rather than getting entire content. Default is to fetch all the fields in the essentials section. Default value is None.
severity	string	Filter by severity. Default value is select all. Known values are: "Sev0", "Sev1", "Sev2", "Sev3", and "Sev4". Default value is None.
smartGroupId	string	Filter the alerts list by the Smart Group Id. Default value is none. Default value is None.
sortBy	string	Sort the query results by input field, Default value is 'lastModifiedDateTime'. Known values are: "name", "severity", "alertState", "monitorCondition", "targetResource", "targetResourceName", "targetResourceGroup", "targetResourceType", "startDateTime", and "lastModifiedDateTime". Default value is None.
sortOrder	string	Sort the query results order in either ascending or descending. Default value is 'desc' for time fields and 'asc' for others. Known values are: "asc" and "desc". Default value is None.
targetResource	string	Filter by target resource( which is full ARM ID) Default value is select all. Default value is None.
targetResourceGroup	string	Filter by target resource group name. Default value is select all. Default value is None.
targetResourceType	string	Filter by target resource type. Default value is select all. Default value is None.
timeRange	string	Filter by time range by below listed values. Default value is 1 day. Known values are: "1h", "1d", "7d", and "30d". Default value is None.

SELECT examples

get_by_id

Get a specific alert. Get information related to a specific alert. If scope is a deleted resource then please use scope as parent resource of the delete resource. For example if my alert id is '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/virtualMachines/vm1/providers/Microsoft.AlertsManagement/alerts/{alertId}' and 'vm1' is deleted then if you want to get alert by id then use parent resource of scope. So in this example get alert by id call will look like this: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AlertsManagement/alerts/{alertId}'.

SELECT
id,
name,
context,
customProperties,
egressConfig,
essentials,
systemData,
type
FROM azure.alerts_management.alerts
WHERE scope = '{{ scope }}' -- required
AND alert_id = '{{ alert_id }}' -- required
;

get_summary

Get a summarized count of your alerts grouped by various parameters (e.g. grouping by 'Severity' returns the count of alerts for each severity).

SELECT
id,
name,
groupedby,
smartGroupsCount,
total,
type,
values
FROM azure.alerts_management.alerts
WHERE scope = '{{ scope }}' -- required
AND groupby = '{{ groupby }}' -- required
AND includeSmartGroupsCount = '{{ includeSmartGroupsCount }}'
AND targetResource = '{{ targetResource }}'
AND targetResourceType = '{{ targetResourceType }}'
AND targetResourceGroup = '{{ targetResourceGroup }}'
AND monitorService = '{{ monitorService }}'
AND monitorCondition = '{{ monitorCondition }}'
AND severity = '{{ severity }}'
AND alertState = '{{ alertState }}'
AND alertRule = '{{ alertRule }}'
AND timeRange = '{{ timeRange }}'
AND customTimeRange = '{{ customTimeRange }}'
;

get_by_id_tenant

Get a specific alert. Get information related to a specific alert.

SELECT
id,
name,
context,
customProperties,
egressConfig,
essentials,
systemData,
type
FROM azure.alerts_management.alerts
WHERE alert_id = '{{ alert_id }}' -- required
;

get_all

List all existing alerts, where the results can be filtered on the basis of multiple parameters (e.g. time range). The results can then be sorted on the basis specific fields, with the default being lastModifiedDateTime.

SELECT
id,
name,
context,
customProperties,
egressConfig,
essentials,
systemData,
type
FROM azure.alerts_management.alerts
WHERE scope = '{{ scope }}' -- required
AND targetResource = '{{ targetResource }}'
AND targetResourceType = '{{ targetResourceType }}'
AND targetResourceGroup = '{{ targetResourceGroup }}'
AND monitorService = '{{ monitorService }}'
AND monitorCondition = '{{ monitorCondition }}'
AND severity = '{{ severity }}'
AND alertState = '{{ alertState }}'
AND alertRule = '{{ alertRule }}'
AND smartGroupId = '{{ smartGroupId }}'
AND includeContext = '{{ includeContext }}'
AND includeEgressConfig = '{{ includeEgressConfig }}'
AND pageCount = '{{ pageCount }}'
AND sortBy = '{{ sortBy }}'
AND sortOrder = '{{ sortOrder }}'
AND select = '{{ select }}'
AND timeRange = '{{ timeRange }}'
AND customTimeRange = '{{ customTimeRange }}'
;

get_all_tenant

List all existing alerts, where the results can be filtered on the basis of multiple parameters (e.g. time range). The results can then be sorted on the basis specific fields, with the default being lastModifiedDateTime.

SELECT
id,
name,
context,
customProperties,
egressConfig,
essentials,
systemData,
type
FROM azure.alerts_management.alerts
WHERE targetResource = '{{ targetResource }}'
AND targetResourceType = '{{ targetResourceType }}'
AND targetResourceGroup = '{{ targetResourceGroup }}'
AND monitorService = '{{ monitorService }}'
AND monitorCondition = '{{ monitorCondition }}'
AND severity = '{{ severity }}'
AND alertState = '{{ alertState }}'
AND alertRule = '{{ alertRule }}'
AND smartGroupId = '{{ smartGroupId }}'
AND includeContext = '{{ includeContext }}'
AND includeEgressConfig = '{{ includeEgressConfig }}'
AND pageCount = '{{ pageCount }}'
AND sortBy = '{{ sortBy }}'
AND sortOrder = '{{ sortOrder }}'
AND select = '{{ select }}'
AND timeRange = '{{ timeRange }}'
AND customTimeRange = '{{ customTimeRange }}'
;

Lifecycle Methods

get_history_tenant

Get the history of an alert, which captures any monitor condition changes (Fired/Resolved), alert state changes (New/Acknowledged/Closed) and applied action rules for that particular alert.

EXEC azure.alerts_management.alerts.get_history_tenant 
@alert_id='{{ alert_id }}' --required
;

get_history

Get the history of an alert, which captures any monitor condition changes (Fired/Resolved), alert state changes (New/Acknowledged/Closed) and applied action rules for that particular alert. If scope is a deleted resource then please use scope as parent resource of the delete resource. For example if my alert id is '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/virtualMachines/vm1/providers/Microsoft.AlertsManagement/alerts/{alertId}' and 'vm1' is deleted then if you want to get history of this particular alert then use parent resource of scope. So in this example get history call will look like this: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AlertsManagement/alerts/{alertId}/history'.

EXEC azure.alerts_management.alerts.get_history 
@scope='{{ scope }}' --required, 
@alert_id='{{ alert_id }}' --required
;

get_enrichments

Get the enrichments of an alert. It returns a collection of one object named default.

EXEC azure.alerts_management.alerts.get_enrichments 
@scope='{{ scope }}' --required, 
@alert_id='{{ alert_id }}' --required
;

change_state_tenant

Change the state of an alert.

EXEC azure.alerts_management.alerts.change_state_tenant 
@alert_id='{{ alert_id }}' --required, 
@newState='{{ newState }}' --required 
@@json=
'{
"comments": "{{ comments }}"
}'
;

change_state

Change the state of an alert. If scope is a deleted resource then please use scope as parent resource of the delete resource. For example if my alert id is '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/virtualMachines/vm1/providers/Microsoft.AlertsManagement/alerts/{alertId}' and 'vm1' is deleted then if you want to change state of this particular alert then use parent resource of scope. So in this example change state call will look like this: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AlertsManagement/alerts/{alertId}'.

EXEC azure.alerts_management.alerts.change_state 
@scope='{{ scope }}' --required, 
@alert_id='{{ alert_id }}' --required, 
@newState='{{ newState }}' --required 
@@json=
'{
"comments": "{{ comments }}"
}'
;

meta_data

List alerts meta data information based on value of identifier parameter.

EXEC azure.alerts_management.alerts.meta_data 
@identifier='{{ identifier }}' --required
;