From 1ad41149cb9429adb7182e6ec82ce7de6bfdeecd Mon Sep 17 00:00:00 2001 From: github-actions <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 5 Sep 2024 08:58:44 +0000 Subject: [PATCH] Auto-update Policies [Brunoga-MS/55201742] --- .../policyDefinitions/policies-Hybrid.json | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/patterns/alz/policyDefinitions/policies-Hybrid.json b/patterns/alz/policyDefinitions/policies-Hybrid.json index 658ae3d75..cbd2704c6 100644 --- a/patterns/alz/policyDefinitions/policies-Hybrid.json +++ b/patterns/alz/policyDefinitions/policies-Hybrid.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.19.5.34762", - "templateHash": "6354819903882613978" + "version": "0.29.47.4906", + "templateHash": "16468692433239637076" } }, "parameters": { @@ -13,8 +13,8 @@ "type": "string", "defaultValue": "alz", "metadata": { - "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"", - "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!" + "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!", + "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"" } }, "location": { @@ -115,9 +115,9 @@ "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" } ], - "$fxv#0": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_dataDiskReadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Data Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMdataDiskReadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#1": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_dataDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Data Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMdataDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#10": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_Memory_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Memory Alert\",\r\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMMemoryAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Memory\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_dataDiskReadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Data Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMdataDiskReadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_dataDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Data Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMdataDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#10": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_Memory_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Memory Alert\",\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMMemoryAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Memory\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", "$fxv#11": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_Disconnected_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Disconnected Alert\",\n \"description\": \"Policy to Deploy Hybrid VM Disconnected Alert\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"P1D\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT10M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT2H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT10M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"defaultValue\": \"10m\",\n \"allowedValues\": [\n \"5m\",\n \"10m\",\n \"15m\",\n \"30m\",\n \"1h\",\n \"2h\",\n \"3h\",\n \"6h\",\n \"12h\",\n \"1d\",\n \"2d\",\n \"3d\",\n \"7d\"\n ],\n \"metadata\": {\n \"displayName\": \"Hybrid VM Disconnected Threshold (expressed in timespan)\",\n \"description\": \"Threshold in timespan value for the Hybrid VM Disconnected alert\"\n }\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where parse_json(tostring(tags.{0})) !in~ (\\\"{1}\\\") | where tostring(properties.status) == \\\"Disconnected\\\" | extend appliedThresholdString = iif(tags contains \\\"_amba-Disconnected-threshold-override_\\\", tostring(tags.[\\\"_amba-Disconnected-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = totimespan(appliedThresholdString) | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate >= ago(appliedThreshold) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMDisconnectedAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\",\n \"description\": \"Hybrid VM in disconnected state. Not being connected, prevents extensions to be correctly managed from the portal and Azure policies to be correctly applied. Ensure that both server the specific service (Azure Hybrid Instance Metadata Service on Windows or azcmagent on Linux) are running.\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where parse_json(tostring(tags.{0})) !in~ (\\\"{1}\\\") | where tostring(properties.status) == \\\"Disconnected\\\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago(totimespan(policyThresholdString)) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"resourceIdColumn\": \"id\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", "$fxv#12": { "type": "Microsoft.Authorization/policySetDefinitions", @@ -2700,14 +2700,14 @@ "policyDefinitionGroups": null } }, - "$fxv#2": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_dataDiskWriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Data Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMdataDiskWriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#3": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_HeartBeat_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM HeartBeat Alert\",\r\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT6H\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMHeartBeatAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#4": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_NetworkIn_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Network Read Alert\",\r\n \"description\": \"Policy to audit/deploy VM Nework Read Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMVMNetworkInAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#5": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_NetworkOut_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Network Write Alert\",\r\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMVMNetworkOutAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#6": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_OSDiskreadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM OS Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMOSDiskreadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#7": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_OSDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM OS Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMOSDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#8": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_OSDiskwriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM OS Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMOSDiskwriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#9": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_CPU_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM CPU Alert\",\r\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity.\",\r\n \"displayName\": \"User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"GreaterThan\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"85\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag name\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\",\r\n \"metadata\": {\r\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\r\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\r\n },\r\n \"defaultValue\": [\r\n \"true\",\r\n \"Test\",\r\n \"Dev\",\r\n \"Sandbox\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\r\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\r\n },\r\n {\r\n \"field\": \"identity.userAssignedIdentities\",\r\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"type\": \"String\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"type\": \"Array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMCPUAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[parameters('UAMIResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine CPU\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"UAMIResourceId\": {\r\n \"value\": \"[[parameters('UAMIResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"MonitorDisableTagName\": {\r\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\r\n },\r\n \"MonitorDisableTagValues\": {\r\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", + "$fxv#2": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_dataDiskWriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Data Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMdataDiskWriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#3": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_HeartBeat_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM HeartBeat Alert\",\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT6H\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMHeartBeatAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#4": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_NetworkIn_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Network Read Alert\",\n \"description\": \"Policy to audit/deploy VM Nework Read Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMVMNetworkInAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#5": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_NetworkOut_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Network Write Alert\",\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMVMNetworkOutAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#6": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_OSDiskreadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM OS Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMOSDiskreadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#7": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_OSDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM OS Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMOSDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#8": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_OSDiskwriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM OS Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMOSDiskwriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#9": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_CPU_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM CPU Alert\",\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"85\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMCPUAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\n \"description\": \"Log Alert for Virtual Machine CPU\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", "cloudEnv": "[environment().name]", "defaultDeploymentLocationByCloudType": { "AzureCloud": "northeurope",