[Question/Feedback]: Action groups with other than email for distribution

[KapitanIglu]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Description

Hi,
first of all I like the whole concept here. I am currently working on implementing it in a bigger scale for my company.
You stated in the documentation:

We may investigate and implement alternative or additional actions in the future (e.g. configure alternate email distribution groups depending on the subscription/service or workload owners/etc.).

Are you still considering that?
I just wanted to highlight it as a very sought after feature on my site ;)

[arjenhuitema]

Hi @KapitanIglu,

Thanks for your feedback. Yes we are, actually, it´s actively being developed. You will soon be able to configure the action group to use other actions like: (Note that this will require an existing EventHub/ Logic App etc.)

• EventHubs
• Logic App
• Webhook
• Secure Webhook

I will leave this issue open and will tag you when these features are merged.

[gerrynicol]

On this topic, I am also keen on seeing this developed, so thats great news :). I customised the previous incarnation of the AMBA to use Webhooks which worked well with existing Logic Apps. One other aspect of this that would be benefial is the splittling out of the Action Groups per Alert type. i.e An action group for ResourceHealth, One for ServiceHealth etc. In that way the alerts can then be picked up by specigic Logic Apps.

[alexeyzolotukhin]

@arjenhuitema To add something on the topic of Actin Groups. I believe AMBA needs a more flexible way of defining Alert Groups and / or Alert Processing Rules. Consider even a basic scenario:

Platform team deploys AMBA. The deployment adds and assigns all the policies and creates one action group with the email addresses of the people specified in the parameters file. Those people are most likely a part of the platform or core team.

Then the platform team deploys a landing zone for the dev team. AMBA creates another Action Group with the SAME people listed as email recipients. The dev team deploys an AKS cluster in their LZ and all the AKS alerts go to the platform guys and not to the dev team.

Currently I don't see any way to customize this behavior besides creating our own Action Groups and ignoring the ones that AMBA creates. Is this something the team is considering to add? Are there better patterns to follow than the one I outlined?

Thanks!

[arjenhuitema]

@alexeyzolotukhin thank you for your feedback.

More flexibility for action groups and actions is in development and should be available in January. The following actions will be implemented:

1. Web and secure webhook
2. Logic Apps
3. EventHub
4. ARM roles
5. Azure Function
6. Automation Runbook

You could then leverage the functionality in Logic Apps and Event hubs to meet your requirements. This considers that you have an existing Logic App or EventHub, if not you will need to be build them before being able to use them for AMBA.

• Stream Azure monitoring data to an event hub or external partner
• Customize alert notifications by using Logic Apps

Additionally, depending on your RBAC configuration, your could leverage sending notifications to ARM roles. Note that as of writing the email is only sent to Microsoft Entra ID user members of the selected role, not to Microsoft Entra groups or service principals. Sending email to groups is coming (I dont have an ETA).

• Email Azure Resource Manager