Fixed inconsitency in query between existenceCondition and alert

Azure · Oct 17, 2024 · d0e5995 · d0e5995
1 parent 339268c
commit d0e5995
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-Disconnected-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-Disconnected-Alert.json
@@ -8,7 +8,7 @@
     "displayName": "Deploy Hybrid VM Disconnected Alert",
     "description": "Policy to Deploy Hybrid VM Disconnected Alert",
     "metadata": {
-      "version": "1.3.1",
+      "version": "1.3.0",
       "category": "Hybrid Compute",
       "source": "https://github.com/Azure/azure-monitor-baseline-alerts/",
       "alzCloudEnvironments": [
@@ -285,7 +285,7 @@
               },
               {
                 "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query",
-                "equals": "[[format('let policyThresholdString = \"{2}\"; arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | where parse_json(tostring(tags.{0})) !in~ (\"{1}\") | where tostring(properties.status) == \"Disconnected\" | extend appliedThresholdString = iif(tags contains \"_amba-Disconnected-threshold-Override_\", tostring(tags.[\"_amba-Disconnected-threshold-Override_\"]), policyThresholdString) | extend appliedThreshold = totimespan(appliedThresholdString) | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate >= ago(appliedThreshold) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]"
+                "equals": "[[format('let policyThresholdString = \"{2}\"; arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | where parse_json(tostring(tags.{0})) !in~ (\"{1}\") | where tostring(properties.status) == \"Disconnected\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago(totimespan(policyThresholdString)) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]"
               },
               {
                 "field": "identity.userAssignedIdentities",